South Africa: Cloud in Oil and Gas

To support the world’s expanding economies and populations, many in the oil and gas (O&G) sector are looking for new ways to keep up with a growing demand for dwindling natural resources. Upstream, midstream, and downstream O&G businesses are quickly shifting away from using the cloud primarily for infrastructure. The cloud is becoming an enabler for successful digital transformation, helping to optimize exploration and production. The O&G sector needs better, faster, and cheaper ways to manage and analyse increasing amounts of data. The cloud offers the solution. It gives companies an ability to vastly improve operational excellence, safety, and productivity, using cloud technologies like advanced analytics, machine learning, and Artificial Intelligence; all of which enable the real-time use of information to deliver more effective decision-making and business process efficiencies.

Currently, the SA O&G industry is characterised by a fragmented regulatory regime, with different regulators and laws regulating different activities in the upstream, midstream, and downstream sectors, including:

• O&G and mining industries¹
• the construction and operation of petroleum pipelines, loading facilities, and storage facilities²
• the downstream sector in respect to the licensing of wholesalers, retailers, and manufacturers of petroleum products³
• the construction and operation of gas transmission, storage, distribution, liquefaction, and re-gasification facilities, and trading in gas⁴
• various activities requiring environmental authorisation, including oil and gas exploration, production, and decommissioning⁵
• the import and export of petroleum and petroleum products⁶
• the imposition of royalties on the transfer of mineral resources⁷
• the administration of matters in connection with the imposition of royalties on the transfer of mineral resources⁸
• the taxation of oil and gas activities in South Africa⁹.

• Who are the regulators?

  The key regulators for the O&G industry are:

  • Department of Mineral Resources, which administers the Mineral and Petroleum Resources Development Act (MPRDA) and is the competent authority to issue environmental authorisations under the National Environmental Management Act (NEMA) where the listed activities are directly related to prospecting/exploration or extraction and primary processing of a mineral/petroleum resource
  • Department of Energy, which is the controller of petroleum products within the Department of Energy and the licensing authority under the Petroleum Products Act
  • Petroleum Agency of South Africa (Agency), which promotes exploration for onshore and offshore oil and gas resources and their optimal development on behalf of the South African government. The Agency regulates exploration and production activities, and acts as the custodian of the national petroleum exploration and production database
  • National Energy Regulator of South Africa (NERSA), which administers and is the competent licensing authority under the Petroleum Pipelines Act and the Gas Act.

• Are cloud services permitted?

  The use of cloud services is not expressly addressed in any particular SA O&G legislation. There may however be laws of application to the SA O&G industry which may need to be taken into account (see below). In making the decision to move to the cloud, it is crucial for industry participants to consider and ensure compliance with all applicable legislation.

  The use of cloud services is not expressly addressed in any particular SA O&G legislation. There may however be laws of application to the SA O&G industry which may need to be taken into account (see below). In making the decision to move to the cloud, it is crucial for industry participants to consider and ensure compliance with all applicable legislation.

• What are the sector-specific laws and guidelines that need to be considered?

  There is presently no uniform regulation of cloud services in SA. Role-players within the O&G industry would, however, need to be mindful of certain regulatory provisions in moving to the cloud, including provisions:

  • precluding disclosure of certain types of information and data¹⁰
  • for certain licensed activities, prescribing where certain types of records and data must be held¹¹
  • requiring the submission of complete and correct data¹². There is therefore an imperative to store information in a manner which ensures integrity of data and security
  • regulating confidentiality¹³

  In addition, there may also be licence and/or contractual provisions (including confidentiality undertakings)¹⁴ which may need to be considered.

• Is approval needed?

  Approval is not required from any O&G regulator, as none of the O&G sector legislation specifically address cloud services.

  An O&G industry participant which is an organ of state (such as a national oil company) may be required to follow specific procurement processes in procuring cloud services under applicable public procurement laws. This may necessitate certain approvals but any such requirement is unlikely to relate specifically to the aspect of cloud computing.

• What are the audit / inspection requirements?

  O&G regulators possess fairly broad inspection powers which include the power to search and seize a wide range of information and records.¹⁵

• What are the data transfer requirements?

  There are no offshore data transfer requirements specific to the O&G industry.

  However, the processing of personal information will soon be regulated under the Protection of Personal Information Act 4 of 2013 (POPIA). Under POPIA, personal information may be transferred out of South Africa as long as the requirements of POPIA are met. POPIA permits the transfer of personal information to a third party who is in a foreign country in specific circumstances, including if the recipient is subject to a law, binding corporate rules or binding agreement which provides an adequate level of protection as contemplated in POPIA, or with the person's consent.¹⁶

  Microsoft holds itself accountable to, and is subject to laws of regions in which it maintains data centres, and has binding agreements which, in our view, provide adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft is also committed to ensuring that its products and services comply with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.

• Footnotes

  ¹The Mineral and Petroleum Resources Development Act No. 28 of 2002
  ²The Petroleum Pipelines Act No. 60 of 2003
  ³The Petroleum Products Act No. 120 of 1977
  ⁴The Gas Act No. 48 of 2001
  ⁵The National Environmental Management Act No. 107 of 1999
  ⁶The International Trade and Administration Act No. 71 of 2002
  ⁷The Mineral and Petroleum Resources Royalty Act 28 of 2008
  ⁸The Mineral and Petroleum Resources Royalty (Administration) Act 29 of 2008
  ⁹Tenth Schedule, Income Tax Act, No 58 of 1962
  ¹⁰Section 30(2) of the MPRDA provides that no information or data may be disclosed to any person if it contains information or data supplied in confidence by the supplier of the information or data.
  ¹¹Section 69(2)(a) of the MPRDA, as read with sections 21 and 28, requires the holder of an exploration right and/or reconnaissance permit to keep proper records, at its registered office or place of business, of reconnaissance or exploration operations and the results and expenditure connected therewith, as well as borehole core data and core-log data, where appropriate. This applies to exploration and reconnaissance for O&G. In relation to production, there is currently no analogous requirement, however the legislature seems to have recognised this lacuna and is seeking to amend this in terms of Mineral and Petroleum Resources Development Amendment Bill B15D of 2013.
  ¹²The MPRDA requires rights holders and applicants to submit information which is complete and correct (including under section 43). Rights granted under the MPRDA may also be cancelled, suspended or revoked for submission of inaccurate, false, fraudulent, incorrect or misleading information (including under section 47).
  ¹³Section 30(5) of the MPRDA stipulates that any data, information or reports lodged with the Council for Geoscience must be kept confidential for a certain period of time. Furthermore, under section 29 of the Gas Act, no information obtained by NERSA which is of a non-generic, confidential, personal, commercially sensitive or proprietary nature may be made public or otherwise disclosed to any person without the permission of the person to whom that information relates, except in terms of an order of the High Court.
  ¹⁴These include those required in relation to any granting instrument and information or data obtained through and from the Agency. In addition, section 21(1)(c) of the Gas Act provides that NERSA may impose licence conditions relating to certain requirements and limitations, including that the gas transmission, storage, distribution, trading, liquefaction and regasification activities of vertically integrated companies must be managed separately with separate accounts and data and there must be no cross-subsidisation.
  ¹⁵Section 91(4) of MPRDA allows for broad powers of entry, search and seizure, including the right to inspect any book, record, statement or other document including electronic records, documents or data and for making copies or excerpts. Sections 41(1) and 45(g) of The International Trade and Administration Act also grants an investigating officer broad powers of entry, search, inspection and seizure, including the right to use any computer system on the premises to search for any data contained in or available to that computer system and to reproduce any record from that data. Section 29 of the Gas Act allows for NERSA to authorise a person to enter any property on which a licensed activity is taking place to (i) inspect any facility, equipment, machinery, book, account or other document found on that property; and (ii) require any person to furnish NERSA with such information as may be necessary for the proper application of the Gas Act.
  ¹⁶Section 72 of POPIA.