Most conversations about data residency stop at “it is hosted locally”. That is usually enough to satisfy a procurement form and nowhere near enough to answer the question properly.
What POPIA actually says
Section 72 of the Protection of Personal Information Act restricts transferring personal information outside South Africa. It is not a prohibition. A transfer is permitted where the recipient is subject to a law, binding agreement or binding corporate rules providing substantially similar protection, or where the data subject consents, or where the transfer is necessary to perform a contract with them.
So hosting abroad is lawful if you have done the work. The practical difficulty is that the work is ongoing, has to be documented, and has to survive the other party changing their terms. Keeping the data in the country removes the question rather than answering it.
Three reasons it matters beyond compliance
Jurisdiction
Data is subject to the laws of the place it sits and, in practice, the laws binding the company holding it. That can mean foreign legal process reaching data belonging to a South African business. Whether that is a real risk for you depends entirely on what the data is.
Latency
A round trip to Europe is roughly 150 to 180 milliseconds. To a datacentre in Durban or Johannesburg it is single digits. For a browser-based application this is invisible. For someone working in a hosted desktop or an accounting package all day it is the difference between a system that feels instant and one that feels like wading. This is the most underrated argument for local hosting and the easiest to demonstrate.
Being able to prove it
The question that catches people out is not “is it local” but “show me”. You should be able to name the facility, say who operates it, and produce its compliance certifications. If your provider cannot tell you which building your data is in, you do not have a data residency position. You have an assumption.
What we can tell you about ours
Cloud29 infrastructure runs at Teraco DB1 in Durban. Teraco is a carrier-neutral facility, ISO and PCI compliant, independently audited every year. Our own operating procedures on that floor are documented, and we are happy to walk a technical team through them, including cabling standards, backup strategy and incident response.
That is set out in full on our datacentre assurance page, and we mean the invitation on it. If you are doing due diligence on a provider, ours included, ask for the walkthrough.