Appointment of a Service Provider to Conduct Due Diligence on the South African Cities Network (sacn) Regarding the Future of the Organisation and Implications on Legal, Financial and Governance.

Cloud and Hosting Procurement in South Africa: SITA, Data Sovereignty and Compliance in 2026

Security contractors in Gauteng are entering 2026 under heightened scrutiny: every cloud or hosting service that stores, processes or transmits any state data must now prove full data-sovereignty, localisation and residency compliance before a security guarding or electronic security tender can even reach adjudication. National Treasury’s Instruction 2025-11 (effective 1 April 2026) makes SITA’s Cloud Framework Agreement 2.0 mandatory for national and provincial departments, while the Information Regulator’s 2025 enforcement guidance treats non-compliant hosting as an automatic POPIA breach. For security firms, the risk is immediate—if the CCTV archive, access-control database or guarding-management platform is not demonstrably hosted inside South Africa with verified local data custodians, your bid is rejected at box-tick.