Appointment of Service Provider for Provision of Automated Backup Solution for Cloud Services (onedrive, Exchange Online) and Bankseta Endpoints (computers).

Cloud and Hosting Procurement in South Africa: SITA, Data Sovereignty and Compliance in 2026

Security contractors in Gauteng are entering 2026 under heightened scrutiny: every cloud or hosting service that stores, processes or transmits any state data must now prove full data-sovereignty, localisation and residency compliance before a security guarding or electronic security tender can even reach adjudication. National Treasury’s Instruction 2025-11 (effective 1 April 2026) makes SITA’s Cloud Framework Agreement 2.0 mandatory for national and provincial departments, while the Information Regulator’s 2025 enforcement guidance treats non-compliant hosting as an automatic POPIA breach. For security firms, the risk is immediate—if the CCTV archive, access-control database or guarding-management platform is not demonstrably hosted inside South Africa with verified local data custodians, your bid is rejected at box-tick.