The Provision of Technical Advisory Services to the Government Technical Advisory Centre (gtac) for the Intergovernmental Relations (igr) Division to Support in the Implementation of the Municipal Finance Improvement Programme (mfip) Phase Iiix 2 X Asset Management Advisors

Cloud and Hosting Procurement in South Africa: SITA, Data Sovereignty and Compliance in 2026

Security contractors in Gauteng are entering 2026 under heightened scrutiny: every cloud or hosting service that stores, processes or transmits any state data must now prove full data-sovereignty, localisation and residency compliance before a security guarding or electronic security tender can even reach adjudication. National Treasury’s Instruction 2025-11 (effective 1 April 2026) makes SITA’s Cloud Framework Agreement 2.0 mandatory for national and provincial departments, while the Information Regulator’s 2025 enforcement guidance treats non-compliant hosting as an automatic POPIA breach. For security firms, the risk is immediate—if the CCTV archive, access-control database or guarding-management platform is not demonstrably hosted inside South Africa with verified local data custodians, your bid is rejected at box-tick.