Cloud data sovereignty: where is your data really stored?

When a Ghanaian business signs up for a cloud service — whether it is Microsoft 365, Google Workspace, Salesforce, or any of the thousands of smaller platforms — there is a question that rarely gets asked and almost never gets answered clearly: where, physically, is our data stored? Is it in Ghana? In Europe? In the United States? In several places at once? And does it matter?

It matters more than most business owners realise. The concept is called data sovereignty, and in an era of tightening data protection laws, growing geopolitical tensions, and increasingly complex regulatory environments, it is a topic every business leader should understand in plain terms.

Why Physical Location Still Matters

Digital data feels weightless and location-less. In reality, every bit of it lives on a physical hard drive or solid-state drive, in a physical building, in a specific country, subject to the laws of that country. When your customer records live in a data centre in Frankfurt, they are subject to German and European Union law. When they live in a data centre in Virginia, they are subject to United States law. These laws can differ dramatically in areas like data access by government authorities, mandatory breach disclosure, and consumer rights.

Ghana’s Data Protection Act 2012 (Act 843) places obligations on organisations that process personal data about Ghanaian citizens, including rules about transferring that data outside the country. Other countries have stricter rules still — for example, Europe’s General Data Protection Regulation (GDPR) imposes sweeping requirements on anyone handling the data of EU residents, regardless of where the business itself is based.

What Your Cloud Provider Actually Controls

All major cloud providers organise their infrastructure into regions, each containing one or more data centres. Microsoft Azure, AWS, and Google Cloud all let you choose which region your data lives in when you create a service. This choice determines where your data physically resides, the applicable legal framework, and in many cases the latency your users will experience.

For Ghanaian businesses, the most commonly chosen regions are in Europe (Ireland, Frankfurt, Amsterdam) and South Africa (particularly for AWS customers using the Africa Cape Town region). Some providers are expanding into Nigeria and other parts of West Africa, which may change the calculus over the next few years.

The Cloud Act and Similar Laws

A specific wrinkle every business leader should understand is the United States Clarifying Lawful Overseas Use of Data (CLOUD) Act, passed in 2018. This law allows US authorities to compel US-headquartered cloud providers to hand over data they hold, regardless of where in the world that data is stored. This means even data you keep in an Irish Azure region could, in theory, be subject to US legal process if the provider is a US company.

Similar concerns exist for providers headquartered in other jurisdictions. The practical response is not panic — major cloud providers go to significant lengths to protect customer data through encryption and legal challenges — but awareness. If your business handles particularly sensitive information, you should understand which legal regimes apply and design accordingly.

Encryption: Your First Line of Defence

The strongest practical protection for cloud data is encryption, both in transit (as it moves across the network) and at rest (while stored on disk). All major cloud providers encrypt data by default, but the real question is who holds the keys. If the provider holds the keys, they technically have the ability to decrypt your data. If you hold the keys — using services like AWS KMS with customer-managed keys, Azure Key Vault, or Google Cloud KMS — the provider cannot decrypt without your cooperation.

For highly sensitive data, some businesses go further and use customer-managed encryption keys combined with Bring Your Own Key (BYOK) models, ensuring that the keys never leave their own control.

Practical Guidance for Ghanaian Businesses

A sensible approach to data sovereignty for most Ghanaian businesses involves a few clear steps. First, know where your data lives. Audit every cloud service you use and document the regions. Second, classify your data. Not all data is equally sensitive. Customer personal data, financial records, and intellectual property deserve more thought than marketing brochures. Third, choose regions deliberately. For personal data about Ghanaian or EU citizens, European regions are often the safest default. Fourth, use encryption with controls you understand. Finally, document your decisions. Regulators appreciate businesses that can show they thought about this, even if their answers are imperfect.

The Bottom Line

Data sovereignty is not a theoretical issue. It is a real, legal, operational concern that every Ghanaian business using cloud services should understand. The cloud is not some borderless digital ether. It is servers in specific buildings in specific countries, governed by specific laws. The sooner you treat those questions seriously, the better prepared you will be for whatever regulatory or geopolitical changes come next.

Let’s Have a Conversation

If you would like help assessing your current cloud data sovereignty posture — identifying where your data lives, which laws apply, and whether your configuration matches your risk appetite — let’s have a conversation. This is one of those topics that rewards thoughtful planning now and punishes neglect later.