Digital Sovereignty in the Middle East and Africa: Trust, Control, and Resilience Beyond Data Localisation 

By Alessandro Liotta, EMEA Regulatory Affairs Lead, Fortinet

Digital sovereignty is becoming a strategic priority across the Middle East and Africa. Governments are investing in domestic cloud capacity, artificial intelligence (AI), data centres, and national cybersecurity solutions. 

At the same time, organisations, particularly in public administration, critical infrastructure, and regulated industries, are reconsidering how much control they retain over the technologies on which their essential services depend.

There is no single regional model. Saudi Arabia, the UAE, South Africa, Egypt, and Morocco (to name a few jurisdictions in the region) have different legal systems, security priorities, and levels of digital maturity. Some policies impose or encourage domestic processing for sensitive data, while others concentrate on cloud security, national AI capacity, trusted data flows, or the development of local infrastructure.

Nevertheless, a common direction is visible across the region: Sovereignty is evolving beyond the physical location of data. It increasingly concerns effective control over data, infrastructure, security, operational continuity, and supplier relationships.

For CISOs and C-level compliance leaders, this requires a more sophisticated approach. The nationality of a technology provider can be relevant, particularly where national-security interests, sensitive government information, or critical systems are involved. But nationality alone does not demonstrate that a provider is secure, resilient, or trustworthy. Trust must be supported by evidence, and sovereignty must remain operational when systems are attacked, disrupted, or transferred to alternative providers.

Different National Approaches, Common Strategic Concerns

Saudi Arabia has developed especially detailed requirements for cloud security and personal data governance.

The National Cybersecurity Authority’s Cloud Cybersecurity Controls establish minimum requirements for both cloud providers and cloud tenants and expressly address data-localisation requirements. However, the Saudi framework is not based solely on preventing international transfers. The Personal Data Protection Law and its transfer rules permit transfers outside the Kingdom under defined conditions, including adequate protection or safeguards such as standard contractual clauses, binding common rules, and certifications.

The emerging Saudi Arabia approach therefore combines national control with managed international data flows.

This is also reflected in the exploration of sovereign-cloud models intended to preserve domestic controls while partnering with international cloud and AI providers. The Saudi kingdom has already announced a few international partnerships.

The UAE has made the broader concept of sovereignty particularly explicit. Its National Cloud Security Policycovers data location and sovereignty as well as contractual protection, data lifecycle management, identity, incident response, supply chain risk, and cloud resilience. Significantly, it includes interoperability and portability requirements intended to allow customers to use different providers, switch more easily, and protect themselves against vendor lock-in.

The UAE’s approach demonstrates why localisation cannot be considered in isolation. Knowing where information is stored is important, but so is knowing who can administer it, how it is encrypted, which subcontractors are involved, what evidence is available after an incident, and whether the customer can migrate its data and services. The UAE’s new National Cyber Security Policy for Artificial Intelligence applies the same logic to AI through governance, secure design, change control, privacy compliance, and third-party risk management.

South Africa’s National Data and Cloud Policy meanwhile seeks to promote data sovereignty, local infrastructure, and secure, reliable cloud services while also enabling competition and reducing regulatory barriers. The government has previously identified domestic storage as especially important for critical data, while clarifying that this does not amount to a general requirement for all data to be stored in national infrastructure.

South Africa therefore illustrates the need for data classification. Not every dataset or workload presents the same sovereignty risk. Critical operational systems, government information, ordinary corporate data, and publicly available information may justify different controls. Personal-data transfers are also governed by section 72 of the Protection of Personal Information Act, reflected in the information regulator’s official material on transborder information flows.

Egypt is also positioning itself as a regional data and technology hub. The National Telecommunications Regulatory Authority’s data-centre and cloud regulatory framework aims to attract hyperscale data centres, cloud providers, and international expertise while supporting Egypt’s digital transformation. Its model therefore connects national capability with foreign investment and competitive markets.

Egypt’s National AI Strategy for 2025–2030 reinforces this direction through infrastructure, data governance, skills, responsible AI, and innovation. These initiatives create economic opportunities while concentrating on valuable data and compute and digital services in increasingly interconnected environments. Cybersecurity becomes essential to protecting both national investment and customer confidence.

Morocco has adopted a more prescriptive approach for particularly sensitive cloud use. Decree No. 2-24-921 establishes a qualification regime for providers serving public entities and critical infrastructure with sensitive systems or data.

The Direction Générale de la Sécurité des Systèmes d’Information clarified that relevant providers must demonstrate expertise, organisational and technical security, and trustworthiness. For sensitive information systems, the framework also requires qualifying providers to be established as Moroccan legal entities and to operate and administer relevant systems from within Morocco.

However, nationality is only one component of assurance. The qualification regime examines personnel, competence, technical controls and organisational measures. Morocco’s National Cybersecurity Strategy to 2030 similarly seeks to build a trusted digital environment by strengthening governance, institutions, skills and national resilience.

Sovereignty Must Survive Operational Reality

These policies point to an important conclusion: Data localisation may establish jurisdictional control, but it does not by itself create cyber resilience.

Locally hosted infrastructure can still be compromised through stolen credentials, vulnerable software, insecure APIs, misconfiguration, insider activity, or weaknesses in the technology supply chain. It can also become unavailable through ransomware, infrastructure failure, or a destructive attack. A sovereign system that cannot withstand disruption is sovereign in name only.

Organisations should therefore assess whether they retain practical control throughout the service lifecycle.

Can they determine where data and security telemetry are processed? Can they manage encryption keys and privileged access? Do they receive usable logs and timely incident information? Can security policies be applied consistently across cloud, on-premises, and operational-technology environments? Can data, configurations, and workloads be exported in usable formats? Is there a credible, tested exit plan?

Cybersecurity Partners as Sovereignty Enablers

Cybersecurity partners have a central role in making sovereign infrastructure secure and usable. New national clouds, AI platforms, and data centres will become high-value targets. They require comprehensive protection across identities, applications, networks, workloads, data, and operational technology (OT) systems.

A trusted partner must empower customers to maintain visibility and control across these diverse environments without creating isolated technology silos. Through an integrated platform approach, such as the Fortinet Security Fabric, organisations can achieve open integration, consistent policy enforcement, and strong segmentation.

This unified architecture ensures usable security data and coordinated incident response, backed by continuous threat intelligence from entities like FortiGuard Labs. Furthermore, a trusted partner must remain transparent about supply chain security, software development practices, and access controls.

Trust should therefore be assessed through demonstrable capabilities: a rigorous secure-by-design philosophy, independently validated cybersecurity controls, and localised offerings like FortiSASE (Secure Access Service Edge) tailored for highly regulated environments. Crucially, a partner must offer strong local and regional support – demonstrating sustained investment in the Middle East to meet distinct national and sector-specific regulatory requirements while maintaining transparent data practices.

For critical infrastructure and public administration, digital sovereignty cannot be reduced to choosing between domestic and foreign technology. The better question is whether the organisation remains secure, resilient, and in control, regardless of where disruption originates.

Sovereignty begins with jurisdiction and location, but it is completed through trust, portability, operational resilience, and freedom of action.