The industry regulator has published a draft framework setting out proposed obligations for operators that hold South African customer data offshore, with comment open until November.
According to the draft, affected operators would be required to disclose the jurisdictions in which customer data is stored and to demonstrate contractual protections.
The regulator said the framework is intended to provide clarity rather than restrict cross-border data flows. Industry bodies have been invited to make written submissions.