Hosting your South African business data in Germany or Romania: POPIA section 72 explained

A practical guide for South African businesses, developers and agencies deciding where to host customer data. Status as of 30.09.2026. This is general information, not legal advice.

Short answer

1. 1The Protection of Personal Information Act 4 of 2013 (POPIA) governs personal information processed by South African responsible parties, and section 72 covers transfers to a recipient in a foreign country.
2. 2Section 72(1) allows such a transfer only if one of five conditions applies: adequate protection binding the recipient, the data subject's consent, necessity for a contract with the data subject, necessity for a contract in the data subject's interest, or a benefit to the data subject where consent cannot reasonably be obtained.
3. 3Renting a server in Frankfurt means the host is a foreign recipient, so you should document which condition you rely on, usually a written contract that binds the host to comparable protection.
4. 4The responsible party stays accountable. A hosting provider does not certify POPIA compliance for you.

What POPIA section 72 says

The Act. POPIA is Act 4 of 2013. According to the South African government's page on the Act, it commenced in phases: 11 April 2014 for section 1 and sections 39 to 54, and 1 July 2020 for sections 2 to 38 and 55 to 109. Section 72 falls in the second range.

The rule. Section 72(1) prohibits a responsible party in South Africa from transferring personal information about a data subject to a third party in a foreign country unless one of five conditions is met.

• The recipient is subject to a law, binding corporate rules or a binding agreement that provides adequate protection, substantially similar to the POPIA conditions for processing and including limits on onward transfers.
• The data subject consents to the transfer.
• The transfer is necessary to perform a contract between the data subject and the responsible party, or to implement pre-contractual measures the data subject requested.
• The transfer is necessary to conclude or perform a contract in the interest of the data subject between the responsible party and a third party.
• The transfer benefits the data subject, it is not reasonably practicable to obtain consent, and the data subject would be likely to give it.

For hosting. The first condition is the one most hosting arrangements rely on, through a written contract that binds the host to protect the information in a comparable way. That is our reading of the text, not legal advice, and we did not open Information Regulator guidance on transfers. For this reason this page names no adequacy list and no penalty figures.

Real-world examples

Common mistakes

• Assuming that a server outside South Africa takes your data outside POPIA. Your obligations as a responsible party stay with you wherever the server stands.
• Not knowing which section 72 condition you rely on, or relying on consent that was never collected.
• Having no written contract with the host that requires comparable protection.
• Forgetting to tell customers in your privacy notice that their information is hosted abroad.
• Treating security as a one-time setup instead of testing backups, access and updates regularly.

How 4hosting helps

Our datacenter is in the EU, in Frankfurt, not in South Africa. We say this plainly so that you can describe the destination of your data accurately, and so that you expect somewhat higher latency than from a local server. We offer a data processing agreement (DPA) under GDPR Article 28 and standard contractual clauses for transfers. Which section 72 condition you rely on is for you and your adviser to decide.

Every plan includes monthly DevOps, CyberSecurity and Programming hours (from cPanel Advanced upwards; VPS plans include 1 to 8 hours). You can use them for server hardening, backups, access control and WAF rules. Hours are requested from the client panel and do not carry over; work beyond the included hours is accepted and billed separately. 4hosting is not a compliance certifier and does not sign legal compliance for you. Migration is free. Support is in English and Romanian.

Frequently asked questions

See also

• 4hosting for South Africa
• Contact us about your setup