Africa’s Public Data: 100% Local Hosting Targeted by 2030. Who Controls Access?
The Yaoundé Declaration sets an ambition for locally hosting critical public data. Server location alone cannot answer who controls access, backups and disaster recovery.
The key points of this analysis, checked by the editors.
The Yaoundé Declaration presents a 2030 ambition for local hosting of classified critical or sovereign public data.
Location needs to be assessed alongside administrative access, copies and recovery capability.
A percentage becomes measurable when its scope, resources and outcomes are documented.
The Yaoundé Declaration sets an ambition to host 100% of critical or sovereign public data locally by 2030. But a server's physical address does not establish who controls the service. Who holds administrator access, where are backups stored and who can restore operations after a failure? Without documented answers, the headline percentage tells only part of the digital-sovereignty story.
Assessing that promise requires looking at everyday operations. Data can be located domestically while depending on poorly controlled access, copies or skills. The work concerns how a public service is run as well as where its servers stand.
What the Yaoundé Declaration actually targets
The organisers describe shared recommendations, preferring national hosting and then African infrastructure where capacity and the nature of the information permit.
The 100% ambition concerns classified critical or sovereign public data. It should not be extended to every file, company or use across the continent.
The publication alone also does not establish a new national obligation for every administration. The rules applying to a particular institution require examination of its applicable texts, decisions and commitments.
Treating the ambition seriously means identifying the implementation decisions that follow.
Define the data covered before measuring 100%
A 100% target requires a defined set. Which databases are critical? Who classifies them? Are replicas, archives, logs and backups included?
These questions form our first assessment framework. Without an inventory, two institutions could report the same percentage while measuring different things. A useful indicator explains both inclusion and exclusion.
Data should then be connected with its applications, owners and dependencies. That helps identify feasible migrations and services requiring more preparation.
Where do backup copies go?
Consider an illustrative architecture, rather than a real administration: a primary database is hosted domestically while a backup and some logs are sent to another environment.
Stating only that the server is inside the country would conceal part of the journey. Assessment needs to follow copies, protections, access and restoration conditions.
Encryption raises related operational questions. Who administers keys? How are permissions granted and removed? Which records support investigation of an intervention? Control becomes meaningful through operations the institution can explain and verify.
Who can restore a service after an outage?
A public service needs to continue or restart when equipment, a link or a site becomes unavailable. Hosting location alone cannot establish that capability.
Our assessment would examine backups and restoration exercises, network and power dependencies, staff responsibilities and recovery commitments. A documented exercise provides more information than a declaration that backups exist.
Recovery conditions also need testing: what information might be lost, how long could the service remain interrupted and who directs the response? The answers must match the institution’s actual needs.
Build clear responsibilities for operators and suppliers
This direction may interest hosting providers, integrators and security professionals. It establishes neither a volume of contracts nor a quantified employment opportunity.
A public buyer should compare the complete scope, including operations, support, security, exit arrangements and duration. Installation expenditure needs to be accompanied by the recurring costs of keeping the service running.
Exit arrangements deserve particular attention. If the institution changes provider, can it recover usable data, regain its access and continue the service? Requirements should make the answer verifiable.
Make progress measurable for citizens
The user should not need a cabling plan to judge the outcome. They need to use the service, understand an interruption and recover their application afterwards.
We therefore suggest tracking public outcomes such as availability, processing times, explained incidents and demonstrated restoration capability, using consistent scope and methods over time.
A proposed observatory is not a national enforcement mechanism
The organisers' October 21, 2026 statement calls for an African Observatory for e-Government and AI, a barometer, an annual report and a map of digital public services. Signatories are encouraged to identify up to three measurable commitments before the next event. These are proposed monitoring mechanisms, not evidence that a national regulator is already enforcing a 2030 data-hosting requirement in Cameroon.
Trigenys Insight proposes three editorial monitoring indicators, which should not be mistaken for adopted official benchmarks: (1) the number of government datasets classified as critical or sovereign and the proportion hosted domestically; (2) the share of affected services with documented backup locations, administrative access and tested restoration; and (3) actual service availability and recovery times after incidents.
Any credible percentage needs a denominator. The list of covered data, the organisation responsible for classification, the date of measurement and any exceptions should be disclosed. Two authorities can report the same hosting percentage while tracking entirely different sets of systems.
The evidence to publish before 2030
A credible progress report would identify which public datasets are classified as critical, where the primary and backup copies are hosted, who controls administrative access, when recovery exercises were performed and comparable service-availability indicators. These are evaluation criteria proposed by Insight, not evidence that an audit has already been carried out.
The 2030 goal will be credible when public institutions can define their critical-data scope, account for backup locations and access rights, and demonstrate recovery after incidents. Local hosting is one step; retaining the ability to operate, secure and restore essential services is another. Sovereignty should be judged by that evidence, not solely by a data centre's address.
Documentary analysis checked on October 24, 2026 using E-Gov Africa’s published presentation. Technical criteria are Insight’s assessment framework. No hosting service, public contract or recovery system was audited.
Frequently asked questions
Does the ambition concern all African data?
E-Gov Africa’s presentation applies the 100% local ambition to public data classified as critical or sovereign. It should not be extended to every dataset or business.
Does a domestic server guarantee control of data?
Location is one element. Administrative access, subcontractors, backups, keys, contracts and operational continuity also require examination.
Sources and method
Facts that may change over time were checked against the sources below. Observations and interpretations are presented as such in the article.
Could electricity infrastructure help extend fibre in Cameroon? Understand the CAMTEL–SOCADEL agreement, last-mile access and the results users should watch.
