Data Without Borders, Sovereignty Without Guarantees: Cybersecurity Risks of Cross-Border Data Hosting in the Global South, Evidence and Policy Lessons from Mozambique

The digital transformation of public and private institutions across the Global South has produced a paradox: as states digitize government services, financial systems, and citizen records, an increasing share of this data is hosted on servers physically located in the United States, the European Union, and other developed economies. This article develops a taxonomy of the cybersecurity and sovereignty risks generated by this dependency, distinguishing deliberate risks, arising from extraterritorial legal instruments such as the United States CLOUD Act, foreign surveillance regimes, and a concentrated hyperscale cloud market, from non-deliberate risks, arising from undersea cable failures, hyperscaler outages, misconfiguration, and abrupt commercial withdrawal. Using Mozambique as an illustrative case, and situating it within a broader Global South comparative frame that includes Nigeria’s tiered data-localization regime and the African Union’s Malabo Convention, the article shows how an incomplete domestic legal framework, limited local hosting capacity, and heavy reliance on undersea cables transiting a small number of chokepoints compound both categories of risk simultaneously. The analysis draws on legal instruments, regulatory policy documents, and recent infrastructure incidents to argue that digital sovereignty cannot be achieved through data protection legislation alone; it requires parallel investment in domestic hosting capacity, regional interconnection, and reciprocal legal arrangements. The article concludes with a policy framework combining risk-tiered data localization, sovereign and hybrid cloud investment, and regional cooperation mechanisms suited to resource-constrained states, together with implications for cybersecurity education and professional practice.