Cloud computing has ceased to be an option and become a strategic necessity for organisations across all sectors. The gains in scale, efficiency, resilience, security, and operational agility have transformed cloud computing into one of the primary catalysts of digital transformation, enabling organisations to modernise infrastructure, optimise costs, and respond more effectively to business demands.

It is in this context that Mozambique has approved the Cloud Computing Regulation (Decree No. 72/2025) and the Data Centres Regulation (Decree No. 71/2025), establishing a new regulatory framework for the use of cloud services and data centre infrastructure in the country. These regulations introduce specific requirements relating to registration, licensing, security, operational continuity, and data protection, with a particularly significant impact on organisations operating in sectors deemed essential.

More than a regulatory change, this represents a significant shift in how organisations must approach the management of their digital infrastructure. In practice, compliance no longer depends solely on the technology used or the reputation of contracted suppliers. It demands an integrated view of data, applications, service providers, technological architecture, security, contracts, processes, and business continuity mechanisms.

The regulations also introduce new requirements relating to the classification of cloud providers and data centres, as well as to the sensitivity of the information processed. Certain sectors are subject to additional requirements regarding the providers they may use and the levels of security and availability demanded. For sectors deemed essential, the new regulatory framework assumes even greater relevance. In these cases, the regulations establish specific requirements relating to the location of primary data centres, the use of appropriately classified infrastructure, and the implementation of robust security and operational continuity mechanisms.

Cloud Compliance Becomes an End-to-End Exercise

But what does this mean in practice for organisations? One of the most significant aspects of the new regulatory framework is that responsibility for compliance no longer rests solely with the organisation itself. The new regulations place an additional burden on the entities that use these services. Ensuring internal compliance is no longer sufficient. In practice, this responsibility translates into a set of areas that organisations must examine carefully:

1. Verifying the legal representation of the cloud provider;

2. Ensuring the appropriate classification of the cloud service provider;

3. Implementing the enhanced security controls required for cloud services;

4. Guaranteeing that the primary data centres used are located on national territory;

5. Ensuring that secondary data centres meet the location, continuity, and recovery requirements defined by the regulations;

6. Securing the safety, resilience, and operational continuity of the data centres.

The message is clear: compliance has become an end-to-end exercise. It is not enough for the organisation to meet its own internal requirements; it is equally necessary to ensure that the cloud services and data centres supporting its operations are aligned with the applicable regulatory requirements.

Compliance is no longer solely an organisational problem. It has also come to depend on whether suppliers themselves meet regulatory requirements. However, one of the greatest challenges for many organisations may lie not in the technology itself, but in identifying the interdependencies between the various regulatory requirements. An organisation may believe it is compliant because it uses an internationally recognised cloud provider and yet still face non-compliance risks related to data localisation, information classification, the continuity mechanisms adopted, or the contractual clauses agreed with its suppliers.

Remote Computing Demands New Rules

It is precisely this combination of factors that makes compliance a more complex exercise than it may initially appear. In many organisations, the adoption of cloud services has taken place over several years, involving multiple providers, different technological solutions, and various types of data. As a result, a consolidated view of the actual level of regulatory exposure — or of the effort required to fully comply with the new requirements — does not always exist.

Additionally, the regulations introduce new obligations in areas such as the maintenance of evidence, updating of records, contractual requirements, and oversight by the regulatory authority. Preparing for this new framework therefore requires a clear understanding of the technical, operational, and legal implications associated with each organisation’s technological model.

Despite the challenges, this new regulation should also be viewed as an opportunity. Organisations that use this moment to review their technological architectures, strengthen their security controls, increase operational resilience, and reinforce their governance models will not only be better prepared to meet regulatory requirements, but also better positioned to accelerate their digital transformation in a sustainable manner.

Ultimately, ensuring compliance with the new Cloud and Data Centre Regulations is not merely a matter of legal obligation. It is about ensuring that technology continues to serve as an enabler of growth, innovation, and digital trust. Organisations that begin this journey in a structured and timely manner will be better placed to transform a regulatory obligation into an opportunity for value creation and a genuine competitive advantage.

Source: Diário Económico
Original article: https://www.diarioeconomico.co.mz/?p=551391