The first cloud workload at the Tankwa Gambling and Betting Board, the fictional provincial regulator in this series, was meant to be simple: an online form for licence renewals. Within a month the project team had to answer questions it had not expected. Could the form's attachments sit in the same storage account as the analytics team's test data? Who could see a key employee's criminal-record disclosure? Where would the audit logs go, and for how long? Could a contractor who built the form also read the inspection reports in the next folder?
None of those questions is about the form. They are about the environment the form runs in. Without answers, every new workload repeats the same arguments, and the regulator's most sensitive information ends up wherever the last project put it.
A cloud landing zone is a serviced estate, not an empty subscription sets out the general idea: a governed foundation with identity, networking, security, management and policy already in place before workloads arrive. This article applies it to a public regulator. Part 3 described risk-based supervision. That needs data from many sources in one place, which makes the foundation more urgent, not less. Legal references here are general information, not legal advice.
What makes a regulator's estate different
Most organisations hold a mix of public, internal and confidential information. A regulator holds four kinds of information that each need different handling, often about the same licensee.
- Licensee commercial information. Returns, financial statements, ownership structures and business plans. Licensees submit them because the law requires it, and they expect them to stay confidential.
- Personal information. Applicant and key-employee details, probity disclosures, punters who register as excluded persons and complainants. The Protection of Personal Information Act applies, and some categories, such as criminal-behaviour information, carry stricter conditions.
- Supervisory and enforcement intelligence. Inspection findings, informant information, investigation files and information related to the FIC Act. Under the FIC Act, information about suspicious-transaction reports is subject to strict disclosure limits. The Financial Intelligence Centre's guidance (PCC 45, listed in its reference guide) covers how such information may be shared with supervisory bodies.
- Decision records. Licence decisions, reasons, appeals and reviews. They are likely to be public records, in which case archives legislation governs how long they are kept and how they are disposed of, and they may be needed in court years later.
The government's National Data and Cloud Policy (Gazette 50741, 31 May 2024) adds a cloud-first principle and states, at paragraph 15.4.2, that government data "pertaining to the protection and preservation of national security and sovereignty" must be stored only in digital infrastructure inside South Africa. Whether and how that applies to a provincial gambling regulator's data is a question for its legal advisers. A landing zone should make the answer enforceable once it is given. As POPIA does not say your data must stay in South Africa explains, data protection law and residency policy are different tests and need separate answers.
The zones a regulator needs
The Tankwa board's landing zone separates its estate into zones. Each zone has its own access model, network rules, logging and retention. The point is not the number of boxes. It is that the most sensitive information sits behind the strongest boundaries, and that moving data between zones is a governed act.
- Platform zone. Shared identity, connectivity, security monitoring, key management and the central log store. Run by the platform team, as described in Platform landing zone versus application landing zone.
- Public services zone. The digital front door that Part 5 describes, plus the public licence register. Internet-facing, with external identities for applicants and licensees, and no direct path to the intelligence zone.
- Regulatory operations zone. Licensing case management, returns processing, inspections and tax collection. Most officials work here.
- Supervisory intelligence zone. Investigations, informant records, FIC Act-related information and enforcement case files. Smallest user population, strongest controls, separate administration and separately reviewed access.
- Analytics zone. The risk model and reporting from Part 3. It receives curated, minimised data from the operational zones through defined pipelines. This is the regulator's data landing zone.
- AI zone. Approved models, evaluation and the guardrails that govern AI assistance, as described in What is an AI landing zone?. AI tools read from other zones only through governed interfaces.
- Sandbox. For experiments with synthetic or fully de-identified data only. Nothing from the intelligence zone ever enters it.
Six decisions, applied to a regulator
The six design areas every landing zone must resolve apply here as everywhere. What changes is the content of each decision.
| Design area | Regulator-specific decision |
|---|---|
| Identity and access | Separate identities for staff, inspectors in the field, contractors and external licensees. Privileged roles for the intelligence zone held by named people and reviewed at least quarterly |
| Resource organisation | One management group, folder or organisational unit per zone (the term depends on the provider), so policy is inherited by everything placed in it. Production and non-production separated within each zone |
| Network | Public services zone is the only internet-facing entry. Intelligence zone has no inbound internet path and is reachable only from managed devices |
| Security and monitoring | All zones log to a central store that zone administrators cannot alter. Alerts on bulk access to licensee or intelligence records |
| Governance and policy | Residency, encryption, tagging by data classification and blocking of public storage enforced as policy, not checklists |
| Management and continuity | Recovery targets set per zone. Decision records and the licence register restored first, because the regulator cannot do its work without them |
Evidence by design
A regulator is judged on whether its decisions can be reconstructed. That is a property of the platform as well as of the applications.
Three controls do most of the work.
- A protected log store. Access logs, administrative actions and application audit events go to a central store with immutability or retention locks. Those who administer a zone cannot delete its logs.
- Classification that travels with the data. Every storage location is tagged with the classification of the data it holds, and policy blocks placing intelligence-class data in a zone that is not allowed to hold it.
- Retention that follows the records schedule. Retention is configured per record type and approved by the records manager. Retention is a deletion pipeline, not a schedule shows how to make disposal happen, not only be written down.
Identity is the real perimeter
A regulator's staff work in offices, at licensees' premises and from home. Its licensees are companies whose staff change. Its contractors come and go. A network boundary cannot protect all of that, so identity has to.
- Officials use the regulator's directory with phishing-resistant multifactor authentication and conditional access. Inspectors on site use managed devices.
- Licensees use external identities linked to the licensee's record, with a named administrator at the licensee who manages its own users and is accountable for them.
- Contractors receive time-bound access to specific resources, granted through a recorded request and removed automatically when the engagement ends.
- Workloads use managed identities, not stored passwords, and pipelines deploy with least privilege. Least-privilege as code gives a worked example.
Zero trust security: a practical starting point covers the wider approach.
Plan for agents before they arrive
The Tankwa board does not yet run AI agents that act on its behalf. It may in future, for tasks such as chasing missing documents, preparing inspection packs or routing complaints. When that happens, the question changes from what the AI may know to what it may do.
Agentic landing zones: from governed intelligence to governed action describes the controls: agent identity, policy enforcement, credential brokering, human approval for material actions and incident containment. For a regulator, one rule applies from the start. No agent receives authority to take or communicate a regulatory decision. It may prepare the case. An official decides.
Before the first workload moves
| Decision | Owner | Settled when |
|---|---|---|
| Data classification scheme with examples for each class | Information officer and legal adviser | Every planned workload's data is classified |
| Residency position for each class | Legal adviser, with the accounting authority | Written, and enforced as policy in the landing zone |
| Zone model and who may approve data movement between zones | Chief information officer | Approved and documented |
| Identity model for staff, licensees and contractors | Security lead | Tested with real roles |
| Log retention and protection | Records manager and security lead | Configured and tested by restore |
| Recovery targets per zone | Business owners | Agreed and rehearsed |
| Exit plan: how data and records leave the provider | Chief information officer and procurement | Included in the contract |
The exit plan matters more for a public body than for most organisations. Procurement rules, budget cycles and provider changes all mean that a regulator should be able to move its records without losing their evidential value. Procurement is the first test of AI-native government makes the wider point.
Key points
- A regulator holds licensee commercial information, personal information, supervisory intelligence and decision records, often about the same licensee. Each needs different handling.
- Separate the estate into zones: platform, public services, regulatory operations, supervisory intelligence, analytics, AI and sandbox. Moving data between zones is a governed act.
- Apply the six design areas with regulator-specific content: separated identities, a single internet-facing zone, protected logs, policy-enforced residency and recovery targets that put decision records first.
- Evidence is a platform property: protected logs, classification that travels with the data and retention that follows the records schedule.
- Plan for agents now. No agent receives authority to take or communicate a regulatory decision.
This is part 4 of Regulating a Digital Gambling Economy. Previous: From calendar-based audits to risk-based supervision. Next: One digital front door for licensing and regulatory services.
For the foundations in depth, read the Cloud Foundations, Explained End to End series. For public-sector delivery, see The access gauntlet nobody demos in Shipping AI into the Public Sector and Sovereign AI is more than data residency.
Background reading: National Data and Cloud Policy, Gazette 50741 (31 May 2024); FIC reference guide for all accountable institutions; National Gambling Act 7 of 2004. Checked on 7 November 2026. This article is general information, not legal advice.
How CloudNala can help
CloudNala designs cloud landing zones for public bodies whose data needs more than one level of protection. For a regulator, we start with a data classification workshop with your information officer and legal adviser, then design the zone model, identity approach, logging and retention, and recovery targets, and deliver them as policy and infrastructure as code. We make sure the residency position is enforced rather than just written down, and that the exit plan is in the contract before the first workload moves.
Work with CloudNala
CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.
Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.
Book a Regulatory Technology Review or write to us at consult@cloudnala.co.za