Data extraction: The university that cannot see itself

This article first appeared on University World News

A faculty officer writes to ask a simple question. Of the students who entered this programme three years ago, how many are still with us, and where did the others go? It is a reasonable question. It is arguably the only question. Answering it means going to a system and asking where the answer is kept.

Most days this is unremarkable work, and its unremarkableness is the point. That query is not administration. It is the institution perceiving its own state – the act on which every other act of planning quietly depends.

What I have begun to notice, doing this work, is how much of what the university knows about itself is now held under terms the university did not write.

The organ, not the asset

A university is an odd sort of system. It produces its own elements and continues only by observing what it has just produced. Enrolment, progression, throughput, attrition, the slow signal that a curriculum has stopped working some years before anyone will say so aloud – these are not management reporting. They are perception. An institution that loses its records has not suffered an inconvenience. It has lost its memory, and with it any way of telling whether it is getting better or worse at the only thing it does.

This is why I have come to distrust the vocabulary in which we usually conduct this argument. We reach, understandably, for the language of extraction: our data taken, shipped, monetised elsewhere, the continent mined once again by parties who leave little behind. That account is not wrong. It is merely too flattering to us, because it describes a theft of something we still imagine we possess.

We speak of institutional data as an asset. Assets can be leased without much consequence; that is rather the point of them. But this is not an asset. It is the organ with which the institution sees.

The question, then, is not who profits from our data. It is whom we must ask for permission to know ourselves.

What actually leaves

The most interesting evidence here comes not from critics of the technology industry but from regulators, who have lately begun to describe African universities, in official documents, as the weaker party to their own arrangements.

Kenya’s Office of the Data Protection Commissioner, in its guidance note for the education sector, identifies cloud-based solutions as a high-risk area. The most significant issue, it says, is the minimal control over the data and over the setup of the system itself. Terms and conditions are determined by the service provider; educational institutions, as data controllers, have very little power. That is not an activist’s sentence. It is a regulator’s.

On 19 February this year, Nigeria’s Data Protection Commission issued a compliance notice to the education sector – universities, polytechnics and colleges among them – requiring evidence of compliance audit returns and of a designated data protection officer by 11 March, failing which it warned of enforcement orders, administrative fines and criminal prosecution.

And the continental instrument has arrived at last. The African Union’s Malabo Convention entered into force on 8 June 2023, nine years after its adoption, when Mauritania became the fifteenth state to ratify it. It governs processing undertaken in the territory of state parties. On controllers and processors established outside the continent, commentators note, it is unclear.

Read those three together and a shape appears. The law has arrived. It points inward, at the university. And it largely stops at the water’s edge.

The missing number

At about this point, an essay of this kind reaches for a statistic, and there is one conveniently to hand. More than 80% of African data, we are told, is hosted outside the continent, on estimates by the International Finance Corporation and the GSMA.

I went looking for that study. It is not there. Every publication citing the figure is citing another publication; the industry report at the end of the chain asserts it without a footnote; and neither institution appears to have published anything of the sort. The number is not disputed. It is unfathered – repeated so often, and so confidently, that the absence of a parent has stopped being noticeable.

We should resist filing this under gaps in the literature. It is not a gap. It is a reading. A continent that cannot establish where its own institutional records are kept has told us something quite exact about the condition of its self-observation – more exact, as it happens, than the missing statistic would have.

What can be verified concerns buildings rather than records. Africa holds well under one per cent of global data-centre capacity, and more than two-thirds of what exists on the continent sits in South Africa. Useful facts, both. Neither tells a registrar in Kumasi where her students’ records are tonight.

Three serious objections

I would rather meet the counterarguments than be met by them, and there are three that deserve better than a wave.

The first comes from the African Union itself. Its Data Policy Framework affirms that member states may formulate digital rules in line with their national interests, and cautions in the same breath that localisation must be weighed against its harms and must not become protectionism in a security uniform. The AU distinguishes sovereignty as the right to make rules from sovereignty as a storage location, and leans deliberately away from the second. Anyone arguing this case owes that document an honest reading.

The second objection is physical. Nigeria’s data centres draw something in the order of 137 megawatts from a grid that supplies, on average, about four hours of power a day. When a billion-dollar Microsoft and G42 data-centre project in Kenya stalled, it stalled partly over the long-term capacity guarantees the partners sought from the state: foreign capital willing to build locally, on terms that relocated the risk locally as well.

The third is arithmetic. Fifty-four national clouds is not a strategy; it is fifty-four subscale facilities, and the people who point this out are right to.

Now notice what none of these is an objection to. Each is an objection to one particular remedy. None of them is an objection to knowing where your own records are.

Custody

So I want to argue for something smaller, and more stubborn, than the thing usually argued for here.

Not that every university should build a data centre. Most should not, and those that try will do it badly at first and expensively for a long while afterwards. What every university should hold is custody: a readable copy of its own records, in a schema it controls, kept somewhere it can reach without asking, refreshed on a cadence it sets, and demonstrably surviving the end of the contract that produced it.

Custody is not a construction programme. It is a clause, plus a test performed once a year to establish that the clause is still true. It costs whatever it costs to insist at signature rather than at renewal – which is to say, very little, and the willingness of somebody senior to be briefly unpopular in a procurement meeting.

It is also the more urgent thing, because what ends an institution’s memory is rarely a geopolitical rupture. It is a migration. A lapsed licence. A vendor acquired by another vendor. An export format nobody thought to open until the year they needed it.

That domestic capacity can be built is not in doubt. Uganda’s research and education network took its backbone from 10 to 200 gigabits per second, completed in October 2025 – a twenty-fold increase. It is worth telling the second half of that sentence too: the equipment was donated by Norway’s national research network. Both halves are true, and the second is the more instructive. It is also the reason to begin with custody rather than with concrete.

What the instrument returns

An instrument you do not own can still be pointed at you. The readings it returns may well be accurate; they usually are, and the vendors who supply them are withholding nothing out of malice. What you cannot do is check them, keep them, or ask the instrument a question it was not designed to answer.

A university in that position is not being robbed of anything it would miss by Friday. It is being read – attentively, continuously, competently, by somebody else – while it waits to be told what it is.

We should prefer to hold the lens ourselves. It is, after all, pointed at us.