Participants identified poor governance as a major risk to data security and privacy in emerging South African smart cities. Fabrègue and Bogoni (2023) emphasise the detrimental impact of inadequate governance on individual privacy and information security within smart cities, citing potential trade-offs between policy efficiency, business profitability, consumer convenience and personal privacy. The absence of accountability and disciplinary action has severely undermined good governance in local government, compromising the provision of basic services. Additionally, the financial instability of local governments, stemming from poor governance, has further hindered public service delivery (Thusi & Selepe 2023). The fiscal year 2021/2022 highlighted this issue, as only 38 out of 257 municipalities received clean audits, underscoring the widespread lack of consequence management and governance failures (Erasmus 2023). This illuminates scepticism about the potential for effective governance in emerging South African smart cities if basic services continue to go undelivered in many communities. Participants reported governance risks associated with non-compliance with data security and privacy legislation as a major concern. Participant 10 highlighted fears about the oversight of new technology implementation, emphasising that regulatory non-compliance poses serious risks. Despite South Africa’s adoption of the National Cybersecurity Policy Framework (NCPF) in 2015, challenges persist in implementing the cybersecurity strategy at the national level (Malatji, Marnewick & Von Solms 2021).

Participants also pointed out governance risks linked to cybersecurity infrastructure, confidentiality concerns and third-party service providers. The absence of secure technology for data storage and transmission, potential misuse of data by third parties and insufficient contractual agreements with vendors pose substantial risks. Participant 6 stressed the need for well-drafted service-level agreements (SLAs) to mitigate security risks arising from interactions between governments, municipalities and the private sector in emerging South African smart cities. Pereira et al. (2018) and Ramparsad (2020) advocate for the adoption of ‘smart’ governance principles in smart cities to effectively address potential risks. Despite challenges faced by emerging South African cities, Ramparsad (2020) suggests that smart principles and initiatives leveraging urban data for enhanced governance should continue shaping their trajectory.

Participants 4 and 10 underscored the challenges associated with insufficient public-private partnerships (PPPs) in emerging South African smart cities. Strengthening PPPs is vital for smart city development, requiring effective collaboration among government agencies, the private sector and civil society organisations to address data security and privacy risks. Overcoming obstacles connected to diverse interests, priorities and varying awareness levels about cybersecurity risks is crucial. Public sector bureaucracy emerged as a significant challenge, hindering quick adaptation to dynamic cybersecurity needs. Administrative hurdles, influenced by political practices within South African municipalities, contribute to challenges such as politically influenced appointments and inadequately skilled personnel (Mncwabe 2020). Participant 6 stressed governance challenges in keeping up with rapid technological advances, relying on the private sector for due diligence on new systems. The general lack of data maturity in smart cities further hamper informed decision-making in smart governance.

Participants also highlighted key challenges linked to governance in emerging South African smart cities. Notably, concerns were raised about the absence of a dedicated national Cyber Security Incident Response Team (CSIRT) for the smart city IoT environment, as mandated by the NCPF (Malatji et al. 2021; State Security Agency [SSA] 2015; Sutherland 2017). Despite the establishment of the National Cybersecurity Advisory Council (NCAC) in 2013 to address organisational cybersecurity deficiencies, evidence suggests limited impact, leaving regulatory compliance, data governance and ethics concerns unaddressed. Monitoring mechanisms, often focussed on post-breach consequences rather than proactive evaluation, were identified as a weakness by Participant 8. Despite the establishment of the NCPF, South Africa lags in comprehensive cybersecurity legislation and engagement with businesses and citizens. Furthermore, Participants 15 and 16 called for appropriate consequences for the misuse of private information and highlighted challenges associated with load-shedding on data security and privacy. Load-shedding can lead to data continuity issues, especially for data centres relying on the national electricity grid, urging organisations to closely monitor schedules, particularly those using cloud storage (Seacom 2023; Thusi, Matyana & Jili 2023).

In addressing governance in emerging South African smart cities, Participant 6 emphasised the necessity of robust data protection and privacy policies. While the introduction of the Protection of Personal Information (PoPI) Act is a positive step, Participant 9 argued that effective implementation and enforcement of these policies are crucial for consistent data and privacy protection across smart city initiatives. Recent studies in Africa advocate for adopting an automated model for data protection compliance and enforcement using semantic web technologies and ontology. These systems streamline compliance checks effectively and identify instances of non-compliance with minimal effort (Tom et al. 2023).

Professional development is considered crucial for ensuring a fair, efficient and sustainable shift towards smart cities. However, the available training to improve the skills of the smart cities’ workforce is significantly restricted and frequently fails to meet the requirements of smart cities (Panagiotakopoulos et al. 2024). Participants raised concerns about the shortage of skilled professionals in the field of data security and privacy in South Africa. Participants 3 and 4 expressed their concerns about a general lack of knowledge and skills among employees, posing risks to citizens’ data and privacy. Participant 5 accentuated the absence of specialised professionals at the municipal level as a significant risk for emerging South African smart cities. The scarcity of cybersecurity skills, including data privacy and protection expertise, is a prominent challenge not only in South Africa but also in the global market (Cornelius 2022). Despite high unemployment rates and numerous educational institutions, the skills shortage persists, attributed to insufficient national ICT planning and coordination (Malatji et al. 2021; Sutherland 2017).

Participant 8 warned that a skills shortage may hinder harnessing benefits from innovations like AI and machine learning in securing citizen data. Participant 11 cautioned against human errors because of skills shortages, risking data loss and operational disruptions without adequate backups or disaster recovery procedures. To mitigate these risks, the South African government can conduct a comprehensive risk assessment of data security and privacy practices (Malatji et al. 2021; Sutherland 2017). Such an assessment, leveraging industry standards, guidelines and best practices, would enhance cyber resilience in smart cities. However, scholarly research on data security and privacy within South African municipalities remains limited (Boyle 2020; Masombuka et al. 2021).

Participants illuminated the significant challenges linked to skill shortages in data security and privacy in emerging South African smart cities. Participant 6 expressed concern about the limited pool of cybersecurity expertise, emphasising the need for knowledgeable individuals to operate complex systems and anticipate threats. The lack of in-house skills contributes to cybersecurity ineffectiveness in South Africa. Addressing this gap requires interventions such as cybersecurity training, workforce diversification, pursuing certifications and educational enhancements organisations (Malatji et al. 2021; Mcanyana et al. 2020; Veerasamy, Mashiane & 2019).

Participant 8 noted the challenges associated with the lack of shared understanding among employees about risks in emerging South African smart cities but suggested that a combination of resources, risk-aware processes and appropriate technology could rectify this issue. Embracing technological advancements is crucial, including endpoint security, data encryption and secure wireless fidelity (Wi-Fi) networks (Cornelius 2022; Ismagilova et al. 2020; Politou et al. 2022). Participant 9 emphasised the need to build capacity and expertise. He further explained the challenges related to establishing a skilled workforce in cybersecurity, especially in developing countries facing a global shortage of professionals. Developing skills requires investment in training, education and professional development programmes. Participant 11 stressed the importance of skills for robust cybersecurity procedures, frequent security assessments and incident response plans to safeguard smart city infrastructure. Participant 15 highlighted the essential role of skills in establishing appropriate data protection infrastructure. Participant 16 noted the challenges related to the scarcity of skilled resources in managing data security and privacy, attributing it to factors like the absence of cybersecurity courses, limited funds for training, rapid technological advancements and an expanding threat landscape. These findings are corroborated by existing literature (Backhouse, Karuri-Sebina & Guya, 2020; Masombuka et al. 2021; Research ICT Africa 2020; Veerasamy et al. 2019).

Participants highlighted the risks associated with awareness and training in data security and privacy for emerging smart cities in South Africa. Participants 2, 3, 8, 9 and 12 expressed concerns about limited citizen awareness. Participant 9 emphasised the need to raise awareness about cybersecurity risks, data privacy and individual rights, addressing the increasing vulnerability of individuals lacking digital literacy. Research ICT Africa (2020) suggested a comprehensive framework for proactive harm prevention, requiring extensive public awareness campaigns. Participant 4 expressed concern about a widespread lack of awareness in these cities, noting the potential for employees to become ‘insider threats’ because of a careless attitude towards cybersecurity. Participant 9 stressed the critical role of education and awareness programmes in mitigating risks linked to insider threats and social engineering attacks in South Africa. As an example, the Experian data theft incident in August 2020 exposed 24 million South Africans to cybercrimes like identity theft and social engineering (Hosken 2020). Ongoing risks of social engineering attacks were reported by IBM Security (2021), with potentially severe financial ramifications for smart cities and citizens. Earlier mentioned incidents, the 2022 TransUnion credit bureau data breach (Moodley 2022) and a 2023 claim of hacking the SANDF network systems (Daily Maverick 2023), further exemplify the vulnerability of sensitive data. As these incidents occur within the South African context, emerging smart cities will similarly be vulnerable to such attacks unless lessons are learned and proactive measures are implemented to prevent them.

The implementation of regular security awareness training in the workplace is considered essential for enhancing employees’ awareness of threats and overcoming resistance to change (Ablon 2018; Fataar 2020; Ismagilova et al. 2020; Malatji et al. 2021). Participant 7 emphasised that such training could contribute significantly to addressing employees’ resistance and educating them about potential risks and secure practices. Neglecting to secure personal devices, using them for work and lacking multi-factor authentication were identified as significant vulnerabilities, making data security and privacy awareness crucial for citizens in emerging smart cities in South Africa.

Participant 8 cautioned about inadequate understanding of data security and privacy risks among citizens, emphasising the importance of education to aid smart cities in safeguarding information integrity. Participant 12 highlighted challenges in educating end-users about cybersecurity risks, aligning with Mabaso’s (2018) emphasis on the need for cybersecurity education in South Africa. Regular training and education are crucial for promoting a security-focussed cyberculture.

Participant 9 underscored the digital divide in South Africa, emphasising the importance of bridging this gap for effective cybersecurity measures. Initiatives like ‘Smart Townships’ and ‘Smart Villages’ aim to address digital inequality (Research ICT Africa 2020:84). Despite having the third-highest gross domestic product (GDP) (Varrella 2021) and the second-fastest Internet speeds in Africa (Larnyoh 2021), South African Internet users lack experience in cyberspace (Mcanyana et al. 2020; Research ICT Africa 2020). Citizens in emerging smart cities must possess data security and privacy awareness, and the smart city IT department must have the proper training and communication skills to inform and assist citizens effectively (Ismagilova et al. 2020; Malatji et al. 2021; Masombuka et al. 2021).

Participant 6 emphasised the importance of effective data collection management in emerging smart cities, highlighting the need for proper consent, transparency and citizen education. Managing data in smart cities involves addressing challenges in implementing data privacy regulations, deciding what to collect, implementing secure storage solutions, ensuring data quality and making informed decisions about its usage (Backhouse et al. 2020; Ismagilova et al. 2020).

Participants emphasised the risks associated with inadequate funding to address data security and privacy risks. Participant 4 expressed concern about the lack of sustainable funding for implementing necessary measures, potentially leading to ineffective supervision of data security and privacy protection protocols. Participant 18 highlighted increased compliance costs with data security and privacy standards, aligning with Kandeh, Botha and Futcher (2018:8), who argue that compliance with the PoPI Act poses a financial burden to businesses and organisations in emerging South African smart cities. The ongoing issue of insufficient funding in smart cities within local government hampers effective cybersecurity supervision, making emerging South African smart cities susceptible to cyberattacks (Cornelius 2022; Masombuka et al. 2021; Norris et al. 2020). McKinsey and Company (2019) note organisations’ reluctance to allocate resources for cybersecurity unless significant financial consequences are attached. Cornelius (2022) cautions that even with available investment, the shortage of skilled cybersecurity professionals limits efforts.

Participants highlighted insufficient funding as a major challenge for data security and privacy in emerging South African smart cities. Participant 4 expressed concerns about sustainable funding availability for securing data, emphasising its potential costliness. Participant 9 noted limited financial and technological resources for cybersecurity initiatives in developing countries like South Africa, raising concerns about budgetary constraints for training and retaining skilled professionals in small and medium-sized companies within their cities.

Persistent challenges stem from inadequate financial resources allocated to smart cities at the local government level, hindering effective oversight of cybersecurity measures (Cornelius 2022; Masombuka et al. 2021; Norris et al. 2020). The COVID-19 pandemic further strained financial resources because of an upsurge in sophisticated cyberattacks (Nabe 2020). Participant 7 pointed out a lack of understanding among companies in emerging smart cities about the costs of cybersecurity systems, highlighting challenges in justifying expenses when decision-makers do not physically see the differences in devices. Outdated technology use by local governments, including emerging smart cities, is common because of funding limitations, leaving them vulnerable to cyberattacks (Masombuka et al. 2021; Pieterse 2021; Thompson 2019). Participant 18 emphasised the financial challenges associated with implementing and maintaining data security and privacy measures. Despite these challenges, South African organisations face record-breaking data breach costs, with an 8% increase over 3 years, reaching an average of R49.45 million in 2023 (IBM Security 2022, 2023).

Effective data security and privacy rely on comprehensive security measures to mitigate potential risks (Cornelius 2022; Majid 2023; Malatji et al. 2021; Masombuka et al. 2021; Research ICT Africa 2020; Sharma & Arya 2023; Telo 2023; Verhulsdonck et al. 2023; Xia et al. 2023). However, participants emphasised that a combination of poor governance, skills shortage, lack of awareness and insufficient funding may result in inadequate data protection, exposing emerging South African smart cities to cyber threats and data breaches. Insufficient security measures, weak encryption, improper data storage and transmission procedures pose direct risks to data protection, as highlighted by Participant 11. Participant 6 echoed concerns, stating, ‘Inadequate data protection is also a risk because they rely on robust data protection mechanisms to ensure that there is confidentiality, integrity and prudence in the system’. Participant 6 also argued that inadequate security measures may lead to the exposure of sensitive data.

Ransomware and phishing attacks were identified as specific threats linked to inadequate data protection measures, leading to data locking, malware installation or exposure of sensitive information, as noted by Participant 11. Phishing attacks were highlighted as a significant risk, with South Africa leading in cybersecurity threats on the continent in 2022 (Interpol 2022). The Federal Bureau of Investigation (FBI) reported that the majority of cybercrimes in 2021 involved phishing attacks (FBI 2021), and South Africa ranked third globally in the number of cybercrime victims, incurring an annual cost of R2.2 billion (Accenture 2020). Ransomware was emphasised by Participant 1 as a form of extortion following data breaches, aligning with the reported increase in extortion tactics by cybercriminals.

In terms of challenges, a combination of poor governance, skills shortage, lack of awareness and training and insufficient funding poses a significant challenge to achieving adequate data and privacy protection in emerging South African smart cities. Participants highlighted the collective neglect of these challenges, emphasising the major threat they pose to data security.

Participants 6 and 12 identified critical challenges with infrastructure vulnerabilities, stemming from ongoing underinvestment in securing ICT systems and cybersecurity initiatives within local government. Participant 6 attributed this vulnerability to the heavy reliance on interconnected infrastructure networks in smart cities, exposing sensitive data to cyber threats. The Mirai botnet attack in 2016 (Al-Turjman & Imran 2020) illustrated the potentially devastating impact of such attacks on smart cities dependent on IoT for operations (Patel & Doshi 2019; Vaidya et al. 2021).

Instances of sophisticated botnet-assisted cyberattacks in South Africa, including distributed denial of service (DDoS) attacks on the banking sector (Moyo 2019) and ransomware attacks on a city’s power provider (Spadafora 2019), exemplify tangible risks faced by emerging smart cities. Participant 12 emphasised the challenge of safeguarding multiple sensors and IoT devices throughout smart cities, noting the lack of robust security measures and testing, creating opportunities for malicious exploitation and cybersecurity threats. Therefore, the combined data security and privacy risks can greatly compromise the advantages of smart cities, highlighting the critical need for strong security measures and continuous vigilant oversight.