[Maya Chen]

A vendor may say that data stays in one country while backups, logs, or support access occur elsewhere. What exactly needs clarification?

[Jordan Blake]

Accepted answer

Map every data type and processing location, including primary storage, backups, logs, analytics, support access, subprocessors, and disaster recovery. Distinguish storage locations from remote access and legal control. Put permitted regions, change notices, evidence, deletion, and exception handling into the agreement. The NIST Privacy Framework supports identifying and managing privacy risk across all data processing, not only the main database.

[Priya Shah]

Community reply

Would allowing access from another country violate a data residency requirement even if the storage remains local?

[Author]

Posts