CRISC Certified in Risk and Information Systems ControlGovernanceHard
A global technology company is expanding its operations into a new region. The local regulatory authority requires that all customer data collected within its jurisdiction must be stored and processed exclusively within the country's borders. The company's existing global data architecture relies on centralized cloud infrastructure in another country. Which of the following is the MOST appropriate governance response to ensure compliance while minimizing operational disruption?
- AImplement a localized data center or cloud instance within the new region for in-country data.
- BNegotiate with the local regulatory authority for an exemption based on global standards.
- CCease operations in the new region if compliance proves too costly or complex.
- DContinue using the centralized cloud infrastructure and rely on contractual agreements with the cloud provider to manage data residency.
Show answer & explanationAnswer & explanation
Correct answer: A. Implement a localized data center or cloud instance within the new region for in-country data.
Implementing a localized data center or cloud instance directly addresses the data residency requirement without completely disrupting the global architecture, providing a compliant and operationally viable solution.
Why the other options are wrong
- B. Negotiating for an exemption is generally difficult and unreliable, especially for strict data residency laws, and does not guarantee compliance.
- C. Ceasing operations is an extreme measure that should only be considered if all other compliance options are unfeasible or economically prohibitive.
- D. Relying solely on contractual agreements is insufficient for data residency, as the legal requirement is on the organization, not just its provider, and the physical location of data is paramount.
Data Residency Compliance
The adherence to legal and regulatory requirements stipulating that certain data must be stored and processed within the geographical borders of a specific country or jurisdiction.
- Driven by national security, privacy, or economic policies.
- Often requires physical infrastructure within the country.
- A key consideration for global data architecture and cloud strategies.
Memory trick: When local laws demand data stays home, you build a local home for the data.