Customer data remain stored in an EU cloud region, yet a third-country support team remotely reads personal data to resolve tickets. How should the privacy team treat that access?
Select an answer to reveal the explanation.
Short Explanation
If someone outside the EEA can open and read EU personal data, geography of the hard drives is not the whole story. Remote support access can look a lot like a transfer risk. Treat it seriously and put the right transfer tools and access controls around it.
Full Explanation
Transfer analysis follows the personal data, including through remote access. If a third-country support team can read EU-stored customer data to resolve tickets, that access can present a transfer or transfer-like risk requiring Chapter V assessment and safeguards even though the disks remain in an EU region. Civic helpdesks and commercial SaaS support models that “follow the sun” must not assume geography of storage alone equals geography of processing.
Remote access is not unregulated merely because storage stays in the EU. Transfers are not limited to full database backup uploads; read access to personal data can engage Chapter V concerns. EU SCCs for storage alone do not automatically cover non-adequate support access patterns if those patterns were never assessed.
Exam caveat: practical controls include EU-only support shifts, customer-managed keys, redaction tooling, and documented SCCs/TIA for any non-EU accessors. “Access vs transfer” semantics can be debated, but exams expect risk recognition and safeguards—not denial.
Operational check: map which roles outside the EEA can open tickets with personal data, bring those flows into transfer documentation, restrict privileges, log access, and update the notice’s international disclosure.