A tourism board wants to host resident contestant photos on a foreign social platform's free tier. Which concern should security raise first?
Select an answer to reveal the explanation.
Short Explanation
Free foreign hosting sounds cheap until resident photos live under another country's rules. Crossing borders with personal data can trigger privacy, retention, and access surprises. Ask about transborder flow before the upload button becomes muscle memory.
Full Explanation
Hosting resident contestant photos on a foreign social platform's free tier immediately raises transborder data flow and privacy questions. Personal photos stored on infrastructure outside the organization's jurisdiction can trigger different privacy laws, government access regimes, retention expectations, and breach duties than domestic hosting. Security should surface those cross-border implications before convenience and zero cost drive an irreversible upload pattern.
Brand-guideline logo colors are aesthetic, not a primary security or privacy gate for foreign hosting of personal data. Assuming free tiers automatically satisfy every records-retention statute worldwide is unsupported; free consumer platforms rarely meet municipal retention, e-discovery, or deletion controls. Mandating paper-only photos to avoid all digital risk is an extreme avoidance strategy that ignores legitimate digital needs and does not answer the jurisdiction question posed.
Exam caveat: 'Free foreign cloud' stems almost always want transborder data flow / privacy jurisdiction analysis first.
Operational check: Classify the photo data, determine lawful basis and retention needs, prefer in-jurisdiction or contractually controlled hosting with DPAs, minimize published EXIF and identifiers, and obtain privacy-office approval before any tourism contest upload workflow goes live.