A data discovery scan reports that nightly backups of a database holding EU customer records are being replicated to a provider region outside the jurisdictions approved in the company's data residency policy. What is the most important implication of this finding?
Select an answer to reveal the explanation.
Short Explanation
Data discovery isn't just about what you've got, it's about where it lives. A backup sitting in the wrong country can be a compliance problem all by itself. Don't assume encryption or the provider's defaults get you off the hook.
Full Explanation
Data location is one of the outputs of data discovery because where data physically resides determines which laws apply and whether residency commitments, contractual terms and cross-border transfer rules are met. Backups and replicas are copies of the same personal data, so replicating them to an unapproved region can breach the company's residency policy and may constitute a restricted transfer under privacy law. The finding must be assessed by privacy and legal stakeholders, the replication corrected and the root cause addressed. Treating it as purely a cost issue ignores that the data set contains EU personal data subject to legal obligations. Encryption is an important safeguard and may reduce risk, but it does not by itself exempt personal data from transfer rules or residency commitments; the data remains personal data. Blaming the provider's default misreads shared responsibility; the customer chooses and configures regions and replication, and the data controller remains accountable for compliance regardless of who selected a default. Exam caveat: residency questions usually reward verifying actual data location rather than relying on configuration intent. Operational check: inventory every replica and backup location and enforce region restrictions through policy controls that block unapproved destinations.