An architect designing a cloud application learns that the default storage region for its customer data is in a country whose laws allow broad government access to data held there, while many of the customers are subject to stricter privacy laws. Which SDLC response is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Where your data sleeps decides whose laws can knock on the door. So you settle location in the design, picking regions and controls that fit your customers' laws, instead of finding out after launch. The provider's terms of service can't overrule a government, and that's the trap.
Full Explanation
Legal and jurisdiction issues are listed as a cloud-specific risk that the SDLC must address. Where data is stored and processed determines which laws can compel access to it, which privacy obligations apply, and whether transfers across borders are lawful. Those factors shape architecture choices such as region selection, replication targets, backup locations, support access paths and key management, so they belong in requirements and design rather than in a later review. The architect should record the jurisdictional constraints as requirements, choose regions accordingly, and add supporting controls such as encryption with customer-controlled keys and contractual commitments on data location. A provider's terms of service cannot override the law of the country where data is held; a provider may be legally compelled to disclose data regardless of its stated policies. Deferring the question until after go-live treats a design constraint as paperwork and risks costly migration. Encrypting only in transit leaves data readable at rest in the jurisdiction in question, and laws granting access to stored data apply to data at rest, not just data moving between locations. Exam caveat: jurisdiction issues also cover conflicting laws and eDiscovery, so legal and privacy teams are SDLC stakeholders. Operational check: confirm the data inventory records storage and backup regions for each data set and that they match the approved jurisdiction requirements.