DIA-6 - Information and Data Location
Control for data residency and compliance with geographic location requirements
Control Definition
A map of the locations where the organization's data is stored and processed must be documented and kept up to date, identifying the sovereignty and residency restrictions applicable to each type of data. Technical controls must be implemented to prevent storage in unauthorized regions, and any international data transfer, together with its legal compliance mechanism, must be formally assessed, authorized and documented. These transfers must be continuously monitored and the residency impact assessed for new storage locations.
Requirements
Requirement 1
We document and keep up to date the map of geographic locations where the organization's data is stored and processed.
Requirement 2
We identify the data sovereignty and residency restrictions applicable by regulation for each type of data.
Requirement 3
We validate with the security and compliance team the choice of cloud regions for data with residency requirements.
Requirement 4
We formally assess and authorize data transfers outside the permitted jurisdictions.
Requirement 5
We document the legal compliance mechanism applicable to each international transfer: standard contractual clauses, binding corporate rules or an adequacy decision.
Requirement 6
We require an up-to-date DPA for transfers to third parties abroad that reflects the applicable compliance mechanisms.
Requirement 7
We implement technical controls that prevent data from being stored in unauthorized regions.
Requirement 8
We continuously monitor data transfers to detect movements to unauthorized locations.
Requirement 9
We assess the data residency impact when adding new storage locations.