中文
devexamples
← Workflows

阅读中文版本

Data Residency Compliance Workflow

Map where each data class may be stored, verify deployments and backups stay in region, and add controls so new features do not silently move data across borders.

advanced~150 mincomplianceprivacyinfrastructure

Objective

Ensure data stays within the regions required by contract and law, and detect violations early.

Environment

  • A data classification and residency map
  • Infrastructure and backup location visibility

Steps

1. Classify data and map each class

Classify data and map each class to allowed regions.

Expected state: The residency rules are explicit.

2. Verify that compute, storage, and backups

Verify that compute, storage, and backups are in the allowed regions.

Expected state: Current placement matches the map.

3. Add a control or review step

Add a control or review step for new services and features.

Expected state: New components cannot bypass the rules.

4. Audit periodically and alert on any

Audit periodically and alert on any cross-region transfer.

Expected state: Violations are detected, not discovered by auditors.

Decision points

Block all cross-region transfer or allow with review?

  • Block by default
  • Allow with approval

Block by default; allow only named, reviewed cases with data minimization.

How to treat CDNs and caches?

  • In scope
  • Out of scope

In scope when they may store personal data; a cache in a wrong region is still a residency issue.

Expected outcome

Data classes reside only in their allowed regions across compute, storage, and backups, with controls preventing silent drift.

Verification

Confirm placement matches the residency map for every data class and that monitoring would flag any cross-region transfer attempt.

Cleanup

Record the audit results and update the residency map when services change.

Overview

Ensure data stays within the regions required by contract and law, and detect violations early. Confirm placement matches the residency map for every data class and that monitoring would flag any cross-region transfer attempt.

Steps

  1. Classify data and map each class to allowed regions. Expected state: The residency rules are explicit.
  2. Verify that compute, storage, and backups are in the allowed regions. Expected state: Current placement matches the map.
  3. Add a control or review step for new services and features. Expected state: New components cannot bypass the rules.
  4. Audit periodically and alert on any cross-region transfer. Expected state: Violations are detected, not discovered by auditors.
residency:
  eu_personal:
    regions: [eu-west-1, eu-central-1]
    backups: same-region-only
  anonymous_metrics:
    regions: [any]

Verification

  • Data classes reside only in their allowed regions across compute, storage, and backups, with controls preventing silent drift.

Decision points

  • Block all cross-region transfer or allow with review? Options: Block by default; Allow with approval. Recommended: Block by default; allow only named, reviewed cases with data minimization.
  • How to treat CDNs and caches? Options: In scope; Out of scope. Recommended: In scope when they may store personal data; a cache in a wrong region is still a residency issue.