A platform must move personal data between jurisdictions. What does the architecture need to support, beyond the legal mechanism?

What the architecture must support

• Knowing what moves. A transfer inventory: which data, from where, to where, for what purpose, under which mechanism. Most organisations cannot produce this, and the transfers they forget are the derived ones — logs shipped to a central platform, telemetry, backups, and a support tool whose staff are elsewhere.
• Minimising what crosses, since a transfer of aggregated or pseudonymised data may fall outside the restriction entirely — and reducing what moves is more robust than justifying the movement.
• The ability to keep processing local, which means regional deployment of everything that touches the data including logs, telemetry and analytics — the ones most often missed and which routinely contain the data the restriction covers.
• Evidence of the mechanism applied per transfer, retained, since the question asked later is which safeguard applied to which flow.
• The ability to stop a transfer, since mechanisms are invalidated and a flow that cannot be turned off is a flow that will continue after it becomes unlawful.

The distinction that must be precise

Residency, sovereignty and transfer are different requirements. Residency is where data sits; sovereignty concerns which authorities can compel access — which is affected by the provider's own jurisdiction regardless of where the servers are; transfer governs movement.

Conflating them produces an architecture satisfying the easy one and not the one required, and which applies is a legal question that must precede the design.

The remote access case that is routinely missed

Access from another jurisdiction is a transfer. A support engineer viewing a customer record from elsewhere, an offshore development team with production access, or a vendor's support staff are all transfers — and none of them appears in a data-flow diagram drawn from the system architecture.

That makes access control and its geography a transfer control, which is not how it is usually classified.

The employment-platform specific complication

A single employment relationship touches several jurisdictions — the employer's, the employee's, and the payment rails'. Which jurisdiction's rules govern which component is a legal determination, and the architecture must express a record whose parts are governed differently, which a single regional partition does not support.