Your SaaS vendor processes EU customer data in the US. Legal asks for supplementary measures. What can architecture offer?

What the interviewer is testing

Whether you can translate a legal requirement into specific technical measures rather than treating it as paperwork.

The context

Standard contractual clauses are the usual transfer mechanism, and since Schrems II they must be accompanied by a transfer impact assessment considering whether the destination's surveillance laws undermine them. Where the assessment finds risk, supplementary technical measures are required — and those are architecture.

What architecture can offer

Encryption with keys held in the originating jurisdiction. The vendor processes ciphertext and cannot decrypt unilaterally, so a lawful access demand served on them produces nothing useful. This is the strongest measure and it constrains what the vendor can do with the data — if they need to process the plaintext, it does not apply.

Pseudonymisation before transfer, with the re-identification mapping held in the EU. The vendor processes records that cannot be attributed to individuals without information they do not have. Very effective for analytics and processing use cases.

Data minimisation — transfer only the fields the function requires. Frequently the transferred set can be reduced substantially, which reduces both the risk and the assessment burden.

Keep the data in region and transfer only derived results, which is the strongest option where the vendor's function allows it.

Split processing, where sensitive elements are handled in region and only non-sensitive processing happens abroad.

The practical work alongside it

A data flow map recording where personal data goes, including sub-processors — because a transfer through the vendor's support tooling or their own third-party analytics is still a transfer, and those are the ones that appear in enforcement actions rather than in the architecture diagram.

What a strong answer adds

Asking whether the transfer is necessary at all. Many vendors offer EU-hosted deployment, and the assessment effort plus supplementary measures frequently costs more than the regional option. That should be evaluated before engineering around the problem.

And noting that adequacy decisions can change, so an architecture that depends on one has a political dependency worth recording in the risk register.

Common weak answers

Encryption in transit and at rest, which does not address the issue since the vendor holds the keys. Treating it as legal's problem.