Access Geography

A transfer inventory drawn from the system architecture captures data movement between systems. It does not capture a person in another jurisdiction opening a record, and that is a transfer.

A support engineer viewing a customer's data from elsewhere, an offshore development team with production access, a vendor's support staff, and an analyst querying a regional store from a central location are all transfers — and none appears in a data-flow diagram.

Why it matters

It is the transfer category most reliably omitted, and it is one that regulators specifically examine. It also undermines an otherwise correct residency architecture: data kept regionally and viewed globally has been transferred, and the technical work was not sufficient.

Implementation patterns

• Include human access in the transfer inventory, alongside system-to-system flows.
• Location-aware access control, so access from a jurisdiction without a valid mechanism is denied rather than logged.
• Regional support and operations models where the data cannot cross, which is an organisational and staffing decision that the architecture forces.
• Just-in-time elevation with an approval and a recorded justification, so broad standing access does not exist to be exercised from anywhere.
• Customer-visible logging of staff access, which is uncomfortable, converts a policy claim into a verifiable one, and makes the control partly self-enforcing.
• Extend the same reasoning to derived access: an analytics dashboard, an export, a screenshot in a support ticket, and a log platform whose operators are elsewhere.

Industry example

Global employment and payroll platforms such as Remote and Deel handle data whose governing jurisdiction varies per record, with support and engineering staff distributed globally. The technical residency work is the easier half; the harder half is that a single support interaction may constitute a transfer — which makes the support model an architectural constraint rather than an operational choice.

Failure scenarios

• Human access omitted from the transfer inventory, leaving the largest category unmanaged.
• Residency implemented technically and undone by global support access.
• Standing broad access, exercisable from anywhere without a record.
• Log and telemetry platforms operated from another jurisdiction, which routinely contain exactly the data the restriction covers.
• Screenshots and exports, which leave the controlled path entirely.

Trade-offs

Regional support models are substantially more expensive than a single global team, and just-in-time elevation slows support during an urgent customer issue.

The mitigation is tiering by data sensitivity: unrestricted access to non-sensitive fields, elevation for restricted ones, and regional handling only where the jurisdiction genuinely requires it — rather than applying the strictest model uniformly, which makes support unaffordable and produces workarounds that are worse than the controls they bypass.

Interview question

"Your data is stored in-region and your support team is in three countries. Tell me which of your customer interactions constitute a cross-border transfer, and how you would know."