A multinational retailer wants to consolidate all customer records into a single cloud data warehouse hosted in a US region to simplify analytics. The legal team objects, noting that customer data collected from EU residents is subject to rules requiring that personal data remain within specific jurisdictions unless adequate safeguards exist. Which data governance concept is the legal team invoking?