A multinational bank plans to migrate its customer transaction database to a public cloud provider. During the acquisition process, the IS auditor is asked to review the provider selection criteria. The organization operates in jurisdictions that legally require certain customer data to remain within national borders. Which of the following should the auditor recommend receive PRIMARY consideration before finalizing the provider contract?