Question

A multinational retailer processes customer data across several countries. The risk practitioner discovers that a new data-localization law in one country directly conflicts with a data-sharing clause in a signed contract with a global cloud provider, and that the marketing department has continued cross-border transfers to meet campaign deadlines. What should the risk practitioner do FIRST?

Accepted Answer

Escalate the conflict to legal counsel and management to assess the legal, regulatory, and contractual exposure before recommending action

Answer

Instruct the marketing department to immediately halt all cross-border data transfers until the matter is resolved

Answer

Renegotiate the cloud provider contract to remove the data-sharing clause

Answer

Document the finding in the risk register and continue monitoring the transfers