Data Residency & Transfers interview questions

Where data may live, cross-border transfer, and the architecture that follows.

3 questions in Regulation & Compliance.

Regulation & ComplianceA 22-minute read on how the topic fits together, before the questions.Regulation and compliance fundamentals58 short answers on one page, for revising rather than studying.

hard3

hardScenarioDesign

A team wants to add a third-party AI provider hosted in another country to a feature your European customers use. What has to be true before that first request goes out?

Adding a processor in another country is a transfer and a sub-processor change at once, so the work is a lawful transfer mechanism, the notice your own customer contracts require, and an engineering boundary that sends the provider the minimum and keeps nothing at their end.

6 minsenior, staff, lead

hardDesignScenario

A regulator says this customer's data may not leave the country. How do you design for that?

You pin every store to the region, including backups, DR, search indexes and key material, then hunt the paths that leave without anyone choosing to: telemetry labels, error traces, log shipping, support tooling and remote staff access.

7 minsenior, staff, lead

hardDesignScenario

Your data is pinned per region, but login must be globally unique and admins want one global search. How do you build that?

Keep one small global directory holding only the keys needed to route a request, never the payload. Uniqueness becomes a claim on a pseudonymous token, search becomes a fan-out that returns pointers each region resolves locally, and every field promoted to the global tier is a transfer decision.

6 minsenior, staff, lead