ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Because the SaaS environment will store EU residents' PII in the United States, the retailer becomes subject to the EU GDPR's cross-border transfer restrictions. At the same time, the data may be subject to compelled disclosure under U.S. laws such as the CLOUD Act or USA PATRIOT Act. These potentially conflicting legal obligations around government access and privacy (data sovereignty/jurisdictional conflict) represent the primary legal risk that must be addressed through mechanisms such as Standard Contractual Clauses, supplementary controls, or alternative hosting arrangements. While obtaining SOC 2 reports, enforcing multi-factor authentication, and assessing latency are all valid considerations, they relate to assurance, security, or performance-not to the core legal conflict created by storing EU personal data in a non-EU jurisdiction.