Start with classification
Residency requirements almost never apply to every byte an organization holds. The first step is separating data that carries an obligation from data that does not, because over-applying the strictest rule to everything is expensive and usually unnecessary.
Follow the whole path
Data escapes through the routes nobody lists in the architecture diagram:
- Backups and their replication targets
- Application and infrastructure logs shipped to external services
- Analytics, error tracking and session replay tools
- Email, notification and document generation providers
- AI and machine learning APIs called from application code
Make exceptions explicit
Where an external dependency cannot reasonably be removed, it is recorded: what data reaches it, under what legal basis, and what the fallback is. An undocumented exception is the one that surfaces during an audit.