Is institutional data coming into or going out of the United States at any point during collection, processing, storage, or archiving?

This question is asking whether any institutional data (which typically includes sensitive information like student records, financial data, research data, etc.) crosses international borders at any point in its lifecycle. Specifically, it's asking if data is transmitted to or from locations outside the United States during collection (when data is gathered), processing (when data is manipulated or analyzed), storage (where data resides), or archiving (long-term retention). This question is critical in security assessments because different countries have different data protection laws and regulations. For example, the European Union has GDPR, Canada has PIPEDA, and many other countries have their own data sovereignty requirements. When institutional data crosses borders, it becomes subject to those foreign jurisdictions' laws, which may have different (and sometimes conflicting) requirements for data protection, privacy, breach notification, and government access. To best answer this question: 1. Consider your entire data flow and infrastructure - where are your servers physically located? Where are your backup facilities? Where are your development teams? 2. Be specific about which data elements cross borders, when they do so, and to which countries 3. If data does cross borders, explain what safeguards are in place (encryption, data protection agreements, etc.) 4. If you use cloud services, research where their data centers are located and how they handle data transfers 5. Consider whether you have any international employees, contractors, or support staff who might access the data Even if you're using a US-based cloud provider, they might have data centers worldwide, so it's important to understand their infrastructure.