Data Residency, Privacy and Regulatory Compliance
This domain tests whether you can separate three ideas that candidates routinely merge: where data is stored at rest, whose law applies, and which contract or certification actually covers the workload. Scenario questions ask you to scope a commitment precisely or to choose the correct compliance artefact.
Residency
- Tenant geography is fixed at creation and determines the primary region for directory and tenant-level data.
- Multi-geo moves mailbox and file content at rest to satellite regions for users assigned a preferred data location; licensing is per user, and a subset of tenant and directory data stays in the primary region.
- Not every data type follows the mailbox: diagnostic telemetry, some service metadata, and backup or replica placement have their own scopes, which must be described accurately rather than broadly.
- Residency is not sovereignty. Sovereignty concerns who may compel access; it is addressed with encryption, customer-held keys, and access-approval controls, not with geography alone.
Privacy operations
Data subject requests are fulfilled through content search and export, with a defined response window under GDPR. Deletion is layered: a user delete is recoverable for a period, retention labels and litigation hold can block deletion entirely, and backup copies age out on their own schedule. Auditors will ask which of these you told the data subject.
Regulatory artefacts
- A BAA covers HIPAA workloads; it does not make your configuration compliant.
- PCI DSS obligations are contractual and assessed against your architecture; the provider's certification does not transfer.
- Retention labels, disposition review, and preservation lock implement records schedules; eDiscovery implements preservation for litigation.
- Customer lockbox and privileged access approval reduce standing operator access and are separate from residency.
Worked example
An EU subsidiary requires that mailbox content stay in the EU. Assign a preferred data location to those users, confirm the licence supports multi-geo, and document that directory and tenant-scoped data remain in the primary region. Reasoning: writing a blanket "all data remains in the EU" statement into a DPA creates a contractual breach the moment an auditor inspects the tenant topology; a scoped statement is defensible.
Traps
- Equating residency with sovereignty.
- Promising that a mailbox delete removes data from all backups immediately.
- Assuming retention labels and litigation hold interact benignly - hold wins and deletions silently stop.
- Exporting eDiscovery results to a review location outside the approved region.