A supplier stores customer data in multiple regions, but the organization has not mapped applicable location restrictions. What should be done?

1. Treat encrypted data as exempt from every location restriction
2. Use only the supplier's headquarters location
3. Confirm data flows and obligations with qualified owners before evaluating compliance
4. Assume the supplier's default region is always permissible