A company is choosing a cloud processing location for personal information from several jurisdictions. What is the appropriate decision process?

1. Assume the provider's headquarters alone determines every applicable rule
2. Assume encryption removes every cross-border obligation
3. Choose the lowest latency region without considering data obligations
4. Map data flows and assess applicable requirements with qualified privacy and legal stakeholders