A release meets local requirements but will also process records from another jurisdiction. What should the manager do?

1. Assess the additional applicable obligations before authorizing that scope
2. Assume the hosting location is the only relevant jurisdiction
3. Treat encryption as a waiver of every external rule
4. Use the least restrictive rule without qualified review