An organization moved its payroll system to a Software as a Service (SaaS) application. A new data privacy regulation stipulates that data can only be processed within the country where it is collected.
Which of the following should be done FIRST when addressing this situation?
A . Analyze data protection methods.
B . Understand data flows.
C . Include a right-to-audit clause.
D . Implement strong access controls.
Answer: B