How do you approach data residency and compliance requirements in a multi-cloud SAP architecture?

Data residency requirements (GDPR in the EU, industry-specific regulations, or national data sovereignty laws) often dictate that certain categories of data physically remain within specific geographic or legal boundaries — a constraint that directly shapes which provider and region can host which workload.

flowchart TD
    A[Classify data by sensitivity/residency requirement] --> B{Regulatory constraint applies?}
    B -->|Yes| C[Pin that data/workload to a compliant region/provider]
    B -->|No| D[Place based on cost/performance optimization]

Practically, this means starting from a data classification exercise (what data exists, what regulations apply to each category) before any infrastructure placement decision, then mapping compliant hosting options onto that classification. It also means building compliance verification into the architecture itself — audit logging, data lineage tracking across the multi-cloud boundary — rather than assuming manual processes alone will catch a violation after the fact.