Geopolitical tensions don’t need a cyberattack to create real data risk.
A sanctions regime can do it.
A new data-transfer restriction can do it.
A shift in foreign-investment rules can do it.
A government access request can do it.
Even a vendor acquisition can do it.
The attack
What regulators are currently signalling:
Localisation where national security or critical infrastructure is involved
Risk-based approaches elsewhere
Increasing scrutiny of parent-company compulsion and cloud sub-processors
Expectation that classification drives different
