the client's country may have specific requirements for authorization 3. **Identify where personal data subjects reside** — GDPR applies to data subjects in the EU regardless of where processing occurs 4. **For cloud-hosted targets:** Determine the physical region/data center — cloud providers' lega