Cross-border questions stall when legal and engineering speak past each other. Legal asks for the basis; engineering lists vendors; neither has a single path diagram.
Start with production write paths and the nightly extracts that feed risk, marketing, and group reporting. Note destinations, encryption in transit, and whether logs prove the route.
Contracts should match the diagram. If a processor sits on the path but not in the register, the audit finding writes itself.
A short board brief — path, cover, gap — usually unlocks remediation budget faster than a 40-page annex.