Home | Community | Blog

Securing Cross-Border Operations While Maintaining Regulatory Compliance

NextLabs Blogs

As organizations expand their operations across countries and regions, managing data security and regulatory compliance becomes increasingly complex. Different jurisdictions impose their own requirements for privacy, data protection, data storage, and cross-border data transfers. At the same time, distributed teams, regional offices, and third-party providers introduce additional layers of risk that organizations must manage consistently across their global operations. 

The challenge extends beyond understanding different regulations. Data may be subject to localization requirements that restrict how and where it can be stored or transferred, while security maturity and organizational practices can vary significantly from one region to another. Differences in security culture, third-party oversight, and accountability can further create gaps in an organization’s security posture, particularly as businesses scale across borders. 

In this episode of the NextLabs Expert Series, Narendra Sahoo, Director of VISTA InfoSec, discusses the key data security and regulatory challenges organizations face when operating across borders. The conversation explores how enterprises can establish consistent security practices across nearshore and offshore teams, harmonize compliance requirements through unified control frameworks, and use technology and operational controls to strengthen security at scale. The discussion also examines practical lessons from global operations, including the importance of documenting cross-border data flows, scaling security culture with business growth, and maintaining clear accountability across distributed teams. 

About the Speaker 

Narendra Sahoo is the Founder and Director of VISTA InfoSec, a global Information Security Consulting firm. He holds more than 30 years of experience in the IT Industry, with expertise in Information Risk Consulting, Assessment, & Compliance services.    

Read his perspective below, watch the Q&A video, or listen to the podcasts on Spotify.

What are the biggest data security and regulatory challenges organizations face when operating across borders?

The biggest challenge is that every country has its own privacy and data security laws. In the United States, for example, almost every state has its own privacy requirements. Then there are regulations such as GDPR, PIPEDA, HIPAA, PDPA, and India’s DPDP. 

All these different laws complicate how organizations manage data—what needs to be stored, what can or cannot be stored, how it can be stored, who can store it, how governance needs to be managed, and how reporting should be handled. 

Companies also often assume that data can flow freely from one country to another simply because it is electronic. That is not necessarily the case. Data localization requirements are very strong in many countries, and organizations need to understand where their data can be stored and how it can be transferred across borders. 

Another challenge is that security maturity is rarely equal across regions. Within the same company, one location may be highly compliant while another may have a much lower level of security maturity. 

Third-party risk is another major concern. Organizations may assume that outsourcing a process means the compliance responsibility has been taken care of. But while you can outsource the responsibility for performing a process, you cannot outsource accountability. That remains with the organization. 

Finally, there are cultural differences. Different regions and countries can have very different perspectives on issues such as privacy and confidentiality. For example, privacy may receive significantly more attention in Western countries, while in other regions there can still be confusion between privacy and confidentiality. This difference in understanding can create additional challenges when organizations are trying to establish consistent security practices across global operations.

How can enterprises maintain consistent security practices across nearshore and offshore teams?

This is an issue I have seen throughout my career. As the Internet has connected the world and businesses have expanded across regions, the challenge has become even more significant. 

One of the biggest mistakes companies make is having separate policies for each region or country. That is not the right approach. Organizations should have a global, unified policy and a clear standard that everyone must follow, regardless of where they are located. 

At the same time, organizations can have separate procedures and work instructions based on local regulations or the requirements of a particular region. The policy should be centrally created and managed but rolled out appropriately across different locations. In other words, the policy can be globalized while the procedures are localized. 

Regular audits are also important. In large multinational organizations, we have seen the use of roving teams whose purpose is to visit different geographic areas and audit whether the same policies are being maintained, managed, and implemented consistently. 

Last but not least, organizations should follow the Zero Trust model to identify and address gaps across distributed teams quickly. Zero Trust is the way to go, and I see compliance increasingly moving in this direction as cyber threats continue to increase.

What strategies or frameworks help organizations stay compliant with varying international regulations?

With businesses operating across the world, it is important for organizations to be aware of the standards and regulations being introduced in different countries and understand which ones affect their business. There can be a significant number of requirements across different industries, including banking, manufacturing, automotive, pharmaceuticals, and AI. 

The smartest approach is to establish a harmonized control framework. I have seen this in mature organizations, where a centralized framework is used across the enterprise. 

Organizations should consolidate their applicable standards, identify which controls are required by each standard, and create a single GRC framework across multiple standards. Common controls—such as internal audits, training, employee NDAs, onboarding and offboarding, and access management—can then be managed together, while requirements that are specific to individual standards can be addressed separately. 

This consolidated approach can significantly reduce compliance overhead. You can then align the framework with standards such as NIST, ISO, or CIS and take a unified approach to compliance. 

A strong GRC framework also needs to be supported by a solid governance framework. Without clear governance around how controls are applied, including who is responsible for what controls and how they should be implemented, the GRC framework will not be effective. 

Privacy by design is another important consideration. Privacy needs to be incorporated into the design process rather than treated as an afterthought, just as security should be built into the design rather than addressed later. 

I also recommend maintaining a regulatory register that identifies which laws apply to your industry and organization and which specific requirements are relevant. However, it is important to have an oversight board or designated person who regularly monitors this register because regulations and amendments are changing rapidly. 

Finally, organizations need strong vendor governance. You may outsource a particular process to another company, but that does not mean the vendor is following the same requirements or monitoring what is expected of them. In many organizations, vendor oversight becomes the weakest link in the chain. 

How can technology and operational controls support secure and efficient cross-border operations?

As I mentioned earlier, the Zero Trust framework is something I would consider mandatory for most organizations. It helps ensure that access is explicitly approved rather than simply assumed. Everyone should effectively be treated as guilty until proven innocent when it comes to access. 

Identity and Access Management (IAM) and Privileged Access Management (PAM) are also important. Their use is growing across the industry, but they are still not as pervasive as I believe they should be. 

Organizations should also use encryption and segmented connectivity. Network segmentation is often viewed as a requirement primarily for areas such as PCI compliance, but it is not just a PCI issue. Segmentation is important when dealing with highly critical or privacy-sensitive data. 

Monitoring is equally essential. Without monitoring, many of these controls have limited value. Organizations need strong security operations capabilities to monitor what is being accessed, identify and raise alerts, investigate incidents, and respond appropriately. For smaller organizations, outsourcing these capabilities can be an option. 

Finally, automate whatever you can. AI is increasingly available, and much of the repetitive, manual work can now be automated. Organizations should take advantage of these capabilities to improve efficiency and scale their security operations. 

What lessons have you seen organizations learn the hard way when managing global operations?

One of the biggest lessons I have seen is that corporate offices are often the most secure, while offshore and regional offices can be the weakest. Distributed offices can have significantly weaker security, and that is where many major issues can occur. Organizations need to pay particular attention to these locations. 

I have also seen that many companies do not adequately document their cross-border data flows. This is becoming increasingly important as countries introduce stricter requirements around cross-border transfers, particularly privacy-related data. 

Another important lesson is that security culture does not automatically scale. Companies can grow extremely quickly, but security is often one of the areas that receives the least attention during that growth. As organizations expand, security needs to be scaled alongside the business. 

Finally, there is an issue of accountability. When something goes wrong or responsibility needs to be taken, people often assume that someone else is responsible, particularly when the issue does not fall within a high-profile or highly visible area. This can lead to gaps and finger-pointing: one person thinks another person was supposed to act, while someone else is waiting for approval. 

Accountability is therefore key to ensuring that organizations do not have to learn these lessons in a hard way when managing their global infrastructure. 

Thank you, Narendra, for sharing your valuable insights on securing cross-border operations, including nearshore and offshore environments, while maintaining regulatory compliance.

Discover more from NextLabs’ Expert Series, featuring industry experts in educational and thought-provoking conversations on Data-Centric Security, Zero Trust Architecture, Safeguarding AI, and more.

To comment on this post
Login to NextLabs Community

NextLabs seeks to provide helpful resources and easy to digest information on data-centric security related topics. To discuss and share insights on this resource with peers in the data security field, join the NextLabs community.