When evaluating cloud-based services for backup, which of the following is MOST important to consider from a privacy regulation standpoint?