Where the Data Actually Travels
A companion reading from the connectivity provider seat — what routing and egress do, and do not, do to a trial’s data-protection position
REGULATORY OPERATIONSRouting trial traffic through a third country is not, by itself, an international transfer: transit is not transfer. Your layer decides where traffic egresses and who can read it.
A transfer arises only where a party in a third country receives or can access the data — but a residency analysis that stops at storage cannot see your layer. Map egress per market, disclose default backhaul and underlying carriers, evidence end-to-end protection, and issue a routing disclosure.
Regulated twice: by telecoms and cyber law, and by the trial on top
| Perimeter | What it means for you | Provider action / evidence |
|---|---|---|
| Data residency | Routing and egress set where data physically travels; localization rules apply to that. | Map egress points per market; show where data stays or goes. |
| Cross-border transfer | A transfer arises where a third-country party receives or can access the data — not from routing alone. | Disclose default backhaul and any point where traffic is terminated, decrypted or stored abroad. |
| Data integrity | Loss or corruption in transit is a data-integrity event in the trial record. | Evidence encryption in transit and link-integrity controls. |
| Oversight | Whether you are a processor turns on what you do with the content; managed connectivity can make you one. | Name your underlying carriers; provide a routing disclosure the sponsor can assess. |
Four facts about your layer that a sponsor will ask you to evidence
Where traffic egresses sets the security, localization and — where a third-country party is involved — transfer position.
A residency analysis that stops at storage never reaches the connectivity layer; what is not mapped is not assessed, by you or anyone else.
A global eSIM may route via a third country by default; convenience routing quietly crosses borders, and opaque egress points make residency impossible to assure.
Connectivity hardware and software placed on the EU market is a product with digital elements under the Cyber Resilience Act: reporting since 11 Sept 2026, remaining duties from 11 Dec 2027.
Five moves turn an undocumented dependency into a disclosure the sponsor can act on
- 1Map egress per market — know and document where traffic leaves the country in each deployment region.
- 2Disclose default backhaul — where a global eSIM routes by default, and whether traffic is terminated, decrypted or stored on the way.
- 3Name your underlying carriers — they shape routing, and a sponsor cannot name what you do not disclose.
- 4Evidence protection in transit — end-to-end payload encryption and link-integrity controls along the whole path.
- 5Issue a routing disclosure the sponsor can use in its residency analysis and vendor oversight — not a legal opinion on transfer.
ICO transfer guidance · EDPB Guidelines 05/2021 (v2.0) · EDPB Guidelines 07/2020 · ePrivacy Directive 2002/58/EC Arts 4, 5(1) · NIS2 · Cyber Resilience Act · GDPR Art. 32, Ch. V · EMA/INS/GCP/112288/2023 Annex 4
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call