The question for firm owners is whether the firm has decided, in writing, where that data is allowed to go.