A hospital is creating an AI system to help doctors diagnose diseases using patient records and medical images. Regulatory compliance requires that all sensitive patient data remains within the country where it is stored.

Which data governance approach ensures both regulatory compliance and the protection of patient privacy?