Topic starter
11/07/2026 8:36 pm
TL;DR: Cloud-routed ZTNA can create GDPR exposure when vendor-controlled PoPs move traffic, metadata, or identifiers across borders, according to AppGate. Direct-routed access architecture matters because sovereignty failures can arise even when content is encrypted and access appears secure.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Zero Trust Meets GDPR: How Direct-Routed ZTNA Strengthens Data Protection and Sovereignty”.
Key questions
Q: What breaks when ZTNA traffic is brokered through vendor-controlled PoPs under GDPR?
A: The compliance assumption that secure transport equals lawful processing breaks down.
Q: Why can encrypted access still create GDPR transfer risk?
A: Encryption protects confidentiality, but GDPR also governs where personal data is processed and transferred.
Q: How should security teams evaluate ZTNA routing choices for sovereignty?
A: They should review the full access path, including PoPs, telemetry, and identity integrations, against the organisation’s approved processing regions.
Practitioner guidance
- Map every ZTNA broker hop Inventory the points of presence, relays, and telemetry paths that handle user sessions, then identify which jurisdictions they operate from and which data elements they process.
- Require customer-controlled routing paths Prioritise architectures that let you place controllers and gateways in your own regions or on-premises so session flows do not rely on vendor-managed detours.
- Classify session metadata as governed data Include identifiers, device context, and authentication telemetry in your GDPR data maps so reviews cover more than the application payload.
Bottom line: Cloud-routed ZTNA can create GDPR exposure by moving session-related data through infrastructure outside the intended jurisdiction.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:05 pm
Cloud-routed access has become a sovereignty control problem, not just a performance choice. When a ZTNA service brokers traffic through vendor-managed infrastructure, the organisation inherits an additional processing location that may sit outside the intended legal boundary. That makes data-transfer governance part of the access design itself. Practitioners should evaluate routing topology with the same seriousness they apply to identity assertions and logging paths.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between direct-routed and cloud-routed ZTNA for compliance?
A: Direct-routed ZTNA keeps session traffic on customer-controlled paths and lets the organisation choose where controllers and gateways live. Cloud-routed ZTNA brokers traffic through vendor infrastructure, which can introduce additional jurisdictions and data transfer obligations. For GDPR, that difference matters because the routing layer itself can change the compliance posture.
👉 Read our full editorial: GDPR data sovereignty and ZTNA routing risk for enterprises