Can the sensitive data be stored outside the EEA?