Frustratingly, these instruments were drawn up at a time when computing power was owned and managed by the corporation using it, so neither Safe Harbor nor BCR agreements will stand up to a fully distributed cloud.
The only way to ensure that data is properly managed and that the corporation is protected is to understand what exists and to develop a sound policy that can be applied to all content, including legacy files and email.