Cross-border outsourcing under GDPR: data maps, SCCs and access from outside the EEA

An outsourced process may look local while its data travels much further. A client sends a file to a provider established in the EU, yet the service uses a global cloud platform, backups replicate between regions and overnight technical support is delivered from outside the European Economic Area. The contract names one provider, but the real flow may include several countries and entities.

Chapter V GDPR requires protection to travel with personal data sent to a third country or international organisation. Checking the supplier's registered office is therefore insufficient. The organisation must know where data is stored, from where it can be accessed, who provides support and where copies, exports and logs are held.

Start with the real data map

Map the full lifecycle: intake, validation, production, reporting, complaint handling, archive and deletion. In business correspondence this may include the address database, source document, print image, production list, proof of posting, return scan and client report. Each item can have a different location and retention period.

The EDPB identifies transfer mapping as the first assessment step. Access from a third country to data stored in Europe may also need a transfer analysis. “Our servers are in the EU” is not a complete answer.

EEA processing, an adequate country and another third country are different cases

• Processing in the EEA. Chapter V does not add a transfer mechanism, but Article 28, security, minimisation and subprocessor controls still apply.
• A country covered by a European Commission adequacy decision. Data may flow without an additional Article 46 tool, although all other GDPR duties continue and the exact scope of the decision must be checked.
• Another third country. An Article 46 safeguard such as the SCCs is normally needed, together with an assessment of whether it provides essentially equivalent protection in practice.

Article 49 derogations should not become the default for regular outsourcing. They address specific situations and must be interpreted narrowly.

SCCs begin the control process; they do not automatically complete it

The European Commission's 2021 Standard Contractual Clauses contain modules for different relationships, including controller-to-controller and controller-to-processor. Select the right module, complete the annexes with concrete data categories, purpose, recipients and safeguards, and cover onward subprocessors.

A signed blank template is not enough. A transfer impact assessment should compare the law and practice of the destination with the data, access model and actual safeguards. If the mechanism is insufficient, supplementary measures are needed. If the required protection cannot be achieved, the transfer should not start or must be suspended.

Supplementary measures must fit the real risk

• Encryption. Check key ownership and whether the third-country recipient needs data in clear form, not only the algorithm.
• Pseudonymisation. Separate identifiers from content where the outsourced step can work without full identity.
• Minimisation. Do not transfer a whole archive when one batch or a limited field set will do.
• Access control. Time-limited access, roles, MFA, session logs and prompt revocation provide more assurance than a general confidentiality promise.
• Process separation. Keep the sensitive step inside the EEA and send abroad only work that does not require identifying data.

A technical measure only works when it matches operations. Encryption at rest offers limited help if the overseas team must read every document in clear text each day.

Eight provisions for the outsourcing agreement

1. data categories and operations performed in each country;
2. approved processing locations and a controlled change procedure;
3. a subprocessor register and notice period for objections;
4. the transfer mechanism for every route and a duty to keep it current;
5. technical and organisational measures, including key management;
6. handling public-authority requests where notification is legally permitted;
7. information, audit and evidence rights;
8. return, portability and deletion on supplier or service exit.

Link these clauses to subprocessor governance and the data retention matrix. They manage different risks but must rely on the same process map.

A practical 30-day review

1. Collect contracts, subprocessor lists and cloud-region settings.
2. Map data from intake to deletion, including backups, testing and support.
3. Mark the EEA, adequate countries and all other destinations.
4. Assign a mechanism and business owner to every transfer.
5. Complete SCCs and a documented TIA where required.
6. Select supplementary measures and test them against a real access scenario.
7. Remove unnecessary routes, accounts, exports and replicas.
8. Set quarterly review and pre-change checks for every supplier or region update.

BackOffice Outsourcing supports processes including business correspondence, printing, inserting, document workflows and selected back-office activities. Location and processing design should be agreed for the specific scope. Talk to us about data flows, evidence and a controlled pilot.

Sources

• Regulation (EU) 2016/679 - GDPR, Chapter V and Article 28
• European Commission, rules on international data transfers
• European Commission, Standard Contractual Clauses
• EDPB Recommendations 01/2020, version 2.0

Frequently asked questions

Does using an EU server mean there is no transfer outside the EEA?

Not necessarily. Check remote access, support, subprocessors, replicas, backups and exports. The main server location does not describe the whole process.

Are SCCs sufficient in every case?

No. SCCs require the correct module, accurate annexes, an assessment of the transfer context and, where necessary, effective supplementary measures.

Do transfers to an adequate country need SCCs?

Normally not within the scope of a valid adequacy decision. Other GDPR duties still apply, and the organisation must confirm that the recipient and transfer are covered.

How often should the data-flow map be updated?

Before launch, after changes to systems, regions, subprocessors or support access, and periodically - at least annually in practice, more often for high-risk processes.

← Back to all articles