Developers outside the EU: when access is a GDPR transfer

The European Data Protection Board (EDPB) treats remote access to personal data from a third country as a transfer under the GDPR, even when the data stays on servers in the EU and is only shown on a screen. If a separate company or person outside the EU can see the data, Chapter V of the GDPR applies, and the exporter needs an adequacy decision, safeguards such as standard contractual clauses, or one of the narrow exceptions.

When does access from outside the EU count as a transfer?

The GDPR does not define "transfer". The EDPB's Guidelines 05/2021, version 2.0 of 14 February 2023, give three cumulative criteria. First, a controller or processor (the "exporter") is subject to the GDPR for the processing. Second, the exporter discloses by transmission or otherwise makes personal data available to another controller, joint controller or processor (the "importer"). Third, the importer is in a third country, whether or not the GDPR also applies to the importer. All three must be met, so a transfer is a question of who receives the data and where they sit.

The second criterion is where developers come in. The Guidelines list ways of making data available, such as creating an account or granting access rights to an existing one. They then say that "remote access from a third country (even if it takes place only by means of displaying personal data on a screen, for example in support situations, troubleshooting or for administration purposes)" is also considered a transfer, if the three criteria are met. The EDPB's Recommendations 01/2020 repeat the point in paragraph 13.

Two examples from the Guidelines mark the boundary. In Example 8, an employee of a Polish company takes a laptop on a business trip and reaches company data remotely. The EDPB says this is not a transfer, because the employee is "an integral part of the controller" and not a different controller or processor. In Example 11, a company in a third country with no EU establishment acts as a processor for EU controllers and remotely accesses data stored in the EU, for example for support. Since it is located in a third country, "such remote access results in transfers".

The Guidelines also say that Chapter V does not apply to "internal processing", where data is not disclosed to another controller or processor, including where that processing takes place outside the EU. A footnote adds that a natural person can be a controller or processor, "e.g. as a self-employed person". The Guidelines do not discuss freelancers or contractors as a group, so where a particular developer sits on this line is a question for a lawyer.

The Guidelines are an EDPB reading, not the Regulation. Article 44 of the GDPR says a transfer "shall take place only if" the conditions of Chapter V are complied with.

What does Chapter V allow instead of a ban?

Chapter V runs from Article 44 to Article 49, and it gives three bases. The first is adequacy under Article 45. Where the Commission has decided that a third country ensures an adequate level of protection, the transfer "shall not require any specific authorisation", which makes it the simplest route for a buyer when it is available.

The second is appropriate safeguards under Article 46. "In the absence of a decision pursuant to Article 45(3)", a transfer is allowed only if the exporter has provided appropriate safeguards and enforceable data subject rights and effective legal remedies are available. Article 46(2) lists the tools, including binding corporate rules and "standard data protection clauses adopted by the Commission".

The third is the set of derogations in Article 49. If neither of the other bases applies, a transfer may rely on a list of conditions, such as explicit consent after being informed of the risks, or necessity for a contract with the data subject. There is also a last-resort route for a transfer that is "not repetitive", concerns "only a limited number of data subjects" and rests on compelling legitimate interests. The EDPB's Recommendations say Article 49 "has an exceptional nature" and that derogations "cannot become 'the rule' in practice". Our reading: ongoing development work with access to a client's data is not what these exceptions were written for.

On fines, Article 83(5) says infringements of the rules on transfers to a recipient in a third country under Articles 44 to 49 can lead to fines of up to EUR 20,000,000 or, for an undertaking, up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher.

Which countries have an adequacy decision?

The Commission's adequacy decisions page lists these as recognised: Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (commercial organisations participating in the EU-US Data Privacy Framework) and Uruguay, plus the European Patent Organisation. That is 16 countries or territories by our count. India, Ukraine, Turkey and Egypt, for example, do not appear on it.

Recent entries on the same page show how the list moves. On 19 December 2025, the Commission renewed its two 2021 decisions for the United Kingdom. The date the Commission's page gives for its adequacy decision for Brazil is 26 January 2026, although its news item is dated 27 January 2026. On 23 July 2026, the Commission concluded its first review of the 2021 decision for the Republic of Korea and found that it continues to provide an adequate level of protection. The listing for the United States covers only organisations participating in the Data Privacy Framework, so a US importer has to be a participant for Article 45 to apply.

The US decision has the most open questions in our reading. The General Court dismissed an action to annul it on 3 September 2025 in Case T-553/23 (Latombe v Commission). An abstract in the European Data Protection Law Review says Mr Latombe appealed on 31 October 2025 in Case C-703/25 P. We found no ruling on that appeal. On 31 July 2026 the EDPB wrote to Commissioner McGrath after the US Supreme Court's ruling of 29 June 2026 in Trump v. Slaughter, which overruled Humphrey's Executor. The Board asked the Commission "to closely assess whether this development affects the functioning of Commission Implementing Decision EU 2023/1795". The letter does not ask for suspension. We found no Commission assessment published since, and the decision is still on the Commission's list.

What do the standard contractual clauses add?

Where there is no adequacy decision, the usual tool is the set of clauses in Commission Implementing Decision (EU) 2021/914 of 4 June 2021. The decision repealed the earlier clauses from 27 September 2021.

They are modular, with four modules: controller to controller, controller to processor, processor to processor and processor to controller. In our reading, a client that engages an external development team as a processor would look to the controller-to-processor module. The clauses also set out the Article 28(3) and (4) processor terms for that relationship.

There is one limit. Article 1(1) of the decision covers an importer "whose processing of the data is not subject to" the GDPR. The Commission's SCC page says it is still developing additional clauses for importers whose processing is directly subject to the GDPR.

Clause 14 asks both parties to warrant that they have "no reason to believe" that the destination country's laws and practices stop the importer meeting its obligations. They must take account of the circumstances of the transfer, the laws on access by public authorities and any additional safeguards, and they "agree to document the assessment" and make it available to the supervisory authority on request. The clause does not use the term "transfer impact assessment".

What is a transfer impact assessment?

The EDPB's Recommendations 01/2020 set out six steps. The term "transfer impact assessment" does not appear in them, so here we use it for step 3 and its follow-ups. Step 1 is to know your transfers, including remote access and onward transfers, and step 2 is to identify the transfer tool, whether adequacy, Article 46 or a derogation.

Step 3 is to assess whether the Article 46 tool is effective given the law and practice in the third country, looking in particular at access by public authorities. Step 4 is to adopt supplementary measures if the assessment shows a gap, and step 5 is to take the procedural steps those measures need. Step 6 is to re-evaluate at appropriate intervals. Step 3 depends on the facts. The circumstances to consider include the purposes, the sector, the categories of data, "whether the data will be stored in the third country or whether there is remote access to data stored within the EU/EEA", and whether the data is in plain text or pseudonymised.

Use Case 6 covers developers who need data in the clear. Where a processor needs access to the data in the clear and the public authorities' powers go beyond what is necessary and proportionate, the EDPB says it is "incapable of envisioning an effective technical measure" to prevent that access, given the current state of the art. Our reading: in that case the main lever is data that does not identify anyone, and whether it is enough depends on the data and who holds any keys.

A checklist for a project with developers outside the EU

This section is our addition. It turns the legal text and the EDPB documents into questions for a project kick-off. It is not legal advice.

Begin with the people. Is the person or company outside the EU a separate controller or processor, or an employee of yours? Example 8 and Example 11 point to different answers. Then ask in which country they will work and whether it is on the Commission's adequacy list today. If it is the United States, is their employer a Data Privacy Framework participant?

If the country is not on the list, decide which Article 46 tool you will use. For a processor, the controller-to-processor module is the likely candidate. Settle who will document the Clause 14 assessment, and what it says about public-authority access in that country. Check too whether the work can be done on test or anonymised data. If real personal data is needed, someone must approve it and set the conditions.

Last, assign the follow-up. Who re-checks the assessment, and when? Step 6 of the Recommendations asks for monitoring on an ongoing basis, and the Commission's page shows changes to the list in December 2025 and January 2026.

Our security page describes how we handle client data, including live data staying in the client's EU systems by default, and offers written answers for supplier checks. Read it with these questions in mind. If you are weighing an external team, our dedicated teams page describes the model.

What we could not confirm

We read the GDPR as published in the Official Journal in 2016 and did not check a consolidated version for later amendments. A Digital Omnibus proposal to amend Regulation (EU) 2016/679 was published on 19 November 2025 and, according to the Parliament's procedure file, is awaiting a committee decision. We did not check whether it changes Chapter V.

The status of the Latombe appeal (C-703/25 P) rests on one journal abstract, because the Court's own register page needs JavaScript and did not load for us. We found no published Commission response to the EDPB's letter of 31 July 2026, although absence of a result in our search is not proof that none exists. The EDPB's guidance is not binding law, and we found no court ruling on whether on-screen access alone is a transfer.