Guide overview
Employee data transfers, at a glance.
Separate where data is stored from who receives it.
Identify the data, purpose, exporter, recipient and actual service before selecting an applicable EU, UK or Swiss transfer route. Where SCCs are used, choose the module from the parties’ roles and complete the relevant annexes, assessment and safeguards. Local storage duties are a separate country-specific check.
Data flow
Map the recipient
Identify the parties, processing roles and countries involved in the transfer.
Transfer route
Record the legal basis
Check the applicable adequacy or safeguard route.
SCCs
Review module and assessment
Match the module to the roles and review the transfer impact.
Local storage
Check separately
Review local storage requirements as a distinct question.
Check before acting
Keep one evidence record for each data flow.
What to record in the worksheet
Scope
Flow / purpose · Data and people · Exporter / role
Evidence and follow-up
Importer / role · Storage location · Remote access / onward recipient · Transfer or residency basis · Evidence / owner / review date
Ask the provider to name the legal entities that store payroll data, provide remote support and keep backups. Include anyone they pass the data to. With that map, you can assess whether a transfer takes place, which legal route applies and whether local law requires storage in a particular country. Standard contractual clauses (SCCs) are one possible route.
1. Data residency vs transfers under GDPR
Data residency describes where data is stored. Chapter V of GDPR applies a different test, set out in the EDPB’s Guidelines 05/2021: whether a controller or processor subject to GDPR for the processing makes data available to a separate controller or processor in a third country.
Suppose a separate service provider in Manila can open payroll records held in Frankfurt. That access can involve a transfer to the Philippines. An employee accessing their own employer’s records from abroad presents a different case because the data stays within the same legal entity. Both arrangements need appropriate security. For US hosting, check whether an adequacy decision covers the recipient or another GDPR provision allows the transfer. The other GDPR duties still apply.
Our GDPR guide for distributed teams covers controller and processor roles for each EOR service and the Article 28 terms.
Map storage, overseas access and onward transfers
For each flow, name the exporter and importer and describe their roles. Record the data, its purpose, where it is stored, who can access it remotely and who receives it next. Keep the evidence for the transfer route alongside any separate local storage requirement.
| The working record | Fields to complete |
|---|---|
The working record Scope | Fields to complete Flow / purpose · Data and people · Exporter / role |
The working record Evidence and follow-up | Fields to complete Importer / role · Storage location · Remote access / onward recipient · Transfer or residency basis · Evidence / owner / review date |
2. The 2021 standard contractual clauses: which module to use
The 2021 transfer SCCs were adopted by Commission Implementing Decision (EU) 2021/914, and the transition period for the old 2001 and 2010 sets ended on 27 December 2022. If a contract still relies on the old clauses as its transfer safeguard, update the arrangement.
The 2021 text has four modules, chosen by data flow, and a single vendor can need several:
| Module | Flow | EOR example |
|---|---|---|
Module Module 1 | Flow Controller to controller | EOR example Employment data shared between you and the EOR. Deel’s DPA FAQs (October 2024) and Remote’s DPA both place EOR employment data here, as independent controllers |
Module Module 2 | Flow Controller to processor | EOR example Platform services you instruct: the global payroll module, HRIS, contractor management |
Module Module 3 | Flow Processor to processor | EOR example An EOR acting as a processor transfers data to another processor. If the EOR instead acts as a controller and transfers data to a processor, Module 2 applies when SCCs are used |
Module Module 4 | Flow Processor to controller | EOR example An EEA processor returning data to you as a non-EEA controller. Rare in EOR setups; involve counsel before relying on it |
Fig. 1 · The four modules of the 2021 SCCs mapped to EOR data flows · Decision (EU) 2021/914
The clause text is fixed, so deal-specific content goes in the annexes: Annex I (parties and flows), Annex II (technical and organizational measures) and Annex III (approved sub-processors). Incomplete annexes can leave essential transfer details undocumented; fill them with the actual parties, data, purposes and safeguards. Clause 7, the docking clause, lets new group entities join later without re-signing existing contracts.
Remote’s DPA applies Module 1 to its independent-controller services and Module 2 to its processor services. If a DPA uses one module across several products, ask the provider to show that it fits the actual roles and transfers.
Trace one hypothetical payroll flow
Imagine an EU employer collects employee details for payroll and stores them with a platform in the EU. A separate company outside the EU can access those details for support. Map the disclosure to the platform, the support company’s access and any further disclosures individually. You need each party’s role and the applicable rules before choosing a transfer mechanism, an SCC module or a supporting assessment.
3. Transfer impact assessments: what a usable TIA shows
Since the Schrems II judgment (CJEU Case C-311/18, 16 July 2020), SCC-based transfers have needed a case-by-case check of whether the destination country’s law undermines the clauses. The 2021 SCCs put that duty into Clause 14, and the EDPB’s Recommendations 01/2020 (final version adopted 18 June 2021) set it out in six steps: map your transfers, confirm the transfer tool, assess the destination’s law and practice, add supplementary measures, take the procedural steps and re-evaluate periodically.
For a transfer that relies on SCCs, name the exporter and importer and agree who will prepare the Clause 14 assessment. If the vendor controls a further transfer, ask it for evidence covering your data, the actual recipient and the processing it performs. Use the following points to build the transfer impact assessment.
On 22 May 2023 the Irish DPC fined Meta €1.2 billion, still the largest GDPR fine, for EU-US transfers that relied on SCCs without adequate supplementary protections. The same legal reasoning applies to a 10-person payroll file held by your EOR.
4. The EU-US Data Privacy Framework: history through June 2026
Before relying on the DPF, verify that the adequacy decision remains applicable and the exact recipient’s active certification covers the data and transfer. The framework has faced legal challenges since adoption in 2023.
| Date | Event |
|---|---|
Date 6 Oct 2015 | Event Safe Harbour annulled (Schrems I, Case C-362/14) |
Date 16 Jul 2020 | Event Privacy Shield annulled (Schrems II, Case C-311/18) |
Date 10 Jul 2023 | Event Commission adopts the DPF adequacy decision |
Date Oct 2024 | Event First periodic review keeps adequacy, flags PCLOB capacity |
Date 27 Jan 2025 | Event Three of the four sitting PCLOB members dismissed; the board loses its quorum |
Date 3 Sep 2025 | Event General Court dismisses the Latombe challenge (Case T-553/23) |
Date 31 Oct 2025 | Event Appeal filed at the Court of Justice (Case C-703/25 P); pending, no hearing date as of June 2026 |
Fig. 2 · EU-US transfer framework timeline, seven dates from Safe Harbour to the pending appeal · as of June 2026
Checked 15 October 2026: the European Commission still lists the EU-US Data Privacy Framework as an adequacy arrangement, and CURIA lists C-703/25 P as a pending appeal, including a 4 June 2026 procedural order.
Keep a contingency plan for the chosen transfer route. If the DPF route ceased to cover a transfer, put another valid transfer mechanism in place before continuing, or suspend the affected transfer. A fallback to SCCs needs the applicable module, completed annexes, assessment and any necessary measures.
Look up the legal entity that will receive the data and check that its active Data Privacy Framework certification covers the data you plan to send. Then follow any onward disclosures. Ask the recipient how it meets the framework’s rules for passing data on and which Chapter V duties apply.
5. UK transfers: the IDTA, the Addendum and the 2025 Act
First establish whether UK GDPR applies and whether you initiate a restricted transfer to a separate organization outside the UK. If UK adequacy regulations cover it, no Article 46 safeguard is needed. Otherwise, identify an appropriate safeguard or a qualifying exception.
The IDTA and the UK Addendum to the EU SCCs are two available safeguards, but the EU SCCs alone do not qualify. If you use either, complete the transfer risk assessment and any necessary extra protections. Approved binding corporate rules and other safeguards may also be available.
For US transfers, the UK’s simpler route is the UK Extension to the DPF (the UK-US Data Bridge), in force since 12 October 2023. It applies only if the US importer has certified for the UK Extension, a separate option on its DPF registration.
The ICO’s current guidance applies the data protection test in the Data (Use and Access) Act 2025: protection after the transfer must not be materially lower. As of 24 September 2026, the ICO says to keep using the current IDTA and Addendum while it prepares updated versions, so track its guidance and your instrument’s update provisions.
For a UK hire, map the actual payroll, platform and support flows and record who initiates each restricted transfer and which route covers it. An Addendum in a DPA still needs the correct parties, transfer details and completed tables.
6. Switzerland: the revFADP
Switzerland’s fully revised Federal Act on Data Protection (revFADP) took effect on 1 September 2023. Its Articles 16 and 17 distinguish disclosure to destinations covered by an adequacy decision, disclosure using appropriate guarantees, and specific statutory exceptions. The Federal Council’s adequacy list is in Annex 1 of the ordinance. Where adequacy does not cover the flow, assess the applicable guarantees or whether a particular Article 17 exception genuinely applies; do not assume an exception covers routine payroll.
The FDPIC recognized the 2021 EU SCCs on 27 August 2021, provided a Swiss annex adjusts them: Swiss law as the reference where Swiss data subjects are affected, the FDPIC as the competent authority and no reduction in protection. For US transfers, the Swiss-US Data Privacy Framework has applied since 15 September 2024 and mirrors the EU version, including certification by individual legal entity.
For each Swiss data flow, identify the destination and the Swiss transfer route that applies. A Swiss hire does not by itself require an EU SCC pack or a UK Addendum.
7. Data residency requirements in Russia, China and India
Local storage duties are separate from transfer safeguards, and contract clauses do not override them. Some laws require a local database or copy, restrict particular data categories or impose sector-specific conditions. The examples below are not a complete list, so check the current rules, thresholds and exceptions, including for employment data, in every relevant jurisdiction, data category and sector.
| Country | Instrument | What must stay in-country |
|---|---|---|
Country Russia | Instrument Federal Law 242-FZ, in force 1 Sep 2015 | What must stay in-country Where the localization duty applies, identify the covered data, entity and required primary operations/database; assess any separate cross-border requirements |
Country China | Instrument PIPL (1 Nov 2021) + CAC cross-border Provisions (22 Mar 2024) | What must stay in-country Assess CIIO/important-data and applicable export conditions. Any HR-management exemption depends on its actual purpose, labour-rule/collective-contract and other legal conditions; not every employee-data flow is exempt. |
Country India | Instrument RBI directive (6 Apr 2018); DPDP Act 2023 + Rules (Nov 2025) | What must stay in-country Payment-system data: assess the applicable RBI storage rule. Other employee-data flows: check currently operative rules; do not use future-phase DPDP provisions as present permission. |
Fig. 3 · Selected storage and transfer rules in Russia, China and India · examples only
Russia: identify the actual localization duty. Ask which primary databases, operations, data subjects and entities are covered, where processing takes place and which current local rule applies. The 2016 LinkedIn blocking is a historical enforcement example. A provider offering Russian employment should substantiate the relevant locations and legal basis before the flow begins.
China: check the employee-data conditions as well as the destination. PIPL export routes and the March 2024 cross-border data-flow provisions require analysis of the actual dataset, entity and purpose. A human-resources exemption is conditional, including the applicable labour rules or collective contract; it does not remove all personal-information protection duties. For Chinese hires, obtain the relevant employee notice, impact-assessment record and documented explanation of the route or exemption used. Do not apply a numerical export threshold without checking its covered data and entity conditions.
India: distinguish the current sector rules from the phased DPDP framework. Section 16 of the DPDP Act gives the central government power to restrict transfers to notified countries or territories. Rule 15 addresses government-specified requirements for making data available to a foreign state or an entity under its control; it is not a general list of permitted destinations. The November 2025 Rules phase the relevant substantive provisions in after 18 months, in May 2027. As of 3 October 2026, do not treat those future provisions as the operative permission for a transfer. Check existing sector rules separately, including the RBI’s payment-system-data storage requirements, and assess their scope for the actual system and data.
8. Where EOR vendors host employee data
The data sits in places a contract can name: a production database in one cloud region and backups in another.
Our provider ratings show the order in which we recommend providers overall. They are not scores for an individual fee, contract term, certification or country.
★★★★★4.7
What it publishes about hosting
AWS, primary region Ireland, disaster recovery in France, so EU-hosted by default; AES-256 at rest, per its security page
Reported hosting and security
SOC 2, ISO 27001
Our rating
4.7/5
Deel dashboard
Enlarge screenshot
Reviewed by Martynas Pupkevicius · Fact-checked by Michael Ennis
Opens deel.com
★★★★★4.5
What it publishes about hosting
No hosting region published; SOC 2 report on a public security dashboard
Reported hosting and security
SOC 2 Type II; no ISO 27001 published; states DPF adherence
Our rating
4.5/5
Oyster dashboard
Enlarge screenshot
Reviewed by Martynas Pupkevicius · Fact-checked by Michael Ennis
Opens oysterhr.com
Fig. 4 · Published hosting and security stacks, Deel and Oyster · public record as of August 2026
Remote’s trust center lists ISO 27001, SOC 2 Type II and CSA STAR Level 1, none of which locates the data. A current service-specific processing schedule and sub-processor list are needed to establish locations and recipients. Papaya Global’s security materials claim SOC 1 and SOC 2 Type II, ISO 27001 (held since 2018) and ISO 27701 but name no region.
If the public sources do not name a region, ask the provider. For every provider, apply these checks:
9. DPO checklist: 16 checks and their evidence
Complete the applicable checks before the relevant data flow starts, and record why each remaining item does not apply.
Map the flows
| # | Check | Evidence that closes it |
|---|---|---|
# 1 | Check Every transfer listed | Evidence that closes it A flow table: hire country → vendor entities → sub-processor countries, per service |
# 2 | Check Role per flow confirmed | Evidence that closes it DPA appendix naming controller or processor for each product you buy |
# 3 | Check Data categories inventoried | Evidence that closes it Payroll fields flagged for special categories (health, union dues, religious tax markers) |
# 4 | Check Hosting geography in writing | Evidence that closes it Named cloud provider, production region, backup region |
# 5 | Check Access geography in writing | Evidence that closes it Countries from which support and engineering can reach production data |
Fig. 5 · DPO flow-mapping checklist, flow-mapping checks 1–5
Document the transfers
| # | Check | Evidence that closes it |
|---|---|---|
# 6 | Check Transfer route and any SCC module recorded | Evidence that closes it Applicable adequacy decision, safeguard or qualifying exception; if SCCs are used, module selected from the parties’ actual roles |
# 7 | Check Required transfer documents complete | Evidence that closes it Where SCCs are used: completed relevant annexes, parties, flows, safeguards and sub-processors as required |
# 8 | Check Applicable transfer assessment on file | Evidence that closes it For SCC-based transfers: current Clause 14 assessment covering the actual flow, destination law and required measures |
# 9 | Check DPF status verified where that route is relied on | Evidence that closes it Exact recipient and covered data verified on the DPF list; contingency route documented and assessed |
# 10 | Check UK instruments in place for applicable restricted transfers | Evidence that closes it Restricted-transfer test and UK route recorded; Addendum/IDTA and TRA where that safeguard is used |
# 11 | Check Swiss adaptations where SCCs are used for a Swiss transfer | Evidence that closes it Applicable Swiss transfer route recorded; Swiss SCC adaptations where those clauses are the chosen safeguard |
Fig. 6 · DPO transfer-documentation checklist, transfer-paperwork checks 6–11
Confirm residency and keep the evidence current
| # | Check | Evidence that closes it |
|---|---|---|
# 12 | Check Localization screen run | Evidence that closes it Relevant countries, data categories and regulated sectors checked for storage, local-copy, transfer and exemption requirements |
# 13 | Check China HR exemption documented where relied on | Evidence that closes it Labor rules or collective contract, employee notice, PIPIA on file (where this exemption is the proposed route for China employment-data transfers) |
# 14 | Check In-region hosting contractual | Evidence that closes it Order-form commitment, not “available on request” (if any customer requires it) |
# 15 | Check Re-assessment scheduled | Evidence that closes it A documented TIA review schedule and triggers: new sub-processor, transfer involving another country or relevant legal change |
# 16 | Check Evidence pack filed | Evidence that closes it All of the above in one folder your security team can find without asking you |
Fig. 7 · DPO residency and review checklist, residency and upkeep checks 12–16
Track how clearly and promptly each vendor provides the evidence, including hosting, access and transfer assessments.
Review the map when the service changes
Reopen the affected flow when a supplier changes a hosting or backup region, introduces a sub-processor, moves support access, adds a local employer or changes data categories or purposes. Record the notice date, review owner, document revision and action required before the changed flow is accepted.
The evidence to collect for each data flow
Create one record for each meaningful flow, including support access and backups.
| Question | Ask for | Decision it supports |
|---|---|---|
Question Where is the data stored? | Ask for Production and backup locations, with the legal entities operating them. | Decision it supports Whether a location promise or local storage rule is met. |
Question Who can access it? | Ask for Recipient entities, countries, purposes and categories of data. | Decision it supports Whether access involves a separate overseas recipient. |
Question What role does each entity perform? | Ask for Controller or processor role for this processing activity. | Decision it supports Which contractual duties and transfer tools fit. |
Question Which transfer route applies? | Ask for Applicable adequacy decision, safeguard or qualifying exception. | Decision it supports Which GDPR provision permits this transfer. |
Question What makes that route usable? | Ask for Recipient scope; or completed clauses, assessment and measures where required. | Decision it supports Whether the documents cover this transfer in practice. |
Question Who keeps the record current? | Ask for Named owner, change notifications and review triggers. | Decision it supports Whether new entities, locations or laws require a fresh review. |
A single contract can cover several flows, but the evidence must identify each one clearly. An annual review is a useful internal control; it is not a universal statutory expiry date for a transfer assessment.
Include storage, access and onward disclosures.
Name each sender, recipient and subprocessor.
Apply the relevant jurisdiction’s rules to the actual flow.
Use the applicable adequacy, safeguards or exception rules.
Record the assessment and revisit material changes.
Apply the relevant EU, UK or Swiss rules to each actual flow; other privacy and security duties still apply.
10. Frequently asked questions
Do I still need SCCs if my EOR hosts everything in the EU?
Which SCC module applies to EOR employee data?
Is the EU-US Data Privacy Framework still valid in 2026?
Does the UK accept the EU SCCs?
Only with the UK Addendum, because the EU SCCs alone are not a UK transfer safeguard. First check whether there is a restricted transfer and whether UK adequacy regulations cover it. If a safeguard is needed, the IDTA or the EU SCCs with the UK Addendum are options, alongside other permitted safeguards, and you must complete the required transfer risk assessment. A qualifying exception may apply in limited cases, and a UK employee does not by itself require an IDTA or Addendum.
How do I check local data storage requirements for payroll data?
Check every relevant country, data category and sector for storage or local-copy duties, export conditions and employment-data exceptions. Ask the EOR to identify the rule, explain whether it applies to your actual flow and document how it meets it. The Russia, China and India examples in this guide have different scopes and do not establish a general local-storage rule for all payroll data.
11. Sources
The sources behind this guide, grouped by topic. Dates show when we last checked a page. Prices and terms change, so confirm them in your quote.
EU transfer law and guidance
7 sourcesEuropean Union · EUR-Lex
Regulation (EU) 2016/679 (GDPR), Chapter V, Articles 44 to 49
European Union · EUR-Lex
Commission Implementing Decision (EU) 2021/914 of 4 June 2021: Standard Contractual Clauses
European Union · European Commission
Standard contractual clauses: questions and answers
Modules, annexes, Clause 14 assessment and suspension.
European Union · EDPB
Recommendations 01/2020 on supplementary transfer measures
Dated 18 June 2021.
European Union · EDPB
Guidelines 05/2021, version 2.0
Dated 14 February 2023. Transfer criteria, the same-entity employee example and residual security duties.
European Union · EDPB
Processor chains and the transfer criteria.
European Union · European Commission
EU-US Data Privacy Framework
9 sourcesEuropean Union · CJEU
Judgment of 16 July 2020.
European Union · EDPB
1.2 billion euro fine on Meta for EU-US transfers
Result of the EDPB binding decision, 22 May 2023.
European Union · European Commission
Press release on the adequacy decision for the EU-US Data Privacy Framework
Published 10 July 2023.
European Union · EUR-Lex
Commission Implementing Decision (EU) 2023/1795
DPF scope and the Accountability for Onward Transfer Principle.
European Union · European Commission
Report on the first periodic review of the EU-US Data Privacy Framework, COM(2024) 451
Dated 9 October 2024. PCLOB vacancies and nominations to be monitored. Checked Sep 2026
European Union · CJEU
Case C-703/25 P, Latombe v Commission (appeal)
Notice of appeal (Official Journal)
Appeal from the General Court’s judgment in Case T-553/23 (3 September 2025). Filed 31 October 2025 and pending; the listing also shows a 4 June 2026 order. Listing checked 15 Oct 2026.
United States · Data Privacy Framework program
EU, UK extension and Swiss-US certifications.
United States · Nextgov/FCW
Judge overturns firing of Democrats on intelligence and privacy oversight body
Four PCLOB members were in place at the January 2025 dismissals; the quorum is three members. Checked Sep 2026
United States · Independent Institute
PCLOB and the future of Section 702
Dated 14 July 2026: the board is without a quorum. Checked Sep 2026
Data laws outside the EU
14 sourcesUnited Kingdom · ICO
A brief guide to international transfers
Restricted-transfer test, adequacy, safeguards and exceptions.
United Kingdom · ICO
International data transfer agreement and guidance
The IDTA and UK Addendum, in force 21 March 2022. International transfers guidance updated January 2026.
United Kingdom · ICO
Standard data protection clauses: the UK IDTA and the Addendum
Completion requirements and current versions.
United Kingdom · legislation.gov.uk
Switzerland · Fedlex
Federal Act on Data Protection (revFADP)
In force 1 September 2023. Articles 16 and 17 distinguish disclosure to destinations covered by an adequacy decision, disclosure using appropriate guarantees, and specific statutory exceptions.
Switzerland · FDPIC
Recognition of the 2021 EU SCCs, subject to the Swiss annex (27 August 2021).
Switzerland · FDPIC
Cross-border transfer of personal data
Adequacy, safeguards and exceptions.
China · Cyberspace Administration of China (CAC)
PIPL and cross-border data flow rules
PIPL (1 November 2021) and the Provisions on Promoting and Regulating Cross-Border Data Flows (22 March 2024).
China · Cyberspace Administration of China (CAC)
Provisions on Promoting and Regulating Cross-Border Data Flows, full text
Volume thresholds and the HR-management exemption. In force 22 March 2024.
India · Government of India
DPDP Act 2023 and DPDP Rules 2025
Rules notified November 2025.
India · Reserve Bank of India (RBI)
Storage of Payment System Data
Dated 6 April 2018.
Russia · Stanford WILMap
Russia · Recording Law
Russian data privacy law overview
LinkedIn block (November 2016) and localization fine bands under Law 405-FZ (December 2019).
Russia · Denuo
Client alert on Federal Law 23-FZ of 28 February 2025
Extends the localization duty to processors from 1 July 2025.
Provider data-protection terms
3 sourcesDeel
The DPA FAQs (October 2024) treat you and the EOR as independent controllers of the employment data you share.
Oyster
SOC 2 Type II and DPF adherence.
Remote
Treats you and the EOR as independent controllers of the employment data you share. Checked Jun 2026
Our research
2 sourcesThe Best EOR
How we rate EOR providers.
The Best EOR
47 questions, including hosting regions, EU residency and the sub-processor list. Checked Sep 2026
The October 2026 update corrects the India phase-in explanation and checklist applicability. Transfer definitions, UK route selection and SCC contingency wording were checked on 24 September 2026.
If you spot a changed price or a conflicting source, send it through the contact page and we’ll review it.
This guide is for general information only and does not provide legal, tax, accounting, or financial advice. For advice about your business, consult a qualified professional familiar with the rules where you hire. Read our research methodology to learn how we assess sources.
