Guide overview
EOR GDPR responsibilities, at a glance.
Map the role for each processing activity and data flow.
Map each employee-data purpose, the parties’ actual roles, the legal basis for processing and any additional condition for sensitive data. Use Article 28 terms for processor activities and appropriate arrangements between controllers. Connect the existing employee-notice and request procedures to those purposes, assess whether a DPIA is required, and identify which GDPR provision permits each international transfer. Record why a checklist item applies or does not apply.
Data roles
Map each purpose
Identify controller and processor roles for the actual service.
Contract terms
Use the right agreement
Review Article 28 terms and cooperation between controllers as applicable.
International transfers
Identify what permits the transfer
Document the basis for each transfer and the parties involved.
Checklist evidence
Record applicability
Complete applicable items and explain why other items do not apply.
Check before acting
Do not assign one data role to the entire relationship without reviewing the individual services and processing activities.
What to record in the worksheet
Scope
Service / purpose · Client role and reason · EOR role and reason
Evidence and follow-up
Other recipient · Agreement / instructions · Employee information · Evidence · Owner / approval / review date
Before you send an EOR the first employee file, map what it will do with the data. For each use, identify who decides its purpose and essential means, the legal basis for processing and any additional condition needed for sensitive data. Check the terms that cover service providers and international transfers.
1. Controller or processor: the EOR’s role under GDPR
Under GDPR, the controller decides why and how personal data is processed (Article 4(7)), and the processor handles it only on the controller’s documented instructions (Article 4(8)). An EOR’s employment responsibilities can involve its own controller purposes, while other activities may be processing on the client’s behalf.
As the legal employer, the EOR registers your hire with the tax office and social insurance bodies, runs payroll, files statutory returns, administers benefits and, where applicable, handles the agreed immigration service. Local law sets what it must do in those processes, and the EOR decides how. Under the EDPB’s Guidelines 07/2020 on the concepts of controller and processor (final version adopted 7 July 2021), a party that determines purposes and means for its own legal obligations is a controller in its own right.
Look at one activity at a time. Your company and the EOR may each act as a controller where they decide the purposes and essential means of processing. A vendor acts as a processor for work it carries out on a controller’s behalf.
This split limits what you can demand. You cannot instruct an independent controller as you would a processor, or require deletion contrary to an applicable retention duty. For Germany, §41 EStG retains payroll tax accounts through the sixth calendar year following the last recorded payment; §147 AO distinguishes ten-, eight- and six-year categories with their own triggers and exceptions. Other employment and social-insurance records need their own schedule. If something goes wrong, the supervisory authority assesses each controller separately. Your Article 30 records of processing must reflect the roles each party performs.
Map roles for each service and purpose
For each purpose, record the controller, Article 6 basis and any additional Article 9 condition for special-category data. Each independent controller is responsible for its own purposes; the buyer does not select every basis for the employer. Record whether a DPIA is required before high-risk processing and any applicable consultation. Link these decisions to the existing employee-notice, request-routing, retention and incident records.
| The working record | Fields to complete |
|---|---|
The working record Scope | Fields to complete Service / purpose · Client role and reason · EOR role and reason |
The working record Evidence and follow-up | Fields to complete Other recipient · Agreement / instructions · Employee information · Evidence · Owner / approval / review date |
2. The roles Deel and Remote take in their DPAs
Deel’s DPA FAQs (effective 28 October 2024) include a role table for each product line. For EOR and consulting services, “Deel and Client are independent Data Controllers,” because “the Client manages the working relationship (under the Work Order) and Deel manages the employment relationship.” For Global Payroll, Deel HR, contractor management, integrations and background checks, Deel is a processor.
Remote’s DPA (last updated 3 August 2026) takes the same approach. For Employment Services, “each party acts as an independent Controller,” with processing details in Schedule 1, and Schedule 5 treats Contractor of Record the same way. Where Remote provides HRIS, contractor management or global payroll, it is a processor.
Our provider ratings show the order in which we recommend providers overall. They are not scores for an individual fee, contract term, certification or country. “Not rated” means we have not published a rating.
| Service | Deel: verify the activity and current agreement | Remote: verify the activity and current agreement |
|---|---|---|
Service Our rating | Deel: verify the activity and current agreement ★★★★★4.7/5 | Remote: verify the activity and current agreement 3.8/5 |
Service EOR employment data | Deel: verify the activity and current agreement Employer/controller purposes may apply; verify the specific activity and legal entity | Remote: verify the activity and current agreement Employer/controller purposes may apply; verify the specific activity and legal entity |
Service Global payroll | Deel: verify the activity and current agreement Processor where acting on client instructions; assess any separate controller purposes | Remote: verify the activity and current agreement Processor where acting on client instructions; assess any separate controller purposes |
Service Contractor management | Deel: verify the activity and current agreement Processor where acting on client instructions; assess any separate controller purposes | Remote: verify the activity and current agreement Processor where acting on client instructions; assess any separate controller purposes |
Service HRIS module | Deel: verify the activity and current agreement Processor where acting on client instructions; assess any separate controller purposes | Remote: verify the activity and current agreement Processor where acting on client instructions; assess any separate controller purposes |
Fig. 1 · Deel and Remote GDPR roles across four service lines · per Deel’s DPA FAQs (Oct 2024) and Remote’s DPA (Aug 2026)
Deel’s product table and Remote’s schedules describe their contractual positions. Compare those labels with the actual processing activities before choosing terms.
3. The Article 28 DPA: nine required terms
Where the EOR is your processor, Article 28(3) sets out what the contract must contain. Check that the DPA includes:
Missing terms matter because, under Article 83(4)(a), violations of the processor obligations can be fined up to €10 million or 2% of worldwide annual revenue, whichever is higher.
The independent-controller side falls outside Article 28, so look for separate controller-to-controller clauses allocating data subject request routing, breach cooperation and retention between you and the EOR. Deel and Remote put both sets of clauses in one DPA document, which is convenient but easy to misread. For other contract terms, see the 9 EOR contract clauses to review.
4. Sub-processor lists, notice windows and objection rights
Article 28(2) allows either specific approval of each sub-processor or general authorization with a published list and advance notice of changes. Where the EOR uses general authorization, check three contract details: where the list is published, how much notice you get and what remedy you have if you object.
Apply Article 28 sub-processor protections where the EOR processes data on your behalf. An independent controller appoints its own processors, and Article 28 gives another controller no authorization right over them. Provider examples:
A usable objection right lets you object in writing on data protection grounds, requires the vendor to propose a fix and lets you terminate the affected service without penalty if none follows.
Subscribe to the notification feed the day you sign and name an owner, because a 10- or 14-day window is easy to miss. Also ask for the SOC 2 Type II and ISO 27001 reports behind the security annex. The certifications guide explains which ones carry weight.
5. Transfers: 2021 SCC modules, TIAs and the Data Privacy Framework
Chapter V applies when a controller or processor subject to GDPR for the processing makes personal data available to a separate controller or processor in a third country. Identify those parties before choosing a transfer route: an adequacy decision under Article 45, appropriate safeguards under Article 46, or a qualifying Article 49 derogation. Do not assume an exception covers routine payroll.
The current SCCs, adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, have four modules. The transition period for using the old 2001/2010 clauses as the transfer safeguard ended on 27 December 2022. If you rely on the 2021 SCCs, choose the module that matches the parties’ actual roles in the transfer:
- Q1. For this data flow, does the EOR decide purposes itself (employment data: payroll, tax, social security)?
- YES → Controller-to-controller flow → Module 1
- NO → continue to Q2
- Q2. Is the EOR processing on your documented instructions (payroll module, HRIS, contractor management)?
- YES → Controller-to-processor flow → Module 2
- NO → Check the exporter and importer roles. Module 3 applies only when an EOR acting as a processor transfers data to another processor. An EOR acting as a controller and transferring data to a processor uses Module 2, if SCCs are the chosen safeguard.
Remote’s DPA follows this mapping, with Module 1 where the parties are independent controllers and Module 2 where Remote is a processor. If a vendor uses one module across different services, ask how it fits the parties and roles in each transfer.
Since the Schrems II judgment (CJEU Case C-311/18, 16 July 2020), SCCs alone are not enough. The exporter must also run a transfer impact assessment of the destination country’s surveillance law, as Clause 14 of the SCCs requires and EDPB Recommendations 01/2020 (adopted 18 June 2021) explain. Ask the vendor for its TIA. Skipping this step can be costly: the Irish DPC fined Meta €1.2 billion on 22 May 2023 for EU-US transfers without valid safeguards, still the largest GDPR fine on record as of September 2026.
Certified US companies can receive EU data without SCCs, because the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. Deel’s DPA FAQs say that Deel has self-certified, with the relevant provisions in Appendix 4 of its DPA. The EU General Court dismissed the Latombe challenge to the adequacy decision (Case T-553/23) on 3 September 2025, and as of June 2026 the appeal (Case C-703/25 P, filed 31 October 2025) was pending at the Court of Justice. Before relying on the framework, check its current status and the vendor’s certification on dataprivacyframework.gov. Also agree a contingency plan in case adequacy ceases. A fallback to SCCs needs the applicable module, completed annexes, a current transfer assessment and any necessary supplementary measures. If no valid route is available, suspend the affected transfer.
| Route or assessment | What it covers | Scope and review date |
|---|---|---|
Route or assessment EU SCCs (2021/914) | What it covers Transfers to non-adequate countries, 4 modules | Scope and review date One Article 46 safeguard; the old SCC transition ended on 27 Dec 2022 |
Route or assessment Transfer impact assessment | What it covers Every SCC-based transfer | Scope and review date Required since Schrems II, 16 Jul 2020 |
Route or assessment EU-US Data Privacy Framework | What it covers EU to certified US entities | Scope and review date June 2026 litigation snapshot; check current adequacy and certification before use |
Route or assessment UK IDTA / UK Addendum | What it covers UK restricted transfers | Scope and review date Two possible safeguards. An adequacy decision or another GDPR provision may cover the transfer. |
Route or assessment UK-US Data Bridge | What it covers UK to certified US entities | Scope and review date In force since 12 Oct 2023 |
Fig. 2 · Transfer routes and the SCC assessment requirement · SCC and UK rows checked 24 September 2026
UK transfers have separate rules. First establish whether you initiate a restricted transfer to a separate organization outside the UK (employing someone in the UK does not by itself establish one), then check whether UK adequacy regulations cover it. If you need appropriate safeguards, the options include the IDTA, the EU SCCs with the UK Addendum and approved binding corporate rules, and you must complete a transfer risk assessment. The EU SCCs alone are not a UK safeguard, and an Article 49 exception must meet its own conditions.
6. Data residency: what EU hosting does and does not cover
GDPR does not impose a general requirement to store employee data in the EEA. Where Chapter V applies, the transfer needs a valid route. The parties must also meet the rules for processing and securing the data, including any separate local or sector-specific storage requirements.
A Frankfurt database can still involve an international transfer. Access by a separate provider or group company in Manila or San Francisco may meet the EDPB’s transfer criteria. Access abroad by an employee acting within the same legal entity does not, by itself, meet the separate-recipient criterion. The entity responsible for the processing must still assess overseas-access risks and apply suitable security controls.
EU hosting can reduce some overseas storage flows, but map the remaining access and onward transfers before assessing the work required. Record production and backup regions, the legal entities operating them, and the countries and entities whose staff can access personal data. See the EOR RFP checklist and the data residency and SCCs guide.
7. Employee data rules: Article 88 and German works councils
Article 88 GDPR is an opening clause that lets member states set more specific rules for processing employee data, including through collective agreements. GDPR compliance for employment data therefore spans 27 national regimes. The EOR handles that layer as legal employer, and your job is to confirm that it does.
In Germany, employee data processing rests on Section 26 of the BDSG. That legal basis has been in doubt since the CJEU ruled on 30 March 2023 (Case C-34/21) that the equivalent Hessian provision was inapplicable where it merely restates GDPR without adding specific safeguards. A draft Employee Data Act (Beschäftigtendatengesetz) published in October 2024 lapsed when the governing coalition collapsed the following month, and no replacement had passed by mid-2026. A works agreement under Section 26(4) is not a blanket permission to process employee data. The CJEU’s December 2024 judgment in Case C-65/23 confirms that Articles 5, 6 and 9 GDPR still apply, so assess necessity and the specific legal basis with local advisers.
Works agreements are negotiated with the works council, which under Section 87(1) No. 6 of the Works Constitution Act (BetrVG) also has co-determination rights over any technical system capable of monitoring employee performance or behavior. Case law reads “capable” broadly enough to cover an HR platform with activity logs. For EOR hires this is the EOR’s responsibility as employer, so ask the vendor how it handles co-determination at its German entity. If you later move from an EOR to your own German entity, budget time for the works agreement, because negotiating one after the HRIS goes live costs more than agreeing it beforehand.
The benchmark fine for employee data. The Hamburg data protection authority fined H&M €35.3 million on 1 October 2020 because managers at its Nuremberg service center kept records on employees' private lives (illnesses, family events, religious beliefs) without a legal basis. There was no hack or transfer violation. Employee records need that documented basis even when the data never leaves your own systems.
EOR employees send Article 15 data subject access requests (DSARs) to whoever they can reach, usually you. Agree the routing and response deadlines (GDPR allows one month) in the DPA, because missing the applicable response deadline can breach the controller’s obligations. Name the routing owner and escalation contact; check whether a permitted extension applies and notify the person as required.
8. The 72-hour breach notification deadline
Article 33(1) requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in the relevant risk. Article 33(2) requires a processor to inform its controller “without undue delay.” When the risk is high, Article 34 also requires telling the people affected. Article 33(5) requires an internal register of every breach, even the ones you do not report.
Determine the role for the affected activity rather than the owner of the breached system. Each responsible controller assesses its authority-notification duty; a processor alerts its controller without undue delay. Coordinate the initial alert, awareness times and follow-up updates. An agreed outer deadline must not permit unnecessary delay or consume a controller’s own reporting window. Read the actual service-specific DPA rather than assume that a published 48- or 72-hour contractual term applies to every activity.
Run a drill before you need it: know which authority is your lead supervisor, keep a template Article 33 notice, and name the person who decides at 2 a.m. whether a breach poses a risk. The 72 hours include weekends.
Notify the controller without undue delay after becoming aware of a personal data breach.
Assess the breach and record the facts and response.
When required: without undue delay and, where feasible, within 72 hours of awareness.
For high-risk breaches, inform people without undue delay when required, subject to Article 34 exceptions.
Record the assessment even when notification is not required.
High-risk breaches also require notice to affected people without undue delay, subject to Article 34 exceptions. Document every breach.
Coordinate a breach without waiting for every fact
Suppose an EOR tells you a payroll file may have reached the wrong recipient. Open an incident log. Record when each responsible party became aware, whose data was involved, what has been contained and what you still need to establish. The relevant controller assesses its notification duties. A processor follows its notification obligations and its agreement. Give one person responsibility for coordinating updates, and keep the original times when a second team takes over the case.
9. The 13-point GDPR compliance checklist for EOR buyers
For each of the 13 checks, record the answer or explain why it doesn’t apply. A provider’s FAQ about its data processing agreement can help with rows 1 and 11. Before closing either row, compare it with the current contract, the service you’re buying and the incident procedure that applies to it.
| # | Check | Evidence that closes it |
|---|---|---|
# 1 | Check Roles mapped per service | Evidence that closes it DPA appendix naming controller/processor for each product you buy |
# 2 | Check Article 28 clauses complete where the vendor acts as processor | Evidence that closes it All nine items from section 3, including deletion/return and audit rights |
# 3 | Check Controller-to-controller terms where parties are independent controllers | Evidence that closes it Clauses allocating DSAR routing, breach cooperation, retention |
# 4 | Check Sub-processor list for processor services | Evidence that closes it Current list with entity names, locations, and purposes |
# 5 | Check Sub-processor change notifications for processor services | Evidence that closes it Subscription confirmed, owner named, notice window tracked |
# 6 | Check Processor sub-contracting objection process has an agreed remedy | Evidence that closes it Agreed process to resolve a substantiated objection and any contractual exit remedy |
# 7 | Check Correct SCC modules | Evidence that closes it If SCCs are the chosen safeguard, the applicable module based on exporter/importer roles |
# 8 | Check TIA on file | Evidence that closes it For SCC-based transfers, a current Clause 14 assessment covering the actual flow and required measures |
# 9 | Check DPF status verified where that adequacy route is relied on | Evidence that closes it Exact recipient and covered data verified on the DPF list; contingency route documented and assessed |
# 10 | Check UK restricted transfers covered, where applicable | Evidence that closes it Restricted-transfer test and applicable UK route recorded; IDTA/Addendum and TRA where that safeguard is used |
# 11 | Check Breach clause sets a deadline | Evidence that closes it Without-undue-delay duty, prompt initial alert, follow-up updates and named incident contacts |
# 12 | Check Employee privacy notice reviewed | Evidence that closes it The EOR's notice to its employees, plus agreed DSAR routing and deadlines |
# 13 | Check German works-council applicability assessed | Evidence that closes it Vendor's written answer on BetrVG 87(1) No. 6 co-determination for its platform |
Fig. 3 · The 13-point GDPR compliance checklist for EOR buyers · each row paired with the written evidence that closes it
Attach the evidence to each row and hand the table to your security team before kickoff.
Turn checklist items into approval conditions
Keep the document version and reviewer’s name with each checklist entry. Give open questions a due date and record who accepted the answer. If you’ve signed the data processing agreement but still don’t know which subprocessor can see a payroll file, leave that question open. Revisit the entry when a service, purpose, location or supplier changes.
GDPR responsibilities for each employee-data activity
Complete this table for the services you actually buy. Assign an owner to each task.
| Task | Who needs to act | Evidence to keep |
|---|---|---|
Task Role mapping | Who needs to act Both parties identify who decides the purposes and means. | Evidence to keep Activity, purpose, entities, legal basis for processing, any special-category condition, role reasoning and agreement version. |
Task Processor instructions | Who needs to act The controller gives instructions; the processor follows the agreed scope. | Evidence to keep Article 28 terms for processor activity; each controller determines its own legal basis for processing. Assess Article 9 and national employment rules where relevant. |
Task Employee requests | Who needs to act Each controller handles requests for its processing; processors assist. | Evidence to keep Routing contact, receipt log and response procedure. |
Task Breach escalation | Who needs to act The processor alerts its controller promptly; each controller assesses its duties. | Evidence to keep Incident contacts, escalation path and notification decision log. |
Task International transfers | Who needs to act The responsible parties assess the actual flow and applicable route. | Evidence to keep Recipient entities, route, documents and review triggers. |
Task End of service | Who needs to act Each party follows the retention and deletion rules that apply to its role. | Evidence to keep Export, retention and deletion plan with completion evidence. |
For breaches, preserve 'without undue delay' in the contract and agree prompt initial notice with follow-up details.
10. Frequently asked questions
Is an EOR a data processor under GDPR?
Do I still need a DPA if the EOR is an independent controller?
Do I need SCCs if my EOR is EU-US Data Privacy Framework certified?
Does GDPR require employee data to be stored in the EU?
No. GDPR imposes no general EEA storage requirement, but transfers that meet the Chapter V criteria need a valid route, and other processing, security and local-law requirements still apply. Access by a separate provider or group entity overseas may be a transfer. Access abroad by an employee acting within the same legal entity is not automatically one, but it still requires appropriate risk and security controls. See data residency and SCCs for the distinction.
Who files the 72-hour breach notification: my company or the EOR?
11. Sources
The sources behind this guide, grouped by topic. Dates show when we last checked a page. Prices and terms change, so confirm them in your quote.
EU law, guidance and court rulings
18 sourcesEuropean Union · EUR-Lex
Regulation (EU) 2016/679 (GDPR)
Articles 4, 28, 30, 33 and 34, 44 to 49, 83 and 88.
European Union · EUR-Lex
Commission Implementing Decision (EU) 2021/914 of 4 June 2021: Standard Contractual Clauses
European Union · European Commission
Modules, annexes, the Clause 14 assessment and suspension.
European Union · EUR-Lex
Commission Implementing Decision (EU) 2023/1795
DPF scope and the Accountability for Onward Transfer Principle.
European Union · European Commission
Adequacy decision for the EU-US Data Privacy Framework
Dated 10 Jul 2023.
European Union · European Commission
European Union · EDPB
Guidelines 07/2020 on the concepts of controller and processor
Dated 7 Jul 2021.
European Union · EDPB
Processor chains and the transfer criteria.
European Union · EDPB
Recommendations 01/2020 on supplementary transfer measures
Dated 18 Jun 2021.
European Union · EDPB
Guidelines 05/2021, version 2.0
Dated 14 Feb 2023. Transfer criteria, the same-entity employee example and residual security duties.
European Union · EDPB
Guidelines 9/2022 on personal data breach notification, version 2.0
Used in the data protection example. Checked 3 Oct 2026
European Union · EDPB
Identify the applicable Article 6 basis before processing; special-category data needs additional conditions. Checked 15 Oct 2026
European Union · EDPB
Data protection impact assessment (DPIA)
Carry out a DPIA before processing likely to create high risk. Checked 15 Oct 2026
European Union · EDPB
Records and DPIA applicability depend on processing; fewer than 250 staff is not a blanket exemption for occasional or HR processing. Checked 15 Oct 2026
European Union · CJEU
Schrems II (Case C-311/18) and Latombe v Commission (General Court, Case T-553/23)
Judgments of 16 Jul 2020 and 3 Sep 2025.
European Union · Official Journal
Notice of the appeal in Case C-703/25 P against the Latombe judgment
Filed 31 Oct 2025.
European Union · CJEU
A Hessian employee-data provision is inapplicable where it merely restates GDPR. Judgment of 30 Mar 2023.
European Union · CJEU
Case C-65/23, judgment of 19 December 2024
Used in the data protection example. Checked 3 Oct 2026
National laws and regulators
10 sourcesUnited Kingdom · ICO
International Data Transfer Agreement, version A1.0
In force from 21 Mar 2022. The guidance covers completion requirements and current versions.
United Kingdom · ICO
Restricted-transfer test, adequacy, safeguards and exceptions
United Kingdom · GOV.UK
UK-US Data Bridge supporting documents
In force from 12 Oct 2023.
Switzerland · FDPIC
Cross-border transfer of personal data
Adequacy, safeguards and exceptions.
United States · Data Privacy Framework program
Ireland · Data Protection Commission (DPC)
€1.2 billion fine against Meta for EU-US transfers
Dated 22 May 2023.
Germany · gesetze-im-internet.de
Federal Data Protection Act (BDSG), Section 26
Paired with Section 87(1) No. 6 of the Works Constitution Act (BetrVG). Section 87 sets co-determination rights, including No. 6 on technical monitoring systems.
Germany · gesetze-im-internet.de
Ten-, eight- and six-year document categories, with category-specific triggers and exceptions. Payroll tax accounts follow the separate Section 41 EStG rule: retained until the end of the sixth calendar year after the last recorded wage payment (checked 15 Oct 2026).
Germany · Landtag of Baden-Württemberg
Drucksache 17/8646, section 3.4
The federal labour and interior ministries’ draft Employee Data Act (Beschäftigtendatengesetz, 8 Oct 2024), not enacted after the coalition collapsed.
Germany · Hamburg Commissioner for Data Protection
€35.3 million fine against H&M for employee data violations
Dated 1 Oct 2020.
Security standards and fines research
4 sourcesAICPA & CIMA
System and Organization Controls (SOC) suite
The framework behind SOC 2 Type II reports.
International · ISO
DLA Piper
GDPR Fines and Data Breach Survey, January 2026
Meta’s €1.2 billion fine remains the largest GDPR fine. Checked Sep 2026
CMS
GDPR Enforcement Tracker fines database
Records no larger GDPR fine than Meta’s €1.2 billion. Checked Sep 2026
Provider data-protection terms
2 sourcesDeel
The Data Protection Addendum FAQs are effective 28 Oct 2024. The security overview covers AWS infrastructure and AES-256 encryption at rest.
Remote
Last updated 3 Aug 2026. For Employment Services and Contractor of Record each party is an independent controller; Remote is a processor for HRIS, contractor management and global payroll. Checked Sep 2026
Our research
1 sourceThe Best EOR
Transfer definitions, UK route selection and SCC contingency wording were checked on 24 September 2026.
If you spot a changed price or a conflicting source, send it through the contact page and we’ll review it.
This guide is for general information only and does not provide legal, tax, accounting, or financial advice. For advice about your business, consult a qualified professional familiar with the rules where you hire. Read our research methodology to learn how we assess sources.
