GDPR and remote staff access: what to check first

Map the data the person will see

Start with a list, not with a contract. For each tool the person will use, write down what personal data it holds and why the person needs it.

The map shows where access can be narrowed, and it is the starting point for the entry in your records of processing.

Who is who under the GDPR

Your company decides why and how the data is processed, so for this data it is usually the controller. A contractor who works in your systems on your instructions may be treated as a processor acting on your behalf, or as a person acting under your authority; the answer affects which contract terms you need. Ask your adviser how they see your set-up.

Access from outside the EEA

Ukraine, Georgia, Armenia and Kazakhstan are outside the European Economic Area. When an external contractor there can see personal data held in the EU, that remote access is generally treated as a transfer of personal data, and the GDPR's rules on transfers apply.

• Check whether the person's country has an adequacy decision on the European Commission's current list.
• Where there is none, a common safeguard is the Commission's standard contractual clauses, signed with the contractor, together with an assessment of the risks of the transfer.
• Some contractor platforms offer data processing and transfer terms; ask whether they cover your case.

This is the part where advice is most worth paying for: the rules are detailed and the guidance changes.

Contract terms to have in place

Whatever the exact roles, the agreement with the contractor usually covers:

• Processing only on your documented instructions and for the purposes of the work.
• Confidentiality that continues after the agreement ends.
• The security measures the contractor must follow, such as those in our security and access guide.
• Telling you immediately about any suspected breach, so you can meet your own reporting duties, which run on a short deadline.
• No subcontracting or sharing without your written consent.
• Returning or deleting the data at the end, and confirming it in writing.

Our contractor agreement checklist lists the other clauses.

Practical measures that reduce what is transferred

• Keep the data in your systems: the person works in your help desk and cloud storage, never in downloads or personal accounts.
• Narrow the access: an agent role in the help desk, only the folders the work needs, no exports.
• Hide what is not needed, such as full payment details, which support work rarely requires.
• Log access where your tools allow it, and review the list of users every quarter.
• Remove access on the last day, using the offboarding list in our security guide.

Records, notices and training

• Update your records of processing with the new recipient and the transfer.
• Check that your privacy notice mentions service providers and transfers outside the EEA.
• Give the person a short briefing on your data rules on day one: what counts as personal data, what never leaves your systems, how to report a mistake.
• Keep the signed agreement, the transfer terms and the briefing note together.

UK companies follow the UK GDPR, which is similar but has its own transfer tools; ask your adviser which apply. For support teams, our support onboarding guide shows where the data briefing fits into the first days.