GDPR and offshore outsourcing: a practical guide for businesses

Outsourcing to Morocco, Tunisia, or Madagascar while staying GDPR-compliant is entirely possible, but it requires careful preparation. The EU regulation on data protection fully applies to processing carried out outside the EU on behalf of a controller established in Europe. Here are the pillars to verify before signing an outsourcing contract.

The principle is clear: offshoring processing never exempts you from GDPR obligations. The controller remains accountable for its customers' data, wherever it is processed. The good news is that, with a structured partner, appropriate safeguards and careful documentation, offshore outsourcing is fully compatible with the regulation.

1. The legal framework: adequacy decision or not?

Transferring personal data to a third country (outside the EU) is only possible in two scenarios, framed by Chapter V of the GDPR (Articles 44 to 49). Either the European Commission has adopted an adequacy decision recognising that the country ensures an essentially equivalent level of protection — for example Japan, Switzerland or New Zealand. Or, failing that, the transfer must rely on appropriate safeguards.

Morocco, Tunisia and Madagascar do not have an adequacy decision. Any transfer to these destinations must therefore rest on Standard Contractual Clauses (SCC), Binding Corporate Rules (BCR) or, in certain cases, codes of conduct and certifications. For any project we organise, we require the European Commission's Standard Contractual Clauses (Decision 2021/914), adopted after the Schrems II ruling of the Court of Justice of the EU: they are incorporated into the contract with the selected centre and supplemented by a transfer impact assessment (TIA) where the local situation requires it.

2. The data processing agreement (Article 28)

Article 28 of the GDPR requires the processor to process personal data only on the documented instructions of the controller. In practice, this takes the form of a data processing agreement (DPA) that formalises: the subject matter, duration, nature and purpose of the processing; the type of personal data and categories of data subjects; and the security, confidentiality and cooperation obligations towards the supervisory authority.

This contract must also cover the conditions for engaging a subsequent sub-processor (with prior authorisation), how the processor assists with data-subject rights requests, and the deletion or return of data at the end of the contract. Without a properly negotiated Article 28 agreement, an outsourcing project is legally fragile.

3. Security, pseudonymisation and Article 32

Article 32 of the GDPR requires technical and organisational measures appropriate to the risk. In an offshore centre, this translates into several complementary controls. Customer data travels over encrypted connections (VPN, TLS). Internally, data is pseudonymised wherever possible: agents see a customer identifier, not a full name. Access is controlled by role (RBAC) on a least-privilege basis, and every lookup is recorded in an immutable audit log.

On the organisational side, you add controlled-access premises, a ban on personal phones and USB drives, a clean-desk policy, and a formal data-breach notification procedure (Article 33) back to the controller. ISO/IEC 27001 certification of the centre is the reference standard: it ensures that an information security management system is in place and audited.

4. Accountability: who answers for what?

In an outsourcing project we organise, Altavista360 acts as a data processor under GDPR, and the selected centre as a sub-processor authorised by the client. The client remains the data controller and bears the primary responsibility towards data subjects and the supervisory authority. This distinction must be formalised in the contract: the processor decides neither the purposes nor the essential means of processing and acts on the client's documented instructions.

This split does not, however, discharge the processor: it must be able to demonstrate compliance (the accountability principle, Article 5(2)), maintain a record of processing activities (Article 30) and cooperate with the controller. Operational tracking of these obligations is what separates a serious partner from an ordinary vendor.

5. The rights of data subjects

Your clients' customers retain the same GDPR rights regardless of the country where processing takes place: right of access, rectification, erasure, restriction, data portability and objection (Articles 15 to 22). The contract must therefore provide a procedure to forward and handle these requests within the statutory deadline (in principle one month), including for data processed in Morocco or Tunisia: the offshore centre is integrated into the rights-management workflow, with a designated point of contact and a contractual transmission deadline. This is one of the conditions we set before any start.

Sectors that demand extra vigilance

Not all sectors are equal when it comes to offshore GDPR. Two deserve particular attention. Banking and fintech handle sensitive financial data and are subject to overlapping obligations (GDPR, banking secrecy, PSD2, PCI-DSS) that demand reinforced safeguards. Healthcare and health insurance process health data, classed as a special category of data (Article 9 of the GDPR) requiring additional guarantees and, most often, a data protection impact assessment (Article 35).

In these contexts, a Data Protection Impact Assessment (DPIA) is generally required before go-live. It documents the risks to the rights and freedoms of individuals and the measures taken to mitigate them. We can prepare this exercise with the client's DPO.

Compliance audits

Our method provides for an audit of the selected centre against a grid of GDPR criteria before any deployment: physical and logical security, agent training, access-rights management, breach-notification procedures, handling of data-subject rights, retention periods and the record of processing activities. The audit report is given to the client before the start, and these checks are then repeated periodically, because compliance is a continuous process, not an acquired state. For the broader context of outsourcing to Morocco, our article on the Morocco destination details the regulatory framework and available certifications. And to secure your administrative processes too, see our guide on back-office outsourcing.