May my supplier process data outside the EU?

Data outside the EU is permitted, provided there is a valid legal basis

A supplier may process personal data outside the EU in most cases, but not without restrictions. The GDPR makes a distinction between two questions that are often confused: may this supplier process data on your behalf at all (the sub-processor question), and may that processing take place outside the European Economic Area (the transfer question). Both questions have their own answer, and both must be answered with "yes" before data may leave the building.

For the sub-processor, a supplier may only engage another party with prior consent, and the obligations from the processor agreement must then be passed on to that sub-processor. For transfer to a country outside the EU, there is a separate layer: this is permitted on the basis of an adequacy decision by the European Commission for that country, or failing that on the basis of appropriate safeguards, such as standard contractual clauses established by the Commission. Without one of these grounds, the basis for the transfer is lacking, even if the sub-processor itself has been properly engaged.

The basis: Article 28 and Article 44 GDPR

The engagement of a sub-processor is regulated in Article 28 of the GDPR, which sets conditions for consent and transferred obligations; the transfer to a third country is regulated in Article 44 of the GDPR, which forms the starting point for the chapter on transfers outside the EU. The EDPB has published guidelines on this that further elaborate when a safeguard qualifies as "appropriate" and how an organisation can assess this.