If the supplier with which you conclude a data processor agreement is established outside the European Union or the European Economic Area, the data processor agreement itself does not change materially. The same components that the GDPR requires — the subject matter and duration of processing, the nature and purpose, the type of data, the categories of data subjects, and your obligations and rights as the controller — must still be included, regardless of where the supplier is established.
What does change is an additional layer of rules: the GDPR imposes extra conditions on the transfer of personal data to a country outside the EU or the EEA. This layer requires you to assess whether a safeguard is needed for that specific country in addition to the ordinary agreements in the data processor agreement, and if so, which one.
What remains the same
The core of a data processor agreement concerns the relationship between you and the party that processes data on your behalf: who does what, for what purpose, for how long, and what happens in the event of a data breach or termination of the engagement. These arrangements apply to every processor, whether based in Rotterdam, Dublin or San Francisco. A supplier outside the EU therefore does not exempt you from the standard review of a data processor agreement; that review remains necessary, it simply has something added to it.
The transfer rules: the additional layer
The GDPR separately regulates the conditions under which personal data may leave the territory of the EU or the EEA. The starting point is that the level of protection of the data must not be diminished by their transfer to another country. For a number of countries, the European Commission has determined that the level of protection there is adequate; this is called an adequacy decision, and it does not automatically apply to an entire country but sometimes only to a specific sector or arrangement. If there is no adequacy decision, a commonly used mechanism is the standard contractual clauses published by the European Commission: an established template that is used as a supplement alongside or as an annex to the data processor agreement. Which variant applies and whether it is current can change from time to time; the location of the current lists and templates is with the European Commission and the Dutch Data Protection Authority, not in a fixed text that you can memorise.
The cloud makes it more difficult than it seems
For many SaaS tools, the question 'is my supplier within the EU' feels simpler than it actually is. A supplier can have a European head office and still use sub-processors, data centres for back-up, or support staff outside the EU. That also counts as a transfer, even if the main office is in the Netherlands or Germany. The question is therefore not only where the supplier is established, but where the data actually end up, including the links behind it.
What you can practically inquire about
A supplier that has its affairs in order can usually indicate where data are processed and stored, whether sub-processors outside the EU are engaged, and which transfer mechanism has been applied for that purpose. This kind of question belongs in the same assessment as the rest of the data processor agreement: not as a separate exercise afterwards, but as part of reading the agreement itself. Anyone seeking structure in this matter will find in the knowledge base explained by topic how the different situations relate to each other.
Why the source reference is particularly important here
Because lists of adequacy decisions and standard contractual clauses change over time, the risk of an outdated assumption is greater here than with most other GDPR topics. Text that is correct today may not be correct in a year. That is why we always use a direct reference to the source for these kinds of topics instead of a summary that must stand on its own; you can read exactly how that works on the page about where our information comes from.
What this means for your records and your agreements
If you keep track of which suppliers you use and where they are established, you can see at a glance which data processing agreements are subject to transfer rules and which are not. This is precisely why country of establishment is a fixed part of how we record a supplier in the system. Frequently asked questions on this topic are collected at frequently asked questions about suppliers and data outside the Netherlands.
Whether an additional safeguard is actually needed for your situation, and which one, is ultimately for you or your lawyer to assess; we provide guidance and structure, not legal advice. If you are in doubt about how to apply this in a specific case, you can also contact the Netherlands Authority for Data Protection.
Would you like to get a clear overview of which of your suppliers are inside and which are outside the EU, and whether they have a data processing agreement with the appropriate safeguards? Do the free check on a data processing agreement or open a business account to keep track of it in your records.