Nearshoring in Portugal: GDPR with Non-EU Clients

Nearshoring · 4 min

Hiring a team in Portugal does not automatically place a non-EU client under the GDPR. Learn which obligations fall on the provider and how to frame data flows.

Nearshoring in Portugal: GDPR with Non-EU Clients

TL;DR

Hiring a provider in Portugal does not, in itself, make a non-EU client subject to the GDPR.
When acting as a processor, the Portuguese provider must comply with the GDPR obligations that apply to it.
Returning data to a client outside the European Economic Area may constitute an international transfer.
The safeguards required depend on the destination, the recipient and whether an applicable adequacy decision exists.
Before starting the service, it is important to define roles, map data and access, and establish contractual responsibilities.

An EU-based team also brings EU rules

When a company from the United States, the United Kingdom or Switzerland contracts nearshoring services in Portugal, the assessment should not be limited to talent, costs and time zone. It is important to understand whether the team will have access to personal data and under what conditions: information about customers, employees, application users or technical logs that make it possible to identify individuals. The role of each entity must also be defined. If the client determines the purposes and essential means of the processing and the provider processes the data on its behalf, the provider will, as a rule, act as a processor. This qualification depends on the functions actually performed, not merely on the designation used in the contract. Clarifying these aspects before the project starts makes it easier to define access, responsibilities and security measures.

The regulation applies to the processing, not to the entire company

The GDPR sets out its territorial scope in Article 3. A provider established in Portugal is subject to the obligations that apply to it with regard to processing carried out in the context of its activities, even if the controller is located outside the European Union. However, hiring that provider does not, in itself, make the foreign client subject to the regulation. The European Data Protection Board confirms this distinction in Guidelines 3/2018, using the example of a Mexican company that engages a processor in Spain. The client's situation must be analysed independently: it may be covered if the processing is linked to the activities of an establishment in the EU or, under the conditions of Article 3(2), if it offers goods or services to individuals in the Union or monitors their behaviour. The assessment must focus on each specific processing activity.

The provider in Portugal assumes its own obligations

When it acts as a processor, the Portuguese provider has its own obligations under the GDPR. These include the contractual framework set out in Article 28, the adoption of appropriate technical and organisational measures, the oversight of sub-processors and, where applicable, the maintenance of records of the categories of processing activities carried out. It must also inform the controller, without undue delay, when it becomes aware of a personal data breach. The contract must identify the subject matter and duration of the processing, the categories of data and data subjects, the documented instructions, the access conditions and the responsibilities for incident response. The obligations directly applicable to the provider do not disappear because the foreign client is not subject to the GDPR. In Portugal, the Comissão Nacional de Proteção de Dados (CNPD) is the national supervisory authority.

Map data flows before building the team

Before building the team, the path of the data should be mapped: who provides it, where it is hosted, who accesses it, whether it is copied into ticketing systems, repositories or test environments, and to whom it is subsequently made available. There is one particularly important detail: if a Portuguese provider returns personal data to a client located outside the European Economic Area, that disclosure may constitute an international transfer subject to Chapter V of the GDPR, even when the data was originally received from that client. The European Data Protection Board clarifies this situation in Guidelines 05/2021, through a specific example. Remote access by entities located in third countries must also be analysed, even without file downloads. This mapping makes it possible to anticipate contractual requirements, access controls, log retention policies and conditions for the use of sub-processors.

A condition to manage, not an obstacle

An international transfer does not mean the project is unviable. The mechanism required varies depending on the destination and the recipient. The United Kingdom and Switzerland benefit from European Commission adequacy decisions. In the United States, the decision associated with the EU–US Data Privacy Framework covers certified organisations, within the applicable scope. Where there is no adequacy decision covering the transfer, it may be necessary to rely on appropriate safeguards, such as standard contractual clauses, accompanied by the required assessments. In the relationship between a processor established in the European Economic Area and a controller located outside that area, module 4 of the standard contractual clauses may be relevant. These requirements must be aligned with the client's local legislation and any sector-specific rules, without assuming that hiring a team in Portugal, in itself, resolves all compliance issues.

Clarifying roles before the contract reduces rework

The best time to address these matters is before the contract is signed. A solid contracting process starts with identifying the controller and the processor, followed by data classification and documentation of access, locations, sub-processors, retention periods and rules for deletion or return. It should also provide for security measures, incident notification, the responsibilities of the parties and, where necessary, international transfer mechanisms. In support, development and ongoing operations projects, it is important to prevent technical logs, diagnostic copies and test environments from creating unforeseen data flows. The goal is not to add indiscriminate bureaucracy, but to establish an operating model that allows the service to be delivered securely and predictably. The framework should be confirmed in light of the specific case and, where necessary, with specialised legal advice.