Offshore Outsourcing and GDPR: What You Need to Lock Down Before Transferring Data Outside the EU

The GDPR does not block transfers outside the EU. It requires guarantees proportionate to the level of protection in the destination country. Madagascar and Maurice have no adequacy decision. Here is what this means in concrete terms for your outsourcing project.

Article 45 of the GDPR provides that the European Commission may recognize that a country offers an "adequate" level of protection. Madagascar and Maurice do not appear on this list. You must therefore turn to the mechanisms of Article 46. First mechanism: Binding Corporate Rules (BCR). These are suited to multinational groups transferring data between internal entities. Validation by a supervisory authority takes 12 to 24 months. For a company outsourcing to a third-party provider, this is neither proportionate nor realistic. Second mechanism: standard contractual clauses (SCCs) adopted by the European Commission. Updated version of June 4, 2021, four modules depending on the relationship between the parties. This is the mechanism suited to 95% of offshore outsourcing projects for SMEs. Third mechanism: the derogations of Article 49 (explicit consent, performance of a contract). These cover only occasional transfers, not a continuous flow of data to a dedicated team. Disregard them for full-time outsourcing.

Madagascar has a personal data protection law (Law No. 2014-038) and a regulatory authority. Maurice has the Data Protection Act 2017 and a Data Protection Commissioner. These legislative frameworks exist, but the European Commission has not recognized them as "adequate." Direct consequence: every transfer of personal data from your CRM, your ticketing tool, or your accounting software to a team member based in Antananarivo or Port Louis must be governed by standard contractual clauses signed between you (the data exporter) and the provider (the data importer). The fact that Maurice is a member of the Council of Europe's Protocol 108+ makes no difference under the GDPR. And the fact that Madagascar has a law inspired by the French model does not constitute sufficient assurance in the eyes of the CNIL. This legal status is not an obstacle. It is a contractual parameter. You address it before the start, you document it, and your DPO no longer has grounds to block the project.

Since the Schrems II ruling (CJEU, July 16, 2020), SCCs alone are not sufficient. You must carry out a Transfer Impact Assessment (TIA) that evaluates whether the legislation of the destination country allows local authorities to access transferred data in a manner incompatible with the GDPR. The TIA covers three areas. First area: local legislation on surveillance and government access to data. Neither Madagascar nor Maurice has mass surveillance programs comparable to those identified in Schrems II (US FISA 702). Second area: the additional technical measures you deploy (encryption, pseudonymization, access control). Third area: the provider's practical experience with access requests from local authorities. This document does not need to be 80 pages long. The CNIL and the EDPB accept an assessment proportionate to the sensitivity of the data and the volume transferred. For an SME outsourcing customer support or accounting data entry, a structured and sourced TIA of 5 to 10 pages is sufficient. Your provider must supply factual information about local legislation. If your provider does not know what a TIA is, change providers. To understand the security requirements to be imposed on the financial data side, see Sécurité des données financières offshore : les 6 exigences à imposer avant de signer.

Three separate documents govern the GDPR relationship between your company and your offshore provider. They are not interchangeable, and none replaces the others. Here is their exact content and how they relate to one another.

The June 2021 SCCs are divided into four modules. For standard offshore outsourcing, two modules are relevant. Module 2 (controller to processor): this is the standard case. You are the data controller. Your offshore provider processes data on your behalf. This module applies when your dedicated team members in Madagascar access your CRM, process customer tickets, or enter accounting entries containing personal data. Module 1 (controller to controller): less common in outsourcing. It applies if your provider independently determines the purposes of a processing activity, which almost never occurs in a dedicated team model. The SCC document contains mandatory annexes: description of processing activities, categories of data, categories of data subjects, duration of processing, technical and organizational measures. Each annex must be completed specifically for your activity. A generic, non-customized template protects no one and has no value in the event of an inspection. SCCs are a European Commission document. You cannot modify the main clauses. You complete the annexes and sign. So does the provider.

Annex II of the SCCs and Article 32 of the GDPR require a concrete description of security measures. Not statements of intent. Verifiable measures. Access control: multi-factor authentication on all tools containing personal data, role-based rights management, immediate revocation upon departure. Encryption: TLS 1.2 minimum for data in transit, AES-256 encryption for data at rest on workstations. Network security: dedicated VPN between the offshore production site and your systems, configured firewall, network segmentation. Physical security: controlled access to premises, workstation locking, prohibition of removable storage devices. Traceability: logging of data access, retention of logs for a minimum of 12 months. The provider must also document its security incident management policy: detection, notification to the data controller within a maximum of 48 hours (notification to the CNIL must occur within 72 hours), corrective measures. Every measure stated in the annex may be subject to audit. If your provider announces AES-256 encryption but its workstations do not even have a BIOS password, the document is worthless. The annex is contractually binding.

The contractual documents establish the framework. The processing registry and audits demonstrate that this framework is respected over time. Here is how to structure both without dedicating a disproportionate amount of time to them.

Article 30 of the GDPR requires every data controller to maintain a registry. When a processing activity involves a transfer outside the EU, additional fields are mandatory. For each processing activity outsourced to Madagascar or Maurice, your registry must indicate: the name of the processor and its exact location, the destination country of the data, the transfer mechanism used (SCC Module 2, specifying the version and date of signature), the reference of the associated TIA, the categories of data transferred (customer data, HR data, accounting data), the categories of data subjects (customers, prospects, employees), the precise purpose of the processing, and the applicable security measures (referring to Annex II of the SCCs). This registry is not a static document. It must be updated with every change to the scope of processing. If you add a tool, a data flow, or a new type of personal data within the scope of your offshore team, the registry must be updated accordingly. For an SME, a structured spreadsheet with these fields is sufficient. The CNIL provides a basic template, but it does not cover cross-border specifics. You must supplement it. Your provider must maintain its own registry as a processor, in accordance with Article 30-2. Request a copy. To find out how to entrust registry maintenance to an offshore team, see Compliance RGPD externalisée : confier le registre des traitements à une équipe offshore en 2026.

Article 28-3(h) of the GDPR gives you the right to audit your processor. The SCCs reinforce this obligation. The question is not "should we audit" but "how to audit effectively without engaging a consultancy at €2,000 per day." Three levels of audit are proportionate for an SME. Level 1 (quarterly, remote): documentary review. The provider supplies a compliance attestation, anonymized access logs, proof of GDPR training for dedicated team members, and the status of declared technical measures. Level 2 (semi-annual, remote or hybrid): scenario testing. You simulate a rights exercise request (access, deletion) and measure the provider's response time and compliance. You verify encryption and access configurations on a sample of workstations. Level 3 (annual, on-site or by a mandated third party): full audit of premises, workstations, network infrastructure, incident management policy, and any sub-processing contracts. Document every audit. Retain the reports. In the event of a CNIL inspection or a data breach, these reports demonstrate your due diligence. A provider that refuses to submit to an audit or negotiates excessive restrictions is sending you a clear signal: walk away.

Let us take a concrete case. Your company outsources two functions to Madagascar: B2B customer support (inbound tickets via Zendesk) and accounting data entry (entries in Pennylane). Flow 1, customer support: your dedicated team member accesses Zendesk tickets containing names, email addresses, order numbers, and exchange histories. Personal data of your B2B customers, sometimes of their own customers. SCC Module 2 covers this transfer. Access is via browser with SSO and MFA. Data remains on Zendesk servers (EU or US depending on your plan). The team member downloads nothing locally. Flow 2, accounting: your team member enters records containing supplier names, bank account details, and invoice amounts. Access to Pennylane is via a named account with rights restricted to data entry. No bulk export is possible. Data remains on the Pennylane infrastructure. For each flow: one line in the processing registry, a signed DPA, annexed SCCs, and a completed TIA. The specific technical measures are documented in Annex II. The team member has signed an individual confidentiality agreement and has completed documented GDPR training. This structuring work takes two to three days before the start of production. It does not slow down operations. It secures them. To assess the full cost of such a project, ROI de l'externalisation offshore en 12 mois : la méthodologie TCO que personne ne publie incorporates these parameters into the calculation. And to structure the scope of accounting delegation upfront, refer to Externalisation comptable offshore : clôturez vos comptes sans recruter un DAF à 80k€.