The General Data Protection Regulation fundamentally changed how European businesses think about data. Since its enforcement began in May 2018, GDPR has established the world’s most comprehensive framework for protecting personal data, with fines of up to EUR 20 million or 4% of annual global turnover for violations.
For European businesses considering outsourcing, GDPR creates specific obligations that must be understood and addressed before a single piece of data is shared with an external provider. The regulation does not prohibit outsourcing. It does not prevent data from being processed outside the European Economic Area. But it does require that any outsourcing arrangement meets strict standards for data protection, contractual safeguards, and accountability.
This guide explains the GDPR requirements that apply to outsourcing, the legal mechanisms for international data transfers, and how to structure an outsourcing engagement that is fully compliant from day one.
Understanding the GDPR Framework for Outsourcing
Controllers and Processors
GDPR distinguishes between data controllers (the entity that determines the purposes and means of processing personal data) and data processors (the entity that processes data on behalf of the controller). In an outsourcing relationship:
- Your company is the data controller. You decide what data is collected, why it is processed, and how it is used.
- Your outsourcing provider is the data processor. They process data according to your instructions and for the purposes you define.
This distinction is important because it defines who bears which obligations. As the controller, you are responsible for ensuring that any processor you engage provides sufficient guarantees of GDPR compliance. You cannot outsource your accountability.
The Controller’s Obligations When Outsourcing
Under GDPR, when you engage an outsourcing provider as a data processor, you must:
- Select a provider that offers sufficient guarantees: The provider must demonstrate appropriate technical and organizational measures to ensure GDPR-compliant processing.
- Execute a Data Processing Agreement (DPA): A binding contract that specifies the scope, nature, and purpose of processing, the categories of data involved, and the obligations of both parties.
- Ensure lawful data transfer: If the provider operates outside the EEA, you must use an approved legal mechanism for the international data transfer.
- Maintain oversight: You must monitor the provider’s compliance on an ongoing basis, not just at the point of engagement.
- Report breaches: If the provider experiences a data breach affecting your data subjects, you are responsible for notifying the relevant supervisory authority within 72 hours.
The Data Processing Agreement: Your Foundation
The Data Processing Agreement is the single most important document in a GDPR-compliant outsourcing arrangement. It is not optional — Article 28 of GDPR requires it whenever a controller engages a processor.
What the DPA Must Include
A compliant DPA must contain:
- Subject matter and duration: What is being processed and for how long.
- Nature and purpose of processing: Why the data is being processed and what operations are performed.
- Types of personal data: Categories of data involved (names, email addresses, financial information, etc.).
- Categories of data subjects: Whose data is being processed (customers, employees, prospects, etc.).
- Obligations and rights of the controller: Your instructions for processing and your oversight rights.
- Processor’s obligations: Specific commitments including:
- Processing data only on the controller’s documented instructions
- Ensuring persons authorized to process data have committed to confidentiality
- Implementing appropriate security measures (Article 32)
- Not engaging sub-processors without the controller’s authorization
- Assisting the controller in responding to data subject requests
- Assisting with breach notification, data protection impact assessments, and prior consultation
- Deleting or returning all personal data at the end of the engagement
- Making available all information necessary to demonstrate compliance and allowing for audits
Practical Tips for DPA Negotiation
- Be specific about data categories: Vague descriptions create ambiguity. List the exact types of personal data that will be processed.
- Define retention periods: Specify how long data can be retained by the processor and what happens when the engagement ends.
- Address sub-processing: If your provider uses any sub-processors (cloud hosting, software platforms), these must be disclosed and approved. The DPA should include a mechanism for you to object to new sub-processors.
- Include audit rights: The DPA should give you the right to audit the provider’s compliance, either directly or through an independent auditor.
- Define breach notification timelines: GDPR requires the controller to notify authorities within 72 hours. Your DPA should require the processor to notify you within a shorter timeframe (24-48 hours) to give you time to assess and report.
International Data Transfers: The Legal Framework
When your outsourcing provider operates outside the European Economic Area, transferring personal data to them requires a legal basis under Chapter V of GDPR.
Adequacy Decisions
The European Commission can issue an adequacy decision for a country, determining that it provides an adequate level of data protection. Data can flow freely to countries with adequacy decisions without additional safeguards. As of now, the Commission has issued adequacy decisions for a limited number of countries including the UK, Japan, South Korea, Canada (for commercial organizations), and others.
Kenya does not currently have an adequacy decision from the European Commission. However, this does not prevent data transfers to Kenya — it simply means an alternative legal mechanism must be used.
Standard Contractual Clauses (SCCs)
Standard Contractual Clauses are the most commonly used mechanism for international data transfers where no adequacy decision exists. These are pre-approved contractual terms published by the European Commission that the data exporter (your company) and the data importer (your outsourcing provider) both sign.
The current SCCs (adopted in June 2021) are modular, covering four scenarios:
- Module 1: Controller to controller
- Module 2: Controller to processor (most relevant for outsourcing)
- Module 3: Processor to processor
- Module 4: Processor to controller
For a standard outsourcing arrangement, Module 2 (controller to processor) is the applicable framework. The SCCs must be:
- Signed by both parties without modification to the core clauses
- Supplemented with annexes detailing the specific data processing activities
- Accompanied by a Transfer Impact Assessment
Transfer Impact Assessments (TIAs)
Following the Schrems II ruling, organizations relying on SCCs must conduct a Transfer Impact Assessment to evaluate whether the legal framework of the receiving country provides adequate protection for the transferred data. The TIA should consider:
- The nature of the data being transferred
- The legal framework of the destination country (specifically, government access to data)
- The supplementary measures implemented by the provider
- Practical experience with government data access requests
For Kenya, the Transfer Impact Assessment is generally favorable. Kenya’s Data Protection Act of 2019 provides strong data protection principles, the country has an independent Data Commissioner, and there is no widespread government surveillance program that would compromise the protection of European data.
Supplementary Measures
Where a TIA identifies potential gaps in protection, supplementary measures can be implemented to address them. Common supplementary measures include:
- Technical measures: Encryption of data at rest and in transit, pseudonymization, access logging, and intrusion detection systems.
- Organizational measures: Strict access controls, confidentiality agreements, regular security training, and data handling policies.
- Contractual measures: Enhanced breach notification, restrictions on government disclosure, and transparency reporting.
Kenya’s Data Protection Landscape
Kenya’s Data Protection Act of 2019 is one of the most GDPR-aligned pieces of data protection legislation outside Europe. Key provisions include:
- Lawful processing principles: Kenya’s Act requires data processing to be lawful, fair, and transparent, mirroring GDPR’s Article 5 principles.
- Data subject rights: Kenyan law provides data subjects with rights to access, rectification, erasure, and objection to processing — closely paralleling GDPR rights.
- Data protection by design: The Act requires organizations to implement data protection measures from the design stage of processing activities.
- Breach notification: Data controllers and processors must notify the Data Commissioner of breaches within 72 hours.
- Independent oversight: The Office of the Data Protection Commissioner oversees compliance and has enforcement powers including fines.
- Cross-border transfer provisions: The Act includes provisions governing international data transfers, with requirements for adequate protection.
This regulatory alignment means that outsourcing to Kenya is not a leap of faith from a data protection perspective. The legal framework is solid, modern, and designed with international standards in mind.
Building a GDPR-Compliant Outsourcing Framework
Step 1: Data Mapping
Before engaging a provider, map the personal data that will be processed:
- What categories of personal data are involved?
- Whose data is it (customers, employees, prospects)?
- Why does the outsourced team need access to this data?
- Can the dataset be minimized (do they need full names, or would initials suffice)?
Step 2: Provider Due Diligence
Evaluate the provider’s data protection capabilities:
- Do they hold ISO 27001 certification?
- Can they demonstrate documented data protection policies and procedures?
- What technical security measures are in place (encryption, access controls, monitoring)?
- Do they have a designated Data Protection Officer?
- What is their track record on data incidents?
Step 3: Execute the DPA and SCCs
Work with legal counsel to execute a comprehensive Data Processing Agreement and, for transfers outside the EEA, sign the appropriate Standard Contractual Clauses with completed annexes.
Step 4: Conduct a Transfer Impact Assessment
Assess the destination country’s legal framework, identify any risks, and document the supplementary measures that address those risks.
Step 5: Implement Technical and Organizational Measures
Ensure that practical safeguards are in place:
- Data encryption in transit and at rest
- Role-based access controls
- Regular access reviews
- Security awareness training for all personnel handling data
- Clean desk policies in the outsourcing facility
- Visitor management and physical security
Step 6: Establish Ongoing Monitoring
GDPR compliance is not a one-time exercise. Establish:
- Annual compliance reviews
- Regular security audit reports from the provider
- Incident response testing
- Updates to the DPA and TIA when processing activities change
How Bogner & Partners Addresses GDPR Compliance
As a German-registered company operating BPO facilities in Nairobi, Bogner & Partners is structured specifically to address the GDPR compliance concerns of European businesses:
- German corporate registration: As a German entity, Bogner & Partners operates under German commercial law and is directly subject to GDPR.
- ISO 27001 certification: Independently audited information security management system covering all operations.
- Standard Contractual Clauses: Pre-prepared SCCs available for all client engagements involving international data transfers.
- Comprehensive DPA: Detailed Data Processing Agreement covering all GDPR Article 28 requirements.
- Physical and technical security: Secure Nairobi facility with access controls, CCTV monitoring, clean desk policies, encrypted communications, and restricted USB access.
- Staff training: All agents receive mandatory data protection training during onboarding, with annual refresher courses.
- Designated Data Protection Officer: Available to address client data protection queries and manage compliance oversight.
Common GDPR Concerns with Outsourcing — Addressed
“Is it legal to send EU personal data to Kenya?”
Yes. There is no GDPR prohibition on transferring data to Kenya. You need a legal transfer mechanism (Standard Contractual Clauses), a Transfer Impact Assessment, and appropriate supplementary measures. This is the same process used for transfers to the United States, India, the Philippines, or any other country without an adequacy decision.
“Who is liable if there is a data breach at the outsourcing provider?”
Both parties have obligations. The processor must notify the controller without undue delay. The controller must notify the supervisory authority within 72 hours if the breach poses a risk to data subjects. Liability is allocated through the DPA, and both controllers and processors can face direct GDPR fines.
“Can my outsourcing provider use our data for their own purposes?”
No. Under GDPR and the DPA, the processor may only process data according to the controller’s documented instructions and for the purposes specified in the agreement. Any processing beyond this scope is a GDPR violation.
Conclusion
GDPR compliance and outsourcing are not in conflict. They are compatible, provided you approach the arrangement with proper legal foundations, technical safeguards, and ongoing oversight. The GDPR framework actually provides a clear roadmap for compliant outsourcing — one that protects your customers’ data while enabling the operational and cost benefits of working with an external provider.
For European businesses, outsourcing to a provider with the right certifications, legal structure, and compliance culture is not only feasible but straightforward. Bogner & Partners offers GDPR-compliant outsourcing backed by German registration, ISO 27001 certification, and a comprehensive compliance framework designed specifically for European clients.
Frequently Asked Questions
Do I need my Data Protection Authority’s approval to outsource?
In most cases, no. GDPR does not require prior approval from a supervisory authority for outsourcing arrangements that use SCCs as the transfer mechanism. However, if you are processing high-risk data categories (health data, criminal records) or operating in a heavily regulated sector, you may need to conduct a Data Protection Impact Assessment and potentially consult your DPA.
What is the difference between SCCs and Binding Corporate Rules?
Standard Contractual Clauses are pre-approved contract terms between a data exporter and importer. They are suitable for any outsourcing relationship. Binding Corporate Rules (BCRs) are internal data protection policies approved by a supervisory authority for multinational groups to transfer data between their own entities. BCRs are more complex and expensive to establish and are typically used by large corporations with multiple international subsidiaries.
How often should I audit my outsourcing provider’s GDPR compliance?
At minimum, annually. The audit should review the provider’s technical and organizational measures, their incident management procedures, access controls, and staff training records. You should also review and update the Transfer Impact Assessment annually or whenever material changes occur in the processing activities or the destination country’s legal framework.
What happens to our data when the outsourcing contract ends?
The DPA should specify that the processor must either return all personal data or securely delete it upon termination of the agreement. The processor should provide written confirmation of deletion. Any backups containing personal data should be deleted within a defined timeframe.
Can outsourced agents access customer data from personal devices?
In a properly managed BPO operation, no. Agents should only access customer data from controlled, company-managed devices within the secure facility. Personal devices should not be allowed in the operational area. This is standard practice in ISO 27001 certified facilities and is explicitly addressed in Bogner & Partners’ operational security policies.