GDPR Checklist for Offshore Software Development (Netherlands and EU)

The Basics: Controller, Processor and Transfers#

You decide why and how personal data is processed, so you are the controller. A development vendor that handles that data on your instructions is your processor. When the processor is outside the EU and the country has no adequacy decision, GDPR Chapter V applies. The European Commission keeps the list of adequacy decisions and publishes the Standard Contractual Clauses.

The Checklist#

• 1. Map the data. List which personal data the vendor could see: customer records, employee data, logs, support tickets, backups.
• 2. Minimise it. Develop and test with synthetic or anonymised data so most work involves no personal data at all.
• 3. Sign a DPA. An Article 28 data processing agreement covering purpose, security, sub-processors, breach notice and deletion.
• 4. Add the SCCs. Use the 2021 EU Standard Contractual Clauses (controller to processor module) for any transfer.
• 5. Run a TIA. Document a transfer impact assessment of the destination country and the safeguards in place.
• 6. Keep production in the EU. Host production in an EU region in your own cloud account, for example Frankfurt, Dublin or Amsterdam.
• 7. Control access. Personal accounts, least privilege, multi-factor authentication and access logs for every engineer.
• 8. Plan the exit. Revoke access and confirm deletion of any copies when the engagement ends.

Notes for Dutch Companies#

The Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, applies the same GDPR rules on transfers and expects the documentation above to exist. Dutch tech teams already work in English, so adding an offshore team is mostly a question of process and paperwork rather than language. Azure West Europe is located in the Netherlands if you want production data to stay in the country.

Engineering Practices That Reduce Risk#

Good engineering does more for compliance than long contracts. Seed staging environments with generated data, mask personal fields in logs, encrypt data at rest and in transit, and keep secrets in a vault rather than in code. Review access every month and remove it the day someone leaves the project.

If the Project Includes AI#

AI features add two questions. First, where does data go when you call a model API, and does the provider use it for training? Choose enterprise settings that disable training and, where possible, an EU-hosted model endpoint. Second, the EU AI Act applies risk-based obligations that are being phased in; check the European Commission's AI Act page for the current timetable if your feature affects people's access to jobs, credit, education or services.

How We Work With EU Clients#

At Limbani Softwares we sign an Article 28 data processing agreement and the EU Standard Contractual Clauses, develop with anonymised data, and keep production in your EU cloud account. Read more on our pages for European companies and Dutch companies.