GDPR and Data Localization: A Checklist for Global Employers

Start with an inventory, not a policy document. List every system that touches personal data about a candidate, employee, or contractor: the ATS, the HRIS, payroll or EOR platform, benefits administration, performance reviews, expense tools, even the Slack workspace and shared drives where offer letters and ID scans tend to end up. For each one, note where the vendor hosts the data, whether it's transferred outside the country where the person works, and who inside your company can see it.

Most founders are surprised by how much personal data sits in tools nobody thought of as HR systems. A recruiting spreadsheet with candidate national ID numbers, a Zoom recording of an interview, a scanned passport emailed to finance for a wire transfer: all of it counts.

The GDPR reaches any personal data belonging to someone in the EU or EEA, regardless of where your company is registered, if you're processing that data in connection with offering employment, goods, or services to them. That means a US company with one remote employee in Portugal is in scope for that employee's data, full stop.

The practical obligations that matter most for a small HR footprint: a documented lawful basis for processing employee data (usually the employment contract itself, or legitimate interest for things like security logs), a data processing agreement with every vendor that touches that data, a way to respond to a data subject's request to see or delete their own data, and breach notification to the relevant authority within 72 hours of becoming aware of a qualifying breach. None of this requires a large compliance team to satisfy for a headcount in the dozens, but it does require someone to actually own it.

Data localization laws require that certain data physically reside on servers inside a specific country before, or instead of, being transferred elsewhere. Russia's personal data law is the clearest example: personal data of Russian citizens must first be recorded and stored on servers located in Russia. China's rules under the PIPL impose a security assessment for cross-border transfers above certain thresholds and for data classified as sensitive. A handful of other countries (Vietnam, Turkey, and India in specific sectors) have their own versions.

This is a different kind of rule than GDPR. GDPR is mostly principle-based: it cares about lawful basis, transparency, and safeguards for transfers, not physical server location by default. Localization laws are about where the bytes sit. A vendor telling you they're "GDPR compliant" says nothing about whether they satisfy a specific country's localization requirement, and the two get conflated constantly in vendor sales conversations.

Platforms like Vanta and Drata typically automate evidence collection: they can monitor access controls, track vendor risk assessments, confirm policies are acknowledged, and help assemble the audit trail that SOC 2 or ISO 27001 auditors, or an enterprise customer's security team, will ask for. That's genuinely useful once you're trying to demonstrate a working privacy and security program rather than just having one on paper.

What they don't do is tell you whether a specific country requires local storage for a specific category of employee data, or draft the data processing agreement you need with your EOR. Vanta and Drata operationalize a program that someone with legal or privacy expertise has to define first.

A few patterns come up repeatedly when a larger customer's due diligence team starts asking questions:

• No signed data processing agreement with the payroll processor or EOR, even though personal data flows through them daily
• Assuming the EOR's own compliance program covers your company's obligations as the entity that actually directs how the data is used
• No documented process for a data subject access or deletion request, so the first one that arrives becomes an improvised scramble
• Treating a vendor's marketing claim of being GDPR compliant as equivalent to your own company being compliant, when the two are legally distinct questions

Fixing these before they're asked about is far cheaper than fixing them under a deal deadline.