Data protection when moving work to Kosovo: what to ask
Kosovo is outside the EU. Under both EU and Swiss rules, even giving someone abroad access to personal data counts as a transfer, and countries without an adequacy decision usually need extra safeguards, such as standard contractual clauses.
Questions for your data protection officer or lawyer
- Which safeguards do we need for transfers to Kosovo?
- Do we need a transfer risk assessment?
- Which data may the team see, and which not?
- Can the team work inside our systems, so data stays with us?
Questions for the provider
- Who has access, and how is access controlled and logged?
- Which subcontractors are involved?
- How are incidents reported, and how fast?
- What happens to the data at the end of the contract?
Sources: PwC Switzerland, CEE Legal Matters. General information, not legal advice. Check the current adequacy lists with your lawyer.