GDPR - Offshoring
<p>We work for consulting company in India, call it Z.
Z has a partnership with a European cards &amp; transactions processing company Y.</p>

<p>So the Indian consulting company Z does offshore production support for European Company Y. And as part of live production support Indian consultants have read access to sensitive data.</p>

<p>Per new GDPR rules: Can consultants in India view European data outside the EU?</p>

<p>GDPR also applies to foreign companies. Look at article 3.2 of the GDPR:</p>

<blockquote>
  <p>Article 3: Territorial scope</p>
  
  <ol>
  <li>This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a
  processor in the Union, regardless of whether the processing takes
  place in the Union or not.</li>
  <li>This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not
  established in the Union, where the processing activities are related
  to: (a) the offering of goods or services, irrespective of whether a
  payment of the data subject is required, to such data subjects in the
  Union; or (b) the monitoring of their behaviour as far as their
  behaviour takes place within the Union.</li>
  <li>This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member
  State law applies by virtue of public international law.</li>
  </ol>
</blockquote>

gdpr data-protection