Screen-sharing from Hyderabad: is it a transfer, and who signs what?
Nordwind Care Systems BV (Utrecht) supplies scheduling and rostering software to home-care providers. Its platform holds care plans, client addresses and visit notes, which in practice include data about health and mobility. Nordwind's contract with its customers makes it a processor. To cover night-time incidents, Nordwind engaged a support company, Insight24 Ltd, which handles tickets from an operations centre in Hyderabad, India; about 30 engineers there can open any customer record when a ticket is raised, and no transfer impact assessment was ever produced. The customer contract says only that 'appropriate safeguards under the GDPR are in place'. The Dutch DPA opens a routine sector inquiry and asks Nordwind to describe its international transfers. Nordwind's managing director replies that no data is 'stored' outside the EEA, that Insight24 simply 'views screens', and that EU standard contractual clauses were signed with the Indian firm in 2022.
1. Is Insight24's remote access a restricted transfer under Chapter V? Which instrument is needed, and which SCC module applies?
Read the worked answer
Yes - this is a restricted transfer. A transfer occurs when an exporter makes personal data available to another party in a third country, including where nothing is sent but access is enabled. EDPB Guidelines 05/2021 are explicit that remote access from a third country, including screen-sharing where the data is displayed, is a transfer. The managing director's 'nothing is stored abroad' argument fails on the definition, not on the facts.
Who exports what. Nordwind is a processor of its care-provider customers and Insight24 is its sub-processor. Two relationships exist:
- Customer (controller) → Nordwind (processor): already covered by an Article 28 contract; the customer must authorise the onward transfer.
- Nordwind (processor) → Insight24 (sub-processor): Article 28(2) requires prior written authorisation, and Article 28(4) puts the same obligations on the sub-processor.
Module. Because the exporter is itself a processor, the correct tool is Module Three (processor-to-processor) of Decision 2021/914 - not Module Two. Signing Module Two would misdescribe the roles.
Derogations are unavailable. Article 49 exceptions suit occasional, non-repetitive transfers; 24/7 ticket handling is repetitive and structural, so Article 46 tools are mandatory. Note also that SCCs signed in 2022 do not by themselves discharge Schrems II: a transfer impact assessment must accompany them.
2. What must happen before Insight24's engineers keep accessing production records? Set out what the transfer impact assessment must actually examine.
Read the worked answer
Access should be suspended or ring-fenced until the assessment is documented; continuing without it is an accountability failure under Article 5(2).
Step 1 - map the transfer. Categories of data (care plans, addresses, health and mobility notes), volume, data subjects (vulnerable clients), method (remote access, no local storage), frequency, and whether any local copy is cached.
Step 2 - examine Indian law and practice. The Digital Personal Data Protection Act 2023 and its rules, the IT Act 2000, lawful interception under telecom and IT powers, and any government access practice or reported requests. Assess whether the importer has ever received a disclosure request and how it responded.
Step 3 - assess whether the clauses are effective in practice. Where local law can override the clauses, supplementary measures are needed: encryption with keys held in the EEA, pseudonymised records so engineers see identifiers rather than names and diagnoses, just-in-time access, session recording, an obligation to challenge unlawful requests and notify Nordwind, and a transparency report.
Step 4 - conclude and document. If effective equivalence cannot be achieved, the transfer must not proceed; the fallback is EU-based support or a different architecture.
Alongside the TIA: written sub-processor terms, authorisation from each customer, records of processing, and a DPIA, because health data at scale plus third-country access is high risk under Article 35.
3. The DPA asks how Nordwind demonstrates accountability for this arrangement. What would you fix first, and why in that order?
Read the worked answer
Identity the gaps against Article 5(2) and Article 24, then sequence by exposure.
- Stop the unassessed access. Continuing to allow access after the risk has been identified is the hardest fact to defend in an enforcement file. Interim restrictions buy time and show control.
- Complete the TIA and the Module Three SCCs, signed by both parties, with the sub-processor list and the customer authorisations brought into line. Article 28(2) and (4) failures are commonly cited in breach decisions.
- Correct the records of processing (Article 30(1)(e)) so each transfer, the third country, the recipient and the safeguard are recorded. This is the first document a supervisor requests.
- Fix the customer contracts. The line 'appropriate safeguards under the GDPR are in place' is meaningless; customers need the actual mechanism, a notification route for sub-processor changes and an objection right.
- Transparency and governance. If notices promise EEA-only processing, they must be corrected; add the transfer to the DPIA, the risk register and the DPO's reporting line.
Ordering matters because 1 and 2 reduce ongoing risk, while 3 and 4 make the position demonstrable. Fines for Chapter V failures sit in the higher Article 83(5) tier, so documentation is not administrative decoration.