International data transfers
What data leaves the European Union and how we protect it
Which delivery model keeps your data inside the European Union, which one transfers it, and what legal instrument we apply in each case.
In summary: onshore teams in Spain and our hub in Poland keep your data inside the European Economic Area. The corridor with Mexico, Colombia and the Dominican Republic involves an international data transfer, protected by standard contractual clauses and, where relevant, a transfer impact assessment.
What is an international data transfer?
GDPR restricts sending personal data outside the European Economic Area to countries without a European Commission adequacy decision, unless additional safeguards are applied.
None of the countries in Corpshore's Latin America corridor currently holds a European Commission adequacy decision, so any project involving those hubs requires transfer instruments. We say this plainly because it is the question that most shapes a Spanish buyer's decision.
Which model keeps your data inside the European Union
An onshore team in Spain keeps your data inside the European Economic Area at all times, with no need for international transfer instruments.
Our hub in Poland offers the same European Economic Area residency guarantee at a lower cost than a team in Spain, and is the usual choice when the priority is combining savings with European data residency.
What instruments we apply when data leaves the European Economic Area
Standard contractual clauses: the model approved by the European Commission, incorporated into the client contract and into agreements with the delivery hub involved. We apply them systematically to any transfer outside the European Economic Area, whether the client asks for them or not.
Transfer impact assessment: an analysis of whether standard contractual clauses provide sufficient protection in the destination country, taking into account its legal framework and authorities' data access practices. We apply it to projects involving more sensitive data.
Minimisation and pseudonymisation: where the process allows, we reduce the volume of personal data or pseudonymise it before it reaches a delivery hub outside the European Economic Area. This is often the most effective safeguard, because data that never leaves does not need protecting at the destination.
The decision is yours
You choose the delivery model. If your sector or internal policy requires exclusive EU data residency, we reflect that in the proposal and work only with onshore teams in Spain or our hub in Poland.
If your priority is savings and your data allows it, we apply the Latin America corridor with the corresponding instruments. Many clients combine both: the sensitive process stays in the European Union and the volume goes to the corridor.
Frequently asked questions about data transfers
Do Mexico, Colombia or the Dominican Republic have an EU adequacy decision?
No. None of the three currently holds a European Commission adequacy decision, so any transfer to those hubs requires additional instruments such as standard contractual clauses.
What exactly is a transfer impact assessment?
It is an analysis of whether standard contractual clauses provide sufficient protection in the destination country, taking into account its legislation and authorities' data access practices. We apply it to projects involving more sensitive data.
Can I require that my data never leaves the European Union?
Yes. Tell us during discovery and we will work exclusively with onshore teams in Spain or with our hub in Poland, with no international transfers.
What happens if I combine a team in Spain with one in Latin America?
Only the data that actually reaches the team in Latin America requires transfer instruments. Data that stays with the team in Spain does not leave the European Economic Area.
Do these safeguards apply to all clients or only those who ask?
We apply standard contractual clauses systematically to any transfer outside the European Economic Area. The transfer impact assessment is applied based on data sensitivity.
Can I see the documentation before signing?
Yes. The data processing agreement and, where relevant, the standard contractual clauses are part of the proposal process.
What happens if the rules change?
We review transfer instruments periodically and update the model applied if legislation or European Commission adequacy decisions change.
Let's talk about the right data model for your project
Book a discovery call or request a proposal setting out your data residency requirements.