Hacker News Reader

NAL, but I think GDPR has exceptions for remote access, i.e. if a worker in India is viewing data held in the US, that is not necessarily formally considered a transfer from the US to India, even though the data clearly has made it to India if it's being displayed on a screen there.

View on HN

Under GDPR I believe if the data access is from an employee of the company (eg Uber) then there aren’t location checks. (Been a while so I could be mistaken here.)

But if you are subcontracting to an agency you need to list them as Subprocessors in your DPA. So subcontracted support staffing companies for example would be required to be listed and explicitly consented to.

This is all assuming you set up the base contractual protections for the data required to export the data at all, which Iber apparently didn’t do here.

Reply on news.ycombinator.com