This is a tricky question that cannot be fully answered in the context of this site, but it is possible to discuss certain aspects:
- Does GDPR even apply?
- Who is the data controller?
- What is the legal basis for the international transfer?
- Conclusion, including short discussion of your three questions
Does GDPR even apply?
The GDPR applies to all processing of personal data where
- the personal data forms a filing system or processing is performed using automated means; and
- the processing occurs in the context of
- an establishment in the EU; or
- an offering of goods or services to people in the EU; or
- monitoring behaviour of people who are in the EU.
(And wherever I say “EU” I mean “EEA or UK”.)
Your company clearly has an establishment in the EU and would then be fully in-scope of the GDPR for all its processing of personal data. However, by you working from outside of the EU this company might also have an establishment outside of the EU. Then, the question is to which establishments a processing activity should be attributed. It is possible that a processing activity occurs in the context of multiple establishments. If the processing activities were to be attributed solely to a non-EU establishment, GDPR wouldn't apply. For example, an EU-based retail chain might have a store in Switzerland. This store processes personal data such as payroll for staff and card payments for customers. Since these processing activities occur solely in the context of the Swiss store, GDPR wouldn't apply to them.
This might not apply to your case though, since the processing activity is not independent from your company's main establishment.
Another reason why GDPR wouldn't apply is if the sensitive data in question is not personal data. For example, corporate financial details might be sensitive without being personal data.
For the remainder of this answer I will assume that the GDPR does apply because the processing activities occur in the context of an establishment in the EU, and that the data being processed is personal data.
Who is the data controller?
Under GDPR, the data controller is responsible for ensuring GDPR compliance. There can be more than one data controller.
Your company's client is definitely a data controller. They can only give the personal data to a third party if (a) they have a legal basis, or (b) they engage this third party as a data processor that will only process the data as instructed by the controller.
So depending on the contractual relationship your company would be another controller, or a processor working on behalf of the controller.
If your company is a controller then it is responsible for ensuring data protection. This will become relevant in the next section.
If your company is a data processor then things are much simpler: you can only use the data as you have been instructed to. You must not use the personal data for your own purposes. You cannot engage sub-processors without consent from the controller.
A data processor always has a contract (often called a data processing agreement, DPA) that conforms with Art 28 GDPR. In this contract, the controller instructs the processor to implement security measures, and also whether the processor can transfer the personal data to third countries. (A third country is any non-EEA country).
Your company is most likely such a data processor, because otherwise your company's client has likely messed up. But for the following, let's assume that your company is a controller or that the DPA authorizes you to make international transfers.
What is the legal basis for the international transfer?
The GDPR prohibits international transfers of personal data into countries outside of the EEA, unless one of the following hold:
- the target country has received an adequacy decision which attests a broadly equivalent level of data protection;
- the transfer is protected by appropriate safeguards, generally on the basis of Standard Contractual Clauses (SCCs); or
- one of the exceptions in Art 49 applies.
I don't want to discuss Art 49 here because it is unlikely to apply. This involves exceptions like everything is OK if the data subject has given their explicit consent after being informed of the risks, or that the transfer is necessary to fulfil a contract with the data subject, like a hotel booking in Singapore.
SCCs are popular but non-trivial to apply correctly. They are a bit like a data processing agreement, though with standardized clauses that try to ensure data protection through contractual mechanisms instead of laws. The tricky part is that the data exporter must ensure that the data importer is actually legally able to sign these clauses. For example, when the target country has surveillance laws that would require the data importer to disclose personal data to the government, those laws would conflict with the SCCs and the transfer would be invalid.
This issue gained prominence in the wake of the 2020 “Schrems II” ruling, after which EU–US transfer could no longer rely on an adequacy decision. The EDPB has issued recommendations 01/2020 on measures that supplement transfer tools so that transfers into countries are possible where SCCs otherwise wouldn't be valid. TL;DR: use end to end encryption or strong pseudonymization methods so that the data is useless even if it falls into the wrong hands. For example, I could legally store encrypted backups in the US. Of course, these measures also make more interesting processing activities impossible, such as the analysis you intend to make.
Note that a “transfer” is generally understood to not only involve copies of personal data for later processing, but already mere access to the personal data from a non-EU country. So keeping the data on an EU-based server and remoting into that server wouldn't work either.
Conclusion
I have outlined various factors that could affect whether such processing outside of the EU would be allowed. I think the most important factor is what your contract says, followed by your legal basis to perform an international transfer. My hunch is that your transfers would not be legal.
Given this background, your three questions can be briefly answered:
-
Is it legal for me to perform my duties from anywhere outside of the EU at my own discretion?
Yes, if your company is a data controller and has a legal basis for this international transfer. If your company is a data processor, it must abide by the controller's instructions.
-
Is data security I outlined sufficient to be GDPR compliant?
Those measures sounds like reasonable security measures in the sense of Art 32 GDPR, regardless of where the data processing is performed.
However, they are not sufficient to authorize a transfer into a third country. They fall short of supplemental measures recommended by EDPB 01/2020, for example because these measures are susceptible to an xkcd 538 attack (if you and the data are in a non-EU country, and you have the ability to decrypt the data, then the non-EU government could legally order you to violate your SCCs).
-
If the contract does not explicitly state all work must be physically carried out in the EU, can I do it outside of the EU without explicit clause in the contract, i.e. what's not forbidden is permitted?
If your company is a data processor, it can only perform international transfers if explicitly authorized to do so via the DPA.
