# Security and GDPR with remote developers

URL: https://brainpowergroup.eu/en/blog/security-and-gdpr-with-remote-developers
Date: 2025-04-17 (updated 2026-10-01)
By: Erik Schoorl, Brainpower Group

Give remote developers a managed laptop, one account with two-factor authentication and no real personal data. Access from Serbia can be a transfer under the GDPR.

When remote developers work on your software, arrange these before they start: a managed laptop, one account per person with two-factor authentication, as little personal data within their reach as possible, a data processing agreement and a fixed procedure for when someone leaves. Most of these are the same measures you would take for developers in your office, with one difference: as soon as someone outside the EEA can see personal data, that may be a transfer to a third country under the GDPR.

## A managed laptop

Do not let developers work on your code from their own laptop. A managed laptop has disk encryption switched on, installs updates automatically, locks the screen and can be wiped remotely. With a device management (MDM) tool you can also see that it stays that way.

Our developers work on managed, encrypted laptops that we arrange. If you work with another provider, ask how they do this and who manages the laptops.

## Access through one account

Every developer has one personal account in your identity provider, with SSO and two-factor authentication. That account is how they log in to the repository, the cloud console, the ticket system and chat. Do not use shared accounts. With one personal account, you can switch everything off in one go when someone leaves.

Grant rights based on what each person needs. A developer gets write access to the repository and access to the test environment. Production is for a small number of people, granted per role and preferably for a limited time, and you log who was in and when. Secrets belong in a vault, not in a .env file passed around in chat. More on that in [managing secrets and API keys safely](/en/blog/managing-secrets-and-api-keys-safely).

## Keep personal data out of development

The simplest GDPR measure is that developers never need real personal data. Use synthetic data or an anonymised copy for development and testing. Article 32 of the GDPR names pseudonymisation and encryption as examples of appropriate measures.

Sometimes someone has to investigate a problem in production. Agree who may do that, through which route, and that the access is logged. With centrally managed accounts this is little extra work.

## Access from outside the EEA

In its guidelines on transfers, the EDPB states that remote access from a third country is also a transfer, even if someone only sees the data on a screen. That applies when three criteria are met. One of them is that the data is made available to another controller or processor. According to the same guidelines, your own employee logging in while travelling does not count.

Serbia is not on the European Commission's list of countries with an adequacy decision. If there is a transfer, you need a transfer tool, usually the standard contractual clauses the Commission updated in June 2021. Whether your situation involves a transfer depends on who employs the developer and what role each party plays. Have your lawyer or data protection officer pin that down.

## The data processing agreement

If an outside party processes personal data on your behalf, you sign a data processing agreement. Article 28 of the GDPR sets out what it must contain. For remote developers these are the main points:

- Everyone who can access the data has committed to confidentiality or is bound by it by law.
- The processor takes the security measures required by Article 32.
- Sub-processors are only added with your written authorisation.
- At the end, the processor deletes or returns the data, at your choice, and deletes existing copies.

Also agree how quickly the processor reports a data breach to you. Article 33 says "without undue delay", while you, as the controller, must report a breach that poses a risk to your supervisory authority within 72 hours where feasible. So put a concrete deadline in the agreement, for example within 24 hours.

## If NIS2 applies to you

If your organisation falls under NIS2, remote developers are part of your supply chain. Article 21 of the directive lists, among other measures, supply chain security, access control policies and, where appropriate, multi-factor authentication. So ask your provider how they handle these, and record it. What else NIS2 means for a development team is covered in [NIS2 and your development team](/en/blog/nis2-and-your-development-team).

## When someone leaves

With us you can scale up or down per month, so a developer leaving is part of normal work. Make it a checklist you finish on the same day:

1. Disable the account in the identity provider. Through SSO, most systems close at once.
2. Revoke personal tokens, SSH keys and API keys that work outside SSO.
3. Rotate shared secrets the developer had access to.
4. Check systems that are not connected to SSO, such as older admin panels or accounts with outside services.
5. Have the laptop returned or wiped remotely.

On top of that, go through the list of accounts every month, because nobody notices when someone misuses an account that is no longer in use. How we handle laptops, accounts and access is described under [how we work](/en/how-we-work).

## Sources

- [EDPB, Guidelines 05/2021 on the interplay between Article 3 and Chapter V of the GDPR](https://www.edpb.europa.eu/documents/guideline/guidelines-052021-on-the-interplay-between-the-application-of-article-3-and-the_en)
- [European Commission, adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en)
- [European Commission, standard contractual clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)
- [GDPR, Regulation (EU) 2016/679, on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [NIS2 Directive, Directive (EU) 2022/2555, on EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)

## Frequently asked questions

**Is access to personal data from Serbia a transfer under the GDPR?**

It can be. According to the EDPB, remote access from a country outside the EEA also counts as a transfer when its three criteria are met. Serbia has no adequacy decision from the European Commission, so you then need a transfer tool such as the standard contractual clauses.

**Do you need a data processing agreement with a nearshore partner?**

Yes, as soon as that partner processes personal data on your behalf. Article 28 of the GDPR sets out what it must contain, including confidentiality, security measures, rules for sub-processors and deleting or returning the data at the end.

**What do you do when a remote developer leaves?**

On the same day, disable their account in your identity provider, revoke tokens and keys, rotate the secrets they could access and have the laptop wiped. With centrally managed accounts, that is a short checklist.

---

Source: https://brainpowergroup.eu/en/blog/security-and-gdpr-with-remote-developers
Brainpower Group, contact: https://brainpowergroup.eu/en/contact, hello@brainpowergroup.eu