Where the question arises
Remote access to a tenant from another country can count as a transfer, even when the data stays in a UK or EU region.
The safeguards
Where no adequacy decision covers the destination, a transfer needs an appropriate safeguard.
What we agree with you
Before work starts we agree the transfer mechanism, who accesses what and from where, the technical controls, and what happens if you want access restricted to certain people or locations.
Minimising transfers
The simplest transfer to manage is the one that does not happen. We use masked or synthetic data for build and test, and limit production access to named people for defined tasks.
How an engagement runs
It starts with a 45-minute consultation, then a discovery and fit-gap workshop on your own processes. You receive a written fit-gap and a phased plan before a programme is agreed. Four phases follow, each with something you can use and review.
Discover
Process workshops, data audit, and a fit-gap against the standard product.
Design
Solution blueprint, integration map, and the extensions we will actually need.
Deploy
Configuration, migration rehearsal, role-based training, UAT and phased cutover.
Support
Hypercare, managed services, client portal, scheduled optimisation reviews.
What drives the cost: users, legal entities and currencies, integrations, data migration and the gaps found against standard. See how pricing works or run the three-minute readiness score.
Frequently asked questions
Is remote access a transfer?
It can be. Viewing personal data from a country outside the UK or EU is commonly treated as a restricted transfer, so we plan the safeguard and the access controls.
Do you use SCCs or the IDTA?
We agree the appropriate mechanism with you: the UK IDTA or the UK Addendum for UK data, and the EU Standard Contractual Clauses for EU data.
Can access be limited to certain people?
Yes. We record named roles and tasks, apply them in the tenant and report on access on request.
Statutory rates, filing rules, mandate dates and data-protection requirements are set by the relevant authorities and change; we confirm the current position with you and your advisers before configuration. General information, not tax, legal or data-protection advice, and not a statement that any product or service is certified or approved by a regulator.
Last reviewed 2026-10-16