Yes. The EDPB says remote access to EU data by a separate organisation located in a third country is a transfer under Chapter V of the GDPR, even when the data stays on servers in the EU. For engineering teams, that means support access paths belong in the transfer map, not just storage locations.
What the guidance says
The EDPB's recommendations on supplementary measures state that remote access from a third country, for example in support situations, is also considered a transfer. The Board's guidelines on Chapter V give an example: a processor with no EU establishment remotely accesses EU stored data for support, and that results in transfers from the EU controllers to the processor.
So "our database is in Frankfurt" is only half an answer. The other half is who can open it, from where.
Where support access hides
Look for these paths in your own stack:
- Vendor support engineers who join a screen share into your admin console.
- Break glass accounts that vendor staff can request.
- Follow the sun support rotas that route a ticket to whichever team is awake.
- Log and trace tools where a vendor can query raw payloads.
- Database or cloud console access granted for a migration and never removed.
- Customer success dashboards that show personal fields.
How to reduce the exposure
You have three broad options, and teams often combine them.
- Reduce what support can see. Mask personal fields in support tooling by default and show them only on a time boxed request.
- Reduce who can see it. Restrict access by role, region and ticket, and log each session.
- Reduce where they sit. Route tickets that involve personal data to staff in the same region, where your contract and staffing allow it.
None of these removes the legal question for access that remains. It narrows the facts you have to assess.
Ask vendors three questions
- From which countries can your staff access our data, including contractors?
- Is access just in time and logged, and can we see the log?
- Do you use sub-processors for support, and where are they?
Record the answers next to the vendor entry. A subprocessor list is a good home for them.
Internal staff are different
The EDPB's own example of an employee of an EU controller who travels abroad and accesses company systems is not a transfer in itself, because the same controller processes the data. Travel policy still matters for security reasons, but the legal treatment differs from a vendor.
Quick check
If a vendor only reads data and never copies it, is it still a transfer?
According to the EDPB, remote access from a third country counts as a transfer. Make the assessment on that basis and check the guidance text with your counsel.
Does an EU data centre settle this?
No. Location of storage and location of access are separate questions.
Sources
This is educational content, not legal advice.
Last reviewed: 19 October 2026.
