Map the access first
Record what information the team will use, whose information it is, where it is stored and who can see it. Include remote access to UK-hosted systems. Cloud storage location alone does not describe every cross-border access path.
Identify the parties and their roles
Document the UK business, employing entity, service providers and subprocessors. Establish the controller and processor roles for each activity. Record who handles access requests, incidents, retention and deletion.
Check the transfer question
The ICO explains how to identify restricted transfers and the available approaches. Apply its current guidance to the actual arrangement. Confirm appropriate contractual and technical measures with a qualified adviser where needed. An EOR agreement does not automatically resolve every data-protection question.
Limit access and prove removal
Use named accounts, multi-factor authentication, limited privileges and approved devices. Decide whether local downloads are needed. Record how changes to roles, contract end dates and incidents trigger access reviews.
Keep evidence of the decision
Retain the data map, party roles, transfer assessment where applicable, contract records and technical access decisions. Revisit the arrangement when systems, work or providers change.
Official reading
Prepared for operational planning · Reviewed 7 November 2026. Check official guidance for changes and requirements that apply to your circumstances. Checklist progress stays on this page until you leave or reload.