Data Privacy and GDPR Rules for Global HR

• GDPR applies even if you have no EU entity. It reaches any processing of personal data of people in the EU/EEA connected with offering them goods or services, or monitoring their behaviour there, including as an employer with EU-based staff.
• Maximum fines run from the low millions to double-digit percentages of revenue, depending on the regime: the heaviest ceilings (GDPR, UK GDPR, China's PIPL, South Korea's PIPA) are set as a percentage of turnover or revenue, not a fixed cap.
• Consent is usually the wrong legal basis for employee data. Under GDPR, consent isn't valid where there's a clear imbalance between the parties (Recital 43) — which describes most employment relationships. Several other regimes we checked (India's DPDP Act, for example) instead treat employment-related processing as a separate lawful basis.
• Moving employee data across a border is its own compliance step, separate from having a lawful basis to process it in the first place. Every regime below has its own mechanism for that, and some (China) specifically address HR data.

GDPR's territorial scope isn't limited to companies established in the EU. It also catches processing by a controller or processor outside the EU where the processing relates to offering goods or services to people in the EU, or to monitoring their behaviour there. A US or Asia-based company employing even one person who works in the EU, directly or through an EOR, is processing that person's personal data as their employer, and GDPR's obligations follow.

The UK runs its own, near-identical regime (UK GDPR plus the Data Protection Act 2018) with its own fine structure and its own regulator, the ICO, separate from the EU's, following the UK's exit from the EU.

A lawful basis to process someone's data isn't the same as permission to move it to another country. GDPR's rules on international transfers (Articles 44 to 49) require one of: an adequacy decision for the destination country (Article 45), appropriate safeguards such as standard contractual clauses or binding corporate rules (Articles 46 to 47), or a specific derogation for the situation (Article 49). Transferring an EU employee's payroll data to an EOR or HRIS outside the EU needs one of these in place, not just a line in the contract.

Several of the other regimes we checked build in rules aimed specifically at this kind of HR data flow. China's PIPL has an exemption from its standard transfer mechanisms for transfers "necessary for cross-border human resource management" under lawful employment policies or a collective contract, though DLA Piper's guide notes the exact scope of "necessary" isn't settled. South Korea's PIPA and Japan's APPI both default to requiring the individual's specific consent for a cross-border transfer, with exceptions including a government-recognised adequate country (the PIPC recognised the EU in September 2025; the APPI whitelist includes the EU and the UK).

Under GDPR, consent is only a valid legal basis for processing if it's freely given, and Recital 43 says that's not the case where there's a clear imbalance between the data subject and the controller. An employee asked to "consent" to their employer processing their data is rarely in a position to refuse without consequences, which is why consent is treated as an unreliable basis for most employment processing, and why employers instead rely on other grounds, such as performing the employment contract, a legal obligation, or (within the limits Article 88 sets) a specific national employment-law rule.

Article 88 itself lets EU member states write more specific employment rules into national law or collective agreements, covering things like recruitment, performance management and workplace monitoring, provided the rules include appropriate safeguards for the employee. That means the detailed data-protection rules for employees can vary country to country within the EU, on top of GDPR's baseline.

An EOR processes your employees' personal data as part of running payroll, benefits and compliance in the country where they work, usually as a separate controller or as your processor, depending on how its contract is structured. Ask which role it takes, since that determines who's responsible for what under the regimes above.

Ask specifically how the EOR moves data between its systems and yours across borders: which transfer mechanism it relies on, whether it has one in place for every country it operates in, and what happens to the data if you switch providers.