When you sign on as an international contractor, it’s easy to assume the privacy rules that apply are your client’s problem. But the reality is more tangled — and it starts with where you are, not just who you’re working for. Privacy laws follow the data subject, and as a contractor you’re both a data subject (your personal info) and often a data processor (client data you handle). That dual role lands you in a compliance web that most freelancers don’t see coming.
Data Privacy
International Contractors
Remote Work Compliance
Cross-Border Transfers
This post contains affiliate links.
The Geography of Obligation
The first surprise for many contractors: the law that applies to your client’s data isn’t necessarily the law of the client’s headquarters. Most privacy frameworks — GDPR, India’s DPDP Act, California’s CCPA — have extraterritorial reach. They apply based on where the data subject is located, not where the company incorporating them sits. So if you’re a U.S.-based contractor handling personal data of EU residents, GDPR applies to that processing, full stop. The same goes for a contractor in Singapore serving clients in India: India’s DPDP Act may govern the data you handle, even if you never set foot there.
Most of what’s documented here comes from research by PrivacyCache, which lays out these scenarios plainly. Their analysis makes clear that employee — or contractor — location determines which employment privacy laws apply. Your client’s legal team may have built compliance for their home market, but they might not have considered your jurisdiction. That gap becomes your risk.
Three Scenarios That Trip Up Freelancers
Let’s walk through three common situations, each with a different set of obligations.
Scenario 1: U.S. contractor, EU client
You’re based in Texas, hired by a German company to manage their customer support. You process names, emails, and chat logs of EU residents. GDPR applies to that employee data — your data — because you’re the data subject? Actually, your own personal data (your contract details, payment info) is processed by the client, so they must comply with GDPR for that. But more critically, the customer data you handle falls under GDPR because the data subjects are in the EU. The client must have a lawful basis for transferring that data to you, and you as a processor must follow the same rules. Most contracts include Standard Contractual Clauses (SCCs) for this, but many freelancers never see the paperwork. If your client hasn’t done a Transfer Impact Assessment (TIA), you’re both in shaky territory.
Scenario 2: EU contractor, Indian customers
You run a small SaaS from Portugal that sells to users in India. India’s DPDP Act applies to those customers’ data regardless of where you’re based. The act requires explicit consent for most processing, separate consent per purpose, and strict data retention. It also introduces a Consent Manager Framework. If you store data on AWS in Frankfurt, you still need to comply with DPDP for Indian users. The penalty can reach ₹250 crore (~$30 million). That’s not a fine a solo contractor can absorb.
Scenario 3: Canadian contractor, U.S. cloud storage
You’re in Toronto, your client is in New York, and you use Google Cloud in Iowa to store project files. Canada’s PIPEDA applies because you’re operating in Canada and the data subjects are Canadian (if they are). But the U.S. CLOUD Act grants U.S. law enforcement access to data on U.S. servers, even if the data subjects aren’t American. PIPEDA requires you to ensure “comparable level of protection” when data is transferred to a U.S. processor. You need a data processing agreement and must inform your Canadian clients about the government access risk. Most contractors never do this.
The Tools That Actually Help
You don’t need a legal department, but you do need a system. Start with a simple data map: what data do you collect, where does it live, who else touches it, and what countries does it travel through? A spreadsheet works, but it must be updated whenever you add a new tool or client. Many contractors use platforms like Deel to handle contracts, payroll, and compliance documents across countries — their built-in data processing agreements and granular permissions can save you from reinventing the wheel.
For securing data in transit, a VPN is no longer optional when you’re sending files across borders. ExpressVPN encrypts your connection and masks your IP, which matters when you’re accessing client systems from a coffee shop or coworking space. On the device side, Bitdefender provides antivirus and online security that catches malware before it exfiltrates client data.
- Map every tool you use for client work — CRM, file sharing, email, video calls — and note where each stores data.
- Ask each client for their data processing agreement or standard contractual clauses before you start work.
- Set up a separate encrypted folder for each client’s sensitive data and use a password manager to control access.
- Enable two-factor authentication on every platform that holds client data.
What Happens When You Ignore the Rules
Enforcement is accelerating. Cumulative GDPR fines have surpassed €7.1 billion since 2018, with over €1.2 billion issued in 2025 alone. The Irish Data Protection Commission fined Meta €1.2 billion for unlawful U.S. transfers; the Dutch DPA hit Uber with €290 million for sending driver data to the U.S. without safeguards. Those are corporate fines, but as a contractor you’re the weak link that regulators and clients will trace back to. If a client is audited and finds you stored EU data on an unsecured server in a non-adequate country, they may terminate your contract, report you, or even hold you liable for breach costs.
A single data breach from your account can destroy the trust you’ve built with every client. Regulators increasingly scrutinize third-party vendors — and that includes independent contractors. If you can’t show you’ve taken reasonable steps (encryption, access controls, documented transfers), you become the vulnerability in their compliance story.
Building a Privacy Baseline Without a Legal Team
The good news: you don’t need to become a privacy lawyer. Most contractors can start with a single principle: default to the strictest standard that applies to any of your clients. If you work with clients in California, the EU, and India, apply California’s CPRA as your baseline — it’s one of the most demanding frameworks and covers most rights and opt-out requirements. Then layer on specifics for other regions as needed.
I’ve found that asking a client about their data storage location often reveals they haven’t thought about it either. That’s an opportunity to position yourself as the knowledgeable partner who cares about compliance — a genuine differentiator in a crowded market. Access control and secure collaboration are topics that clients value, and being ahead of them builds long-term trust.
I still feel a knot of anxiety when I think about the full scope of global privacy rules. The patchwork is absurd. Yet every contractor I’ve talked to who started with a simple data map and a policy of asking clients “Where does my data go?” has avoided the worst pitfalls. You’re not expected to catch everything — but you’re expected to try.
The rules are messy, and they shift every year. But you don’t need a legal team to start. Map your data, ask your clients, keep a simple log of transfers and safeguards. That’s more than most people do, and it’s enough to put you ahead of the curve.