Is an EOR your data processor, or a controller in its own right?
Summary
At Remote, a controller. Remote's Data Processing Addendum says that for Employment Services, its EOR product, "each party acts as an independent Controller," while for payroll, HRIS, and contractor management Remote processes data on the client's behalf. The label decides which set of EU Standard Contractual Clauses applies and whether you get a say over the subprocessors Remote uses.
One vendor, two roles
Remote's privacy policy opens with the split: "We process personal data both for our own purposes as a controller and on behalf of our clients as a processor." EOR sits on the controller list. Contractor management, payroll services, and HRIS sit on the processor list.
That matters for a company that hires through Remote's EOR and also runs its HR records in Remote's HRIS. The same employee's data then lives under two different legal relationships with one vendor.
What the label changes
Transfer clauses. Where both parties are independent controllers under the EU GDPR, Remote's DPA applies Module 1 of the 2021 SCCs. Where Remote is your processor, it applies Module 2.
Subprocessors. In the processor section, you give Remote general written authorization to add subprocessors, and you can object within 14 days of being told the list has changed. The list sits on a dashboard page "for registered users only." That clause is written for Remote as a processor, so it does not reach employee data held under the EOR relationship.
The clauses that expired
The European Commission issued the current SCCs on 4 June 2021 in Implementing Decision (EU) 2021/914, for transfers from controllers or processors in the EU/EEA to controllers or processors outside it. The clauses "combine general clauses with a modular approach," and the parties pick the module that fits their situation.
The two older decisions, 2001/497/EC and 2010/87/EU, were repealed with effect from 27 September 2021. Contracts signed on the old clauses before that date counted as adequate safeguards only "until 27 December 2022," and only while the processing stayed unchanged. A data agreement that still cites 2010/87/EU has been out of date since then. Remote's DPA cites Decision 2021/914 by name.
Sources
- https://remote.com/policy/data-protection
- https://remote.com/policy/privacy-policy
- https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
- https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914
Related on this site
- Can you pay Remote less than $699 a month, and what's the catch?
- If the big EOR providers charge about the same, what actually separates them?
- What happens to your employees when you move them to a different EOR?
Written by Kaz, independent publisher. No commercial relationship with the providers named unless it is listed on the disclosure page.
Page last updated 2026-09-28. Sources are listed per figure and labeled statutory or payroll reference. Rates last verified 2026-08-21. This is not legal, tax or payroll advice and we do not file anyone's payroll.
Every formula on this site is written out in full on Method. Ordering is by computed cost, never by what a provider pays us.
Corrections: contact form.