Short answer
You can work with engineers in Kosovo under the GDPR. Because Kosovo has no EU adequacy decision, remote access to personal data is a transfer to a third country, so you need a data processing agreement under Article 28, the EU Standard Contractual Clauses under Article 46, and a documented transfer impact assessment.
Is Kosovo an adequate country?
No. The European Commission has not adopted an adequacy decision for Kosovo, so transfers cannot rely on Article 45 GDPR. They need one of the safeguards in Article 46, and for an outsourcing relationship that is almost always the Standard Contractual Clauses.
Kosovo has its own data protection law, Law No. 06/L-082 on the Protection of Personal Data, which is modelled on the GDPR and supervised by the Information and Privacy Agency. That helps in a transfer impact assessment, but it does not replace the contractual safeguards.
Remote access is a transfer
Keeping your database in Frankfurt does not avoid the question. When an engineer in Prishtina can view or query personal data, that is a transfer to a third country, even if no file ever leaves the EU. If engineers never see personal data at all, for example because they only work on code and use synthetic test data, the transfer analysis may change, but document that conclusion.
The documents you need
For a typical engagement where you are the controller and the vendor processes data on your behalf:
- A data processing agreement under Article 28 GDPR: subject matter, duration, types of data, instructions, security measures, sub-processors, deletion at the end.
- The EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), module 2 for controller to processor, or module 3 if you are yourself a processor for your clients.
- A transfer impact assessment that looks at Kosovo’s law and practice on government access to data, and the supplementary measures you apply.
- A record of the transfer in your record of processing activities, and an update to your privacy notice if it lists recipient countries.
Technical measures that reduce the risk
Contracts are necessary, but regulators also look at what actually happens to the data.
- Keep production data in your EU cloud region and give engineers access through your own identity provider, with least-privilege roles.
- Use anonymised or synthetic data in development and test environments.
- Log access to production systems and review it.
- Use managed, encrypted devices and revoke access on the day someone leaves the project.
Switzerland and the United Kingdom
Swiss companies apply the revised Data Protection Act. Kosovo is not on the Federal Council’s adequacy list, and the FDPIC recognises the EU clauses with Swiss adaptations.
UK companies apply the UK GDPR. Kosovo is not covered by UK adequacy regulations, so transfers use the ICO’s International Data Transfer Agreement or the UK Addendum to the EU clauses, with a transfer risk assessment.
How elitics handles it
We sign the data processing agreement and the Standard Contractual Clauses together with the master services agreement and NDA, before work starts. Engineers work inside your accounts and access controls, so your data stays in your systems and your own audit logs show who accessed what.