Can Developers Outside the EU Work on Your Systems? GDPR, Security and the Limits
In most cases, yes, and the work to get there is smaller than it looks from the outside. Neither GDPR nor NIS2 forbids working with people outside the EU; they ask for the right contractual arrangements and for security measures you control. In practice the professional works inside your environment, under your own security policy (your accounts, your VPN, your device rules), and Tunga takes care of the practical side, such as getting a laptop configured by your IT team to the professional. It isn't possible where a law or a contract says so: nationality requirements, defence work, some critical infrastructure, a client contract that excludes offshore work, or a procurement process with no room for a supplier outside its fixed list.
Why it feels riskier than it is
Someone working on your systems from another continent raises three questions at once: where the data goes, who is really behind the screen, and what an auditor will say. Much of that comes down to measures you already have for anyone with access, applied to one more person.
What GDPR asks
GDPR does not forbid a professional outside the European Economic Area from working on your systems. It asks that personal data stays protected wherever it is accessed from. Whether such access counts as a transfer of personal data under GDPR depends on how the arrangement is set up; where it does, the usual legal basis is the EU Standard Contractual Clauses, because most African countries have no EU adequacy decision.
In practice:
- The data stays in your systems. The professional works in your environment, with access to what the role needs, and nothing is copied to Tunga.
- The paperwork is short. If you have your own data processing agreement, Tunga signs it; if you don't, Tunga proposes one.
Your security setup applies, as for any team member
You decide how the professional works with your systems, exactly as you would for someone in the office:
- Accounts and access through your own identity provider, with multi-factor authentication and the access the role needs.
- Your VPN, device and data policies, which the professional follows.
- Offboarding on your terms: when an engagement ends, you close the accounts.
Hardware
Tunga takes care of the friction that comes with distance. Your IT team can configure a laptop the way you require, and Tunga gets it to the professional, for example in Nigeria. Where that is impractical, Tunga can arrange hardware in the professional's country. Tunga can also advise on how to set up remote access safely if you haven't done this before.
Who is behind the screen
Everyone who joins Tunga's pool shares proof of identity and goes through a multi-stage test cycle with several personal conversations, a review of their code on GitHub and screening for cheating. Since Tunga started in 2015, it has not had a case of identity fraud. You interview the candidates yourself before anyone gets access.
NIS2 and supplier questionnaires
NIS2 does not exclude suppliers outside the EU either. It asks organisations in scope to manage the security of their supply chain, including "the relationships between each entity and its direct suppliers or service providers" (article 21). In practice that means your supplier assessment. If you work with a supplier questionnaire, Tunga fills it in.
When it is not possible
Some limits are hard, and then Tunga is not the right choice:
- A legal requirement on nationality or residence, for example in defence or parts of critical infrastructure.
- A contract with your own client that excludes offshore or non-EU work.
- A fixed procurement process that only admits suppliers from a preferred-supplier list or with a fixed set of certifications, with no room to assess an alternative.
- Data that may not leave the EU at all, whatever the contractual safeguards.
Where Tunga fits
Tunga takes the staffing side off the plate of companies that need digital professionals: software engineers, AI operators, product managers and other digital roles, from across Africa. The client directs the work. Tunga handles finding and vetting, contracts, payments and compliance, onboarding, keeping people, and replacing them when someone leaves or it isn't working. The professionals are independent freelancers contracted by Tunga and work remotely from their own country; the client has one contract, with Tunga, and a delivery manager who checks in with both sides. In 2025, about 1 in 56 placements ended because the professional left for another job. Founded in 2015; 3,500 professionals across 38 African countries and 300+ client companies, as of September 2026.
Tunga is not the right fit when the role has to be on site, when the work means talking to your clients in a language other than English or French, or when saving on cost is the main reason you're looking.
Need capacity now?
Tell us what you're looking for. We'll get back to you within one working day.
Tell us what you need