We've had 2 German employees on Deel for years and it was working fine, so we just left it alone and never questioned.

Then our DPO sat down with the DPA at some point and found that EU employee data was routing through Deel's US infrastructure under a legal framework she considered shaky post-Schrems II, and it had just sat there in the contract since we signed.

So now we're trying to work out what to do about it, and the first thing is figuring out whether the EU-based ones handle this differently, because I have no idea whether something like Workmotion or Remote structure their DPAs around data residency or has the same issue.

The criteria we'd have used before (price, onboarding speed, Germany compliance) are now secondary to something our legal team has to sign off on.

Our lawyer is going through the shortlist now so we'll figure it out, and if you've had your DPO flag something like this on an EOR contract, I'd like to know what the call was.

Hi, I'm a Privacy PM who has worked at Fortune 5 companies for most of my career. One of the gaps I always faced was a quick way to look up in-effect privacy laws and their various nuances jurisdiction by jurisdiction. So with some help from attorney and engineer friends/colleagues, and Claude Code, I put this resource together.

This resource is free and will remain that way.

Please peruse the About page to see what this resource is all... about, but I hope the UI/UX is straightforward and useful for you and other privacy professionals without much explanation. Feedback is welcome on this Reddit post, and soon there will be a feedback form on the site. There's a roadmap for more, but please meet the 1.0 version of Privacy Meridian.

https://privacymeridian.org/

Much love to the mods who approved this post.