Reading time: 11 min
Your engineering team in Amsterdam, Utrecht, Brussels or Ghent needs senior engineers your local market can't supply. Your data protection officer has one question before anything is signed: where will our data go, and who is accountable for it? An offshore proposal turns that question into weeks of transfer assessments. A nearshore partner inside the EU can make it a short conversation.
This guide is for CTOs and DPOs at Dutch and Belgian companies, especially in finance, HR tech and SaaS. It explains what GDPR requires of a nearshore partner, why EU-based delivery is simpler, how we compared providers, and which questions to ask before you sign a data processing agreement. For how ITDS runs its teams, see our page on nearshore software development from Poland and Portugal.
| In this guide | |
| What GDPR requires Why EU-based wins by default How we compared The 11 partners |
Language, hours, sector ITDS and House of HR DPA checklist FAQ |
What GDPR actually requires of your nearshore partner
When nearshore engineers work with personal data on your behalf, your partner usually acts as a processor and you remain the controller. GDPR then requires a written contract, the data processing agreement (DPA), that sets out how the partner handles that data.
In general terms, a DPA should make sure the partner:
- processes personal data only on your documented instructions;
- binds its engineers to confidentiality;
- applies appropriate technical and organisational security measures;
- uses sub-processors only with your authorisation and on the same terms;
- helps you respond to data subject requests and data breaches, and tells you about a breach without undue delay;
- deletes or returns the data when the work ends, and allows audits.
None of this is unusual for a serious partner. The difference between providers is how quickly and clearly they can show it. This section is general information, not legal advice, so involve your DPO and counsel in your own case.
Why EU-based GDPR nearshore beats non-EU by default
The biggest GDPR difference between nearshore and offshore is not security. It is international transfers.
If engineers outside the European Economic Area can access your personal data, GDPR treats that as a transfer. It then needs a legal basis, such as an adequacy decision for that country, or standard contractual clauses together with an assessment of the local legal risks. That work is doable, but it takes time, and it has to be kept up to date.
When your nearshore engineers are employed and work inside the EU, as in Poland or Portugal, that transfer layer usually falls away. GDPR applies to them exactly as it does in the Netherlands or Belgium, and the supervisory authorities cooperate across the EU. You still need a DPA, access controls and the right security, but your DPO starts from familiar ground.
For financial companies, the bar is higher. The EU's Digital Operational Resilience Act (DORA) adds requirements for managing ICT third-party risk. An EU-based partner that already works with regulated clients will find those conversations easier.
| Offshore can be made compliant. EU-based nearshore starts compliant, and that saves your DPO weeks. |
How we compared GDPR nearshore partners
We looked at providers with engineering delivery inside the EU and judged them on four things, using their public materials:
- EU delivery. Are engineers employed and working inside the EU or EEA?
- GDPR posture. Do they publish security certifications or clear data protection information?
- Proximity. How much of the Dutch and Belgian working day do they share?
- Seniority and fit. Can they supply senior engineers, and do they suit Benelux buyers, including those who work in French?
We have not audited any of these companies, ourselves excepted, so we don't give scores. Treat the table as a shortlist to check, not a verdict.
The list: 11 GDPR nearshore partners for Dutch and Belgian firms, compared
| Partner | Main EU delivery | Time vs Brussels and Amsterdam | Strength for Benelux buyers | Check before signing |
|---|---|---|---|---|
| Sii Poland | Poland | Same | Scale across many stacks | Availability for niche senior roles |
| STX Next | Poland | Same | Python, data and AI depth | Which engineers sit in the EU, as it also delivers from Mexico |
| Netguru | Poland | Same | Product design and engineering together | Fit for pure team extension |
| Software Mind | Poland | Same | Long-running engineering teams | Seniority of proposed engineers |
| Future Processing | Poland | Same | Long-term teams with consulting | Whether you need the consulting layer |
| EPAM Systems | Central and Eastern Europe, among others | Same for EU hubs | Very large programmes | Which locations your team would use |
| Endava | Romania and other EU locations, among others | Mostly one hour ahead | Enterprise and financial services experience | Which locations your team would use |
| Intellias | Portugal and other European locations | Lisbon one hour behind | Scale with a Portuguese option | Where your engineers will be based |
| KWAN | Portugal | One hour behind | Publishes ISO 27001 and ISO 27701 certification | Capacity for larger teams |
| Growin | Portugal | One hour behind | Local presence in Lisbon and Porto | Senior availability in your stack |
| ITDS | Poland and Portugal | Same (Poland), one hour behind (Portugal) | Senior engineers, EU-employed, part of a Belgian-headquartered group | Fit if you need a very large team at once |
A few patterns stand out. Polish providers share your exact working day. Portuguese providers sit one hour behind and often bring engineers who also work in French, which helps Belgian companies with French-speaking teams or clients. Global firms bring scale, but always ask which of their locations your engineers would work from, because that decides whether your data stays in the EU.
| Need a senior engineer your DPO can sign off quickly? Tell us the role. We will tell you where we would find them and how we handle your data. Book a call in your hours |
Language, hours and sector: what Benelux teams should weigh
Data protection narrows the field. Three more factors usually decide the final choice for Dutch and Belgian teams.
Language. English is the working language of almost every engineering team in Poland and Portugal, so Dutch-speaking teams rarely need anything more. Belgian companies often do. If your team, your product or your users work in French, a Portuguese partner with French-speaking engineers can remove a real bottleneck. According to the ITDS Portugal team, functional roles that need French are among the hardest to fill, which tells you how valuable that combination is.
Hours. Poland runs on the same clock as Amsterdam and Brussels, so your stand-ups, reviews and releases all happen in one working day. Portugal starts an hour later, which most teams barely notice and some use to extend their support window.
Sector. Financial services, HR tech and SaaS companies hold sensitive personal data by default. Ask each partner which regulated clients they already work with, and how their engineers are trained to handle production data. A partner that already lives with audits will make your own audits easier.
Finally, think about size. If you need two senior engineers, a boutique partner will usually move faster. If you need fifty, a large firm's scale may matter more than speed.
ITDS and House of HR: a Belgian group behind EU-based teams
ITDS is a nearshore IT staffing and software engineering company with teams in Poland and Portugal and operations in the Netherlands. We are part of House of HR, a European HR services group headquartered in Kortrijk, Belgium.
For a Benelux buyer, that combination matters. Your partner's engineers are employed inside the EU under EU rules, and the group behind them is headquartered in Belgium and well established in the Belgian and Dutch markets. Contracts, data protection and accountability all sit inside the same legal space as your own company.
In day-to-day terms, roughly one in five candidates passes our vetting, and on average a client goes from starting a search to an integrated engineer in about 20 days.
Questions to ask before signing a GDPR nearshore DPA
Use this checklist with any provider, including us. Good partners answer every point without hesitation.
- Where will each engineer live and work, and who employs them?
- Will any personal data be accessed from outside the EU or EEA? If so, on what legal basis?
- Which sub-processors do you use, and how will you inform us of changes?
- What security certifications or audits can you show, and how recent are they?
- How do you control and log engineers' access to our systems and data?
- How quickly will you tell us about a suspected data breach, and how?
- How do you train engineers on data protection and confidentiality?
- How will you help us answer data subject requests?
- What happens to our data and access when an engineer leaves or the contract ends?
- If we are a financial company, how do you support our DORA obligations?
This checklist is general guidance. Your DPO and counsel should adapt it to your data and your sector.
GDPR nearshore: FAQ for Dutch and Belgian firms
Both are EU member states, so GDPR applies there in the same way as in the Netherlands or Belgium, and personal data can stay inside the EU. You still need a data processing agreement, access controls and appropriate security, so check the details with your DPO.
In most cases, yes. If the partner's engineers process personal data on your behalf, GDPR requires a written agreement that covers instructions, confidentiality, security, sub-processors, breaches and the end of the contract.
Access to personal data from outside the EEA counts as an international transfer. It needs a legal basis, such as an adequacy decision or standard contractual clauses with a risk assessment, which adds work and ongoing review.
Poland shares Belgium's time zone and offers a large engineering market. Portugal is one hour behind and has many engineers who also work in French, which helps Belgian teams that operate in French.
Where engineers work and who employs them, whether any data leaves the EEA, the list of sub-processors, security certifications, access controls, breach notification and what happens to data when the contract ends.
Book a call in Dutch and Belgian hoursTell us about the role your local market can't fill and the data your team works with. On a short call, we will tell you how we would staff it from Poland or Portugal, how we handle your data inside the EU and how soon your new engineer could start. Read more about our nearshore teams. |