International clients / Privacy & procurement

Data boundaries don't end at borders.

Every jurisdiction starts with the same question: what data, whose authority, which systems, and where will it go? Browse countries worldwide and work through specific safeguards before granting access. This is an intake guide, not a certification or legal opinion.

Discuss your data requirements International client guide

Global inquiry coverage / Not automatic compliance

One global intake. Local requirements reviewed separately.

Our reference directory lists 248 UN M49 countries and areas. Geographic grouping is informational; service availability, privacy law, sanctions, security-testing authorization and procurement restrictions are reviewed case by case.

41 countries / areas

North America & the Caribbean

National, state/provincial and sector rules can overlap. A contracting country alone does not identify the applicable privacy law.

Explore country requirements

16 countries / areas

South America

Privacy frameworks and international transfer conditions differ by country. A regional business presence does not establish a common transfer regime.

Explore country requirements

51 countries / areas

Europe

EU/EEA GDPR, UK GDPR and the rules of other European jurisdictions are not interchangeable.

Explore country requirements

32 countries / areas

Asia

Asia has multiple distinct privacy regimes, restrictions and possible localization rules. Do not infer permission to transfer from a regional grouping.

Explore country requirements

18 countries / areas

Middle East / Western Asia

Privacy, cybersecurity, critical-infrastructure, financial and public-sector requirements can vary substantially between jurisdictions and free zones.

Explore country requirements

60 countries / areas

Africa

There is no single Africa-wide personal-data transfer rule. National requirements, local authorities and regulated sectors need separate review.

Explore country requirements

29 countries / areas

Oceania & the Pacific

Australia, New Zealand and Pacific jurisdictions have distinct privacy requirements; remote access may be relevant even without copying a database.

Explore country requirements

1 countries / areas

Antarctica and special jurisdictions

Territory administration, responsible entities, research rules and applicable national law must be individually confirmed.

Explore country requirements

Country & territory lookup

Select where the project or data is based.

Browse 248 countries and areas from UN M49. Region names are navigation aids, not legal equivalence groups or a list of approved delivery locations.

Showing 30 of 248 matching countries or areas

Select a jurisdiction

Choose a country or territory to see region-aware review questions, any verified official regulatory sources, and a safe project-inquiry path.

Country selection does not confirm availability, data residency, legal compliance, or permission to run security tests.

Questions for every project-specific security review

Data inventory

What categories of personal, confidential or regulated information would we receive? Can the work be performed with synthetic data or client-controlled test environments?

Roles and agreements

Is the client acting as controller, processor, or another role under the laws that apply? Determine whether an appropriate data processing agreement or other terms are necessary. No DPA is represented as already executed.

Data location and service providers

Where will the work environment, backups, logs, email and subcontractors process information? Actual providers and locations must be documented and approved before sensitive access. No country-specific data residency is promised.

International transfers

If personal data will cross borders, identify applicable laws for all relevant jurisdictions, exporter/importer roles, location, transfer mechanism and any supplementary measures. EU SCCs, UK IDTA/Addendum or other national instruments are not automatically available for every transfer.

Access and confidentiality

Agree named users, MFA where appropriate, least privilege, secure transfer channel, incident-notification contacts and whether subcontractors require preapproval.

Retention and return

Record what can be retained, for how long, and who authorizes deletion or return. Statutory and business-record obligations may limit deletion.

Security assessment rules

Testing is limited to assets and techniques authorized in writing, with local law, sanctions, export controls and sector procurement requirements reviewed before engagement. Do not send secrets, production dumps or private records to an unverified intake channel.

What is and isn't currently asserted

Publicly documented

Website privacy practices, published engineering evidence, the vendor-readiness checklist and a process for negotiating project-specific access and security requirements.

Requires confirmation

Signed DPA and transfer clauses, actual subprocessors, exact regional storage, retention schedule, incident-notification obligations, insurance documents and any external certification. None is automatically included by visiting this page.

Global reference sources

These are starting points. Use the selector above for verified jurisdiction-specific regulatory references where available; other countries require separate local-law verification. Links are not compliance or legal advice.

United Nations Statistics Division — M49 countries and areas
Geographic classification used for the country selector. Inclusion is not a claim about political status or legal jurisdiction.
European Commission — Standard Contractual Clauses
EU model contractual safeguards for applicable data transfers; case-specific review required.
UK Information Commissioner's Office — IDTA and Addendum
UK guidance for relevant restricted international transfers.

For a proposed engagement, send a non-sensitive overview of the data categories and requirements to info@demonicbinary.com. We can determine which documents and controls need to be reviewed before agreeing to receive data.