Can I work remotely from Europe?

[northernladuk]

More seriously, the client does not need to know any of that. If the contracts are legit (Client Ltd. contracted with UK-based Contractor Ltd) and you're able to meet the demands of the contract - which may involve meetings in the UK at the client's site - then the place where you lay your head down each night is, quite frankly, none of the client's concern.

It's tempting to call this utter BS, which it is if taken on face value as a glib comment but if you read between the lines and consider a host of things you didn't put you could actually be correct. The way you've phrased it isn't great but you could be correct.

Are you considering the clients privacy, data and security policies which you also have to sign as part of the 'demands of the contract' or are you just talking about the contract for work and nothing else?

If you get all the paperwork from a client including contract and other policies that apply to all, have read, understood and can comply with it and none of that mentioned restrictions about working abroad then yes, you are right, you don't have to tell them.

Problem is you've skipped over the problem bits in one simplistic comment 'meet the demands of the contract'. If you'd put 'demands of the contract and the other clients policies then it's none of the clients concern then you would be absolutely correct... and to be honest that's what people have been saying already. If the client allows their data to go offshore then fill your boots and there is no need to tell them.

If the client has clauses about not accessing data from outside the UK then you are dead in the water. To work abroad if they have these policies in you will have to lie to them, make a false statement and then hide the truth from them by technology breaching mulitple clauses along the way which is very bad and I am assuming you aren't suggesting they do this.

Unfortuantely you did go on to say

You're aware that I could be based in (say) Spain, connect to a Virtual Machine located in the UK and from there, access data that is also located in the UK and which might have to remain resident in the UK?

All else being equal (i.e. assuming I actually have legitimate access to the data, am using it for legitimate business reasons and don't transfer it off the UK-based VM etc.) then no laws/regulations around data-residency or access have been broken.

If the client won't allow data to be accessed or stored off shore then you are breaching multiple clauses and potentially laws doing this and it's a pretty stupid thing to do. Clients aren't daft and associated with the offshore stuff will be notes on using VPNs, VM's and other technical ways to breach their policies. Yes technically it might be possible as you say but a decent client will have all the eventualities covered to protect their data and a simple VM won't cut it.
I don't know much about Security but I'm finding it hard to believe that this setup will even work in this day and age.

[northernladuk]

It's clear you've never worked in any industry where security, GDPR or PID is important. In the medical industry there are laws which govern data, where it can be stored and how it can be accessed. Not disclosing where you are connecting from is something that would not be treated well.
It's also relevant in B2C businesses, but the penalties are less severe.

I think it's much more far reaching than that. Public sector won't allow working outside the UK without a host of approvals. Critical areas of utility companies won't. Rather bizarrely at least one global pharma has restrictions but I think that's highly dependant on the area you work in (surprised me this one). All that is from direct experience and I'm pretty sure the NHS and most defense/security companies do so seriously reduces the number of clients that will allow this. And then there is a raft of clients that will allow it but keep a close eye on it and it needs to be disclosed, not quite permission in all cases, but disclosed.

[ladymuck]

Part of the problem is that during the initial phase of securing the work you won't see anything other than the agency contract (or client if you're direct) which, in my experience, say very little about the restrictions around accessing systems and data from non-UK locations. It's only once you start having to do the mandatory training beloved by many clients that you find out you're not supposed to.

So, you'd have to ask about such restrictions either at the interview stage or in the event you're offered the contract which will make it clear that you're intending to work from a non-UK location.