Post-Brexit data transfers for UK customer data platform buyers

What to take away

What changed for UK transfers after Brexit

On 1 January 2021 the UK left the EU data protection framework. UK GDPR replaced EU GDPR as the operative law, and the Information Commissioner's Office became the UK's standalone supervisory authority.

The ICO publishes the post-Brexit rules for transferring UK personal data to third countries, and those rules are what a CDP contract must satisfy.

The practical change for buyers is that an EU vendor is now a third-country vendor. Before Brexit, a London retailer sending customer records to a Paris CDP was an intra-EU transfer. Now it is an international transfer, and it needs its own lawful mechanism. The data does not move differently. The legal basis does.

The UK also kept its own adequacy regime. The Secretary of State, not the European Commission, decides which countries are adequate for UK exports. That matters for UK customer data platform buyers because a vendor's EU-facing paperwork may assume Commission adequacy decisions that do not bind the UK.

Parliament has since passed the Data (Use and Access) Act 2025, which adjusts parts of the UK regime. The Act changes some definitions and processes, but it does not remove the need for a transfer mechanism. Procurement teams should read it as an amendment, not a repeal.

Policy responsibility sits with the Department for Science, Innovation and Technology, which sponsors digital and data policy. When adequacy decisions are reviewed or new ones are proposed, that department is the source to watch, not vendor marketing pages.

UK adequacy decisions and the destinations they cover

A UK adequacy decision is a formal finding that a country or territory provides an adequate level of data protection. When one is in force, UK organisations can send personal data there without an international data transfer agreement or extra safeguards. The decision does the work.

The EEA states, which are the EU member states plus Iceland, Liechtenstein and Norway, have been covered by UK adequacy decisions since 2021. So have Canada, Japan, New Zealand, South Korea and Switzerland, among others.

Adequacy is not a permanent status. The Secretary of State can amend or revoke a decision, and the EU's own decisions have been struck down before. A CDP vendor that stores UK customer data in a destination covered today may be outside cover in three years. Contracts should say what happens then.

For buyers, the first question is where the data physically sits. A vendor with EU primary hosting and a US sub-processor is running two transfer routes, not one. The EEA leg may rely on adequacy. The US leg may rely on the Data Privacy Framework extension, which requires the importer to be certified. Check the certification, not the claim.

Adequacy decisions do not cover onward transfers by themselves. If an EU-hosted CDP sends UK data to a support team in a non-adequate country, that onward transfer needs its own basis. Ask for the sub-processor list and the destination of each one. This is one of the contract areas to read before signature.

International data transfer agreements and the IDTA addendum

The international data transfer agreement is the ICO's standalone contractual tool for UK exports to non-adequate countries. It is a template, published under section 119A of the Data Protection Act 2018, and it binds the exporter and importer to a set of data protection obligations. It is not the EU's standard contractual clauses with a new cover page.

The IDTA addendum is the alternative. It takes the EU standard contractual clauses and adds the UK-specific parts, so a group already using EU SCCs can extend them to UK data without running two separate agreements. For an EU-based CDP vendor, the addendum is usually the easier route because the vendor's EU contracts already use the SCCs.

Both tools require a transfer risk assessment before use. The agreement is the mechanism. The assessment is the evidence that the mechanism is appropriate for the specific transfer. Signing an IDTA without the assessment leaves the paper trail incomplete.

Watch the signature blocks. The IDTA has a complex party structure for multi-party flows, and CDP vendors often sign as importer while a sub-processor actually hosts the data. If the sub-processor is not a party, the onward transfer may be uncovered. The addendum handles this more cleanly by docking the UK addendum onto the existing SCC chain.

Do not accept a vendor's own bespoke transfer clause as a substitute. The ICO approves the IDTA and the addendum. A vendor-drafted clause has no approval, and relying on it puts the transfer risk on your organisation. If the vendor refuses the IDTA or the addendum, treat that as a red flag in the vendor due diligence file.

EU vendor clauses to verify before signing a CDP contract

EU vendor clauses are the contractual terms in the main services agreement and data processing agreement that describe how the vendor handles transfers. They are where most UK CDP deals go wrong, because the commercial team reads the pricing schedule and the governance team reads the DPA, often weeks apart.

Start with the governing law and jurisdiction clause. An EU vendor will usually propose its home courts. That is workable, but the transfer mechanism must still be UK-valid. A German court applying German law to a UK export does not cure a missing IDTA.

Next, the data processing agreement. Check the subject matter, duration, nature and purpose of processing, the categories of data and data subjects, and the controller's instructions. The ICO explains the controller and processor roles in CDP vendor and buyer relationships, and the DPA should reflect that allocation.

Then the sub-processor clause. It should list current sub-processors, give notice of changes, and give you a right to object. A blanket authorisation with no notice period is a transfer risk you cannot monitor. Ask for the list in writing before signature, not after onboarding.

Check the audit and assistance clauses. The vendor should assist with data subject requests, breach notification and any transfer risk assessment you must document. If assistance is chargeable at day rates, budget for it. If it is capped at a number of hours, note the cap.

Finally, the termination and data return clause. When the contract ends, where does the customer data go, and under what transfer mechanism does it come back? A vendor that deletes data in an EU data centre on termination has still performed an international transfer during the contract. The exit plan is part of the transfer plan.

Transfer risk assessments and the controller-processor split

A transfer risk assessment is the documented evaluation of whether the imported data will receive an adequate level of protection in the destination country. It considers the transfer's circumstances, the destination's laws, and any safeguards in the contract. The ICO expects it to be proportionate, not exhaustive.

The controller-processor split decides who does it. Under UK GDPR, the controller determines the purposes and means of processing. The processor acts on the controller's instructions. In a CDP deal, the UK buyer is usually the controller and the EU vendor is the processor, so the buyer owns the transfer risk assessment.

That allocation surprises procurement teams. They assume the vendor's compliance team has covered it. The vendor can supply input, such as sub-processor details and security certifications, but the assessment is the controller's responsibility. The processor cannot make the decision for you.

Map the data flow before writing the assessment. Which fields leave the UK, which systems hold them, which sub-processors touch them, and which countries are involved. A CDP typically ingests email, purchase history, loyalty data and web behaviour. Each category may have a different sensitivity and a different destination.

Then assess the destination's legal framework. Does it have independent oversight, redress for data subjects, and limits on government access? For most commercial CDP data the risk is moderate, but the reasoning must be written down. A one-page assessment with clear sources is better than a template with no analysis.

Review the assessment annually and when the vendor changes sub-processors or hosting regions. Transfers are not static. A vendor that moves primary hosting from Ireland to another region has changed the transfer, and the assessment should change with it. This is where UK regimes touch the CDP lifecycle, and where ownership must be named.

A pre-signature checklist for UK customer data platform buyers

Use this checklist before the contract goes to signature. Each item should have a named owner and a document in the deal file. If an item cannot be evidenced, the deal is not ready.

Work through the steps in order. The sequence matters because each step narrows the next.

A worked example makes the point. A Manchester retailer buys a CDP from a vendor headquartered in the Netherlands, with hosting in Ireland and a support team in the Philippines.

Ireland is covered by a UK adequacy decision, so no IDTA is needed for hosting. The Philippines is not, so the support access needs an IDTA or IDTA addendum plus a transfer risk assessment. The Dutch head office access is covered by EEA adequacy. Three destinations, two mechanisms, one assessment covering the Philippines leg.

The retailer's procurement team should also check whether the vendor's EU-facing clauses conflict with the UK position. If the DPA names the EU standard contractual clauses as the only transfer mechanism, the UK leg is uncovered until the addendum is signed. Ask for both.

Keep the file after signature. Adequacy decisions change, sub-processors change, and the ICO can ask for your assessment. A deal file with the IDTA, the assessment and the sub-processor list is the evidence that the transfer was lawful when it was made.

Common questions