Cross-border funnel data transfers UK Ireland: a guide

What to take away

Where UK adequacy ends and standard contractual clauses begin

The European Commission adopted adequacy decisions for the UK in June 2021. They allow personal data to flow from the EU and EEA to the UK without extra safeguards. That covers most routine lead capture: an Irish visitor fills in a form, the data lands in a UK CRM, and no separate transfer tool is needed.

Adequacy is not permanent. The decisions include a sunset clause, originally four years, and the Commission reviews them. If the EU withdraws adequacy, UK firms would need standard contractual clauses or another transfer mechanism overnight. Larger agencies should keep a fallback clause library ready rather than assume adequacy lasts.

Standard contractual clauses are the main alternative. The EU adopted updated SCCs in 2021 under the GDPR. The UK has its own International Data Transfer Agreement and an addendum that bolts UK terms onto the EU SCCs. For a UK firm receiving EU data, the relevant question is which mechanism the exporter uses.

A transfer risk assessment sits behind the clauses. The exporter must check whether the destination country offers essentially equivalent protection. For UK-to-EU flows, the UK is not the risk; the risk runs the other way. For UK firms sending data onward to the US or India, the assessment matters.

Adequacy also does not cover every processing activity. It covers transfers to the UK, not transfers from the UK to a third country. A UK agency using a US email platform is making a UK-to-US transfer and needs its own mechanism.

ICO international transfers guidance applied to one lead form

The ICO international transfers guidance sets out the rules for moving personal data out of the UK. It applies to any transfer to a country without UK adequacy regulations. The EU and EEA have UK adequacy, so most Ireland-bound flows are covered. The guidance matters when data goes further afield.

Take one lead form on a UK landing page aimed at Irish buyers. The form collects name, email, company and a free-text need. The data goes to a UK CRM, then to a US marketing automation tool, then to a Dublin sales team. That is two transfers: UK to US, and UK to Ireland.

The UK to Ireland leg is covered by UK adequacy regulations for the EEA. The UK to US leg is not. It needs an IDTA or the UK addendum to the EU SCCs, plus a transfer risk assessment. The ICO expects a documented record of both.

A landing page that loads a US-hosted script before consent is making a transfer on page load, not on form submit. That is a common gap. Use map the page event to trace what fires before the visitor agrees.

Consent differences between UK GDPR and EU GDPR for lead capture

The retained UK GDPR text sits in UK law through the Data Protection Act 2018. It mirrors the EU GDPR closely, but not exactly. In Ireland, the EU GDPR applies alongside the Irish Data Protection Act 2018, and the Data Protection Commission (DPC) is the supervisory authority. Consent must be freely given, specific, informed and unambiguous under both. The differences show up in email marketing and cookie rules.

PECR governs UK electronic marketing. It allows a soft opt-in for existing customers where the sender obtained details in a sale and offers an opt-out. Ireland's ePrivacy rules are set out in the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336/2011). A UK firm mailing Irish prospects cannot rely on the UK soft opt-in; check the Irish rules before sending.

The ICO consent guidance sets a high bar: no pre-ticked boxes, no bundled consent, and withdrawal as easy as giving consent. The EU GDPR adds the same standard, but some supervisory authorities expect a separate consent record per purpose. That is where one row per purpose helps.

Cookie consent differs too. PECR requires consent for non-essential cookies in the UK, and the EU ePrivacy Directive does the same. The UK has signalled a move toward opt-out models, but as of 2026 consent remains the baseline. Do not assume UK cookie rules apply to Irish visitors.

For lead capture, the practical split is this: UK visitors can be emailed under soft opt-in if they are customers; Irish visitors generally need prior opt-in. Segment your list by country and keep the lawful basis on record. See PECR and subscriptions for the UK side.

Irish VAT and selling funnel software into Ireland

Irish VAT applies when you sell funnel software or services to Irish customers. The place of supply for B2C digital services is where the customer is located. A UK firm selling to an Irish consumer charges Irish VAT at the standard rate, currently 23 per cent.

For B2B sales, the reverse charge applies. The Irish business accounts for VAT itself, and you invoice without VAT, quoting the customer's VAT number. You must validate that number through VIES before treating the sale as B2B.

The EU's One Stop Shop lets you file a single VAT return for all EU B2C sales. The UK is not in the EU, so a UK firm can use the non-Union OSS scheme to declare Irish VAT without a domestic Irish VAT registration. Register through the OSS portal of the chosen Member State of identification; if you choose Ireland, the Irish Revenue Commissioners handle OSS registration and returns through Revenue Online Service (ROS).

Thresholds matter. The EU removed the EUR 10,000 cross-border threshold for digital services, so Irish VAT applies from the first sale to an Irish consumer. Register for OSS or Irish VAT before you invoice.

HMRC guidance on buying and selling outside Great Britain covers the customs and tax basics. VAT on services is separate from goods, but the same principle applies: know the customer's location and status before you price.

Buying and selling outside Great Britain after Brexit

Brexit changed how UK firms trade with Ireland and the EU. Goods face customs declarations, rules of origin and import VAT. Services, including funnel software, are simpler but still need VAT and data checks. The GOV.UK page on buying and selling outside Great Britain is the starting point.

For software sold as a service, there are no customs duties. The main issues are VAT, data transfers and contract law. If you have no EU establishment but offer goods or services to people in the EU or monitor their behaviour there, GDPR Article 27 generally requires you to appoint an EU representative. The exception is for occasional processing that is unlikely to risk people's rights and does not include large-scale processing of special-category or criminal-offence data; where required, appoint a representative in a Member State where the affected people are located.

Companies House registration is not required to sell into Ireland, but Irish buyers often check your legal status. A UK limited company is fine. Some public sector buyers in Ireland ask for an EU VAT number, which you can obtain through OSS registration.

Contracts should name the governing law and jurisdiction. Irish buyers may prefer Irish law. That is workable, but it changes enforcement. Get advice before signing away UK jurisdiction.

A supplier that cannot show a legal party to proven exit creates risk for Irish buyers. Due diligence on your own stack matters as much as on theirs.

A cross-border funnel data transfers checklist

Use this checklist before launching a funnel that collects Irish or EU leads from the UK.

Common questions