Rules and ethics
Post-Brexit transfers for a social media advertising agency
A practical guide for a Belfast social media advertising agency handling EU client data, UK adequacy, platform transfers and safeguards.
What to take away
- A paid social advertising agency in Belfast can rely on the UK's adequacy decisions when receiving EU personal data, but must document that reliance.
- Standard contractual clauses remain the fallback for transfers to non-adequate countries, and a transfer risk assessment is needed before using them.
- Platform data flows through Meta and Google require their own review, because campaign data often moves outside the UK and EU.
- Northern Ireland sits in a distinct position under the Windsor Framework, which affects how EU rules apply to goods and some data flows.
- A transfer documentation checklist keeps controllers and processors aligned, covering roles, clauses, assessments and records.
Paid social advertising agencies in Belfast handle these transfers. A Belfast social media advertising agency may upload audience lists, set pixel events and report on campaigns for EU clients. That work can move data through Meta and Google, so use the sections below to review client contracts, platform terms and transfer records.
What the UK adequacy position means for a Belfast agency
The UK has held adequacy decisions from the EU since 2021. Those decisions allow personal data to flow from the EU to the UK without extra safeguards. For a Belfast agency, that means EU clients can send campaign briefs, audience lists and measurement data to you without a new transfer mechanism.
The GDPR adequacy decision originally had a sunset date of 27 June 2025. The European Commission extended the UK adequacy decisions in June 2025 to 27 December 2025, then renewed them on 19 December 2025, so the current decisions run until 27 December 2031. Check their status when reviewing a client arrangement rather than treating adequacy as permanent. The UK GDPR and the Data Protection Act 2018 remain part of the UK framework for processing and transfers.
You should know which parts of that Act apply to your work.
The Data (Use and Access) Act 2025 updates UK data protection law, but it is not itself a transfer mechanism. Keep your records current and check the ICO’s international transfers guidance when you design a campaign involving data sent outside the UK.
The ICO’s guidance on international transfers explains when a UK restricted transfer occurs and which safeguards are available. For UK transfers relying on the IDTA or the UK Addendum to EU SCCs, use the ICO’s Transfer Risk Assessment (TRA) tool and record the outcome. For an EU GDPR transfer, apply the EU GDPR’s Chapter V requirements separately.
Adequacy covers government-to-government flows, not every platform. When you use Meta or Google, data may move to servers outside the UK and EU. That is a separate transfer question, and it needs its own answer.
Standard contractual clauses and the transfer risk assessment
EU GDPR transfers to a country without an adequacy decision may use the European Commission’s Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, where the relevant module fits the parties’ roles. Articles 44–49 of the EU GDPR govern these transfers; Article 46 covers appropriate safeguards. The UK IDTA and the formal International Data Transfer Addendum to the European Commission’s standard contractual clauses are UK tools for UK restricted transfers, not substitutes for EU SCCs if an EU-to-UK transfer loses adequacy. For a UK transfer to a non-adequate country, select the IDTA or, where appropriate, the UK Addendum alongside the EU SCCs.
A transfer risk assessment is the step before you rely on clauses. It asks what data is moving, where it goes, who can access it and what legal protections exist in the destination. The ICO's international transfers guidance sets out how to do this in practice.
For a Belfast agency, the assessment often covers audience uploads, conversion tracking and reporting dashboards. Each flow has a different risk profile. A hashed email list is not the same as a full CRM export.
Clauses do not fix a weak assessment. If the destination country’s laws or practices could undermine protection, consider supplementary measures such as encryption, pseudonymisation or limiting what you send. For EU transfers, the European Data Protection Board’s Recommendations 01/2020 on measures that supplement transfer tools describe steps for assessing and addressing that risk.
When you draft client contracts, align the clauses with your role. The contract clauses that decide who owns a paid social account and its evidence should name the transfer mechanism and the parties. That avoids a gap when a campaign ends.
Platform data flows when EU brands run campaigns through Meta and Google
Meta and Google operate global infrastructure. When an EU brand runs a campaign through your Belfast agency, data may pass through their systems in the US and other countries. Map the parties, destination countries and onward transfers before launch, then identify which transfer rules apply to each leg.
EU brand campaign data flow
- EU brand uploads customer list
- Belfast agency configures campaign
- Data passes through Meta/Google US systems
- Pixel sends event data to platform
- Reporting data returns to agency
Start with the platform terms. Meta Ads Manager and Google Ads have data processing terms that describe sub-processors and locations. Check the contracting platform entity, the terms that apply to the data you upload, and any onward-transfer mechanism. For a US recipient, verify whether that specific entity is currently certified under the EU-US Data Privacy Framework and, for UK transfers, the UK extension known as the UK-US Data Bridge; check that the certification covers the relevant data and service.
Pixel and tag data is another flow. A pixel on an EU brand’s site sends event data to the platform. If you set up that pixel from Belfast, you are part of the chain. Personal data is defined in Article 4(1) of the UK GDPR and Article 4(1) of the EU GDPR; assess the event data and identifiers under the rules that apply to the activity.
A platform’s role depends on the processing in question and the terms and facts of that activity; do not assume it is always a processor or always a controller. Document whether the brand, your agency or the platform determines the purposes and means for each use, including audience targeting and conversion reporting. Your contracts and transfer records should reflect those roles.
Mapping data protection across a paid social campaign, role by role, keeps these distinctions clear. It also helps when an EU client asks where their data goes. You can answer with a flow map rather than a guess.
Documenting transfers for controllers and processors
Your agency can be a controller, a processor or both. For EU clients, you may be a processor when running campaigns on their behalf, but the client relationship alone does not settle whether EU GDPR applies directly to your agency. Under Article 3(2) of the EU GDPR, it can apply to a non-EU agency if its processing relates to offering goods or services to people in the EU or monitoring their behaviour there.
If EU GDPR applies directly under Article 3(2), Article 27 generally requires an EU representative unless an exception applies, including where the processing is occasional, low-risk and does not involve large-scale special-category or criminal-offence data. The ICO’s Controllers and processors guidance explains how to distinguish those roles under UK data protection law. Put your role in writing; a client-contract schedule can name the data, purpose and duration.
Keep a record of each transfer, its destination, the mechanism used and any assessment outcome. Include relevant processing details in your records under Article 30 of the UK GDPR where that requirement applies. If you rely on adequacy, note the decision and the date you checked its status.
Vendor due diligence applies to your platform and tool suppliers. Check their transfer terms, sub-processor lists and security measures. If a supplier cannot explain where data goes, that is a risk you carry.
When you select tools, use privacy, security and exit gates to screen them. A tool that stores data in a non-adequate country needs clauses and an assessment. A tool that cannot export your data on exit creates a different problem.
Northern Ireland's position and the Windsor Framework context
The Windsor Framework governs arrangements for goods moving between Great Britain, Northern Ireland and the EU, and the application of specified EU rules in Northern Ireland. It does not create a separate general data-transfer mechanism for Belfast agencies.
For data protection purposes, a Belfast agency is subject to the UK GDPR and the Data Protection Act 2018. An EU-to-UK transfer is covered by the EU’s UK adequacy decision while that decision remains in force. The Windsor Framework does not replace that transfer analysis.
EU GDPR can also apply directly to a Belfast agency under Article 3(2) where the agency offers services to people in the EU or monitors their behaviour there. If it applies, consider the Article 27 representative requirement as well as the EU GDPR’s transfer rules. Do not infer that the Windsor Framework alone makes EU GDPR apply to every Belfast business.
The local agency scene is growing. Belfast agencies often serve clients in Dublin, London and mainland Europe. That mix means you need to handle both UK and EU expectations in one contract pack.
Be careful not to treat the UK as one uniform market. Scotland, Wales and England have their own procurement and sector patterns. Northern Ireland adds the Framework dimension. Your documentation should name the jurisdiction you are working in.
A transfer documentation checklist for EU client work
Use this checklist before you start a campaign for an EU brand. It keeps your files ready for a client audit or an ICO query.
- Identify the client, agency and platform entities, and record their controller or processor roles.
- Map each data set, purpose, destination, platform recipient and onward transfer, including audience uploads and pixel or tag events.
- Assess whether EU GDPR applies directly under Article 3(2), and whether an EU representative is required under Article 27.
- For EU-to-UK transfers, record the relevant UK adequacy decision and when you checked its status.
- For US platform recipients, verify the relevant entity’s EU-US Data Privacy Framework or UK-US Data Bridge certification and its scope.
- Where adequacy does not apply, select the correct EU SCCs or UK transfer tool for that transfer; do not use a UK IDTA as a safeguard for an EU-to-UK transfer.
- Complete the applicable EU transfer assessment or UK TRA, consider supplementary measures and file the contracts and evidence.
Transfer documentation checklist
- Confirm UK adequacy decision applies
- Identify every transfer, including platform flows
- Complete transfer risk assessment
- Choose EU, UK or both clauses
- Record controller or processor role
- Keep record of processing activities
- Check supplier terms and sub-processors
Use this five-step process to put the checklist into practice:
- Map the data. List every data set an EU client sends you, its purpose and every platform or other recipient it touches.
- Assign roles and scope. Record the controller or processor role for each activity, whether EU GDPR applies directly, and whether an EU representative is required.
- Pick the mechanism for each transfer. Use the EU-to-UK adequacy decision while it applies; for other transfers, use a mechanism recognised under the applicable EU or UK rules.
- Assess the risk. Complete the applicable EU transfer assessment or UK TRA, document the destination and safeguards, and add supplementary measures where needed.
- File the evidence. Store the assessment, clauses, platform terms and transfer records with the client contract.
A worked example helps. An EU retailer asks your Belfast agency to run a Meta campaign using a customer list. The EU-to-UK transfer to the agency is covered by the UK adequacy decision while it remains in force. Before the list or event data is sent to a US platform recipient, check the relevant entity’s EU-US Data Privacy Framework certification and, for any UK restricted transfer, its UK-US Data Bridge coverage. If an applicable adequacy mechanism does not cover a transfer, use the appropriate EU SCCs or UK transfer tool, complete the relevant assessment and record the flow before the ad goes live.
