Five checks on UK email data transfers to the EU after Brexit

What to take away

Why UK to EU email data transfers need checking after Brexit

Before Brexit, a campaign sent from Manchester to a list in Germany was an internal EU flow. One rulebook, one supervisory structure, no border in the data path. That is no longer true, even though the practical difference is smaller than the headlines suggested.

Every campaign moves personal data. An email address is personal data. So is an open event, a click, a bounce, an unsubscribe timestamp and an IP address captured at signup.

When that data leaves the United Kingdom for a platform, a marketing automation tool, a CDN or an analytics warehouse in the EU, it is an international transfer under UK GDPR retained text, and it needs a lawful mechanism.

The United Kingdom left with a working adequacy arrangement in place, which is why most day to day sending carries on unchanged. Adequacy is a finding by the UK government that another country provides an adequate level of protection, which removes the need for a separate safeguard for transfers to that country.

The EU adopted its own adequacy decision for the UK, so the arrangement runs both ways. Campaign data moving between the United Kingdom and EU sits inside a framework both sides recognise, while the decisions stand. It is reviewed periodically and can be withdrawn, so it belongs on a checklist rather than in an assumption.

There is a second reason to check. Email data does not sit still. A platform may route a send through Ireland, store logs in the Netherlands and pass engagement data to a subprocessor in the United States. Each hop is a transfer, and each needs a lawful basis.

Drawing the email data path before configuring the tool is the cheapest way to see the hops.

Policy has been moving too. The Department for Science, Innovation and Technology sets the direction for UK data protection and digital policy, and its work shapes how adequacy, transfers and reform develop.

Read the Department for Science, Innovation and Technology - GOV.UK pages when you need the current policy position rather than a blog summary of it.

The five checks below are the ones that catch most problems for UK senders with EU recipients. They are ordered from the legal mechanism down to the inbox.

Check one: is the transfer covered by UK adequacy or a safeguard

Start with the destination, not the platform. If the personal data is going to an organisation established in the EU or the EEA, UK adequacy covers the transfer and you do not need standard contractual clauses for that leg.

If it is going to a UK entity that then sends onward to a non-adequate country, adequacy does not cover the onward leg.

The ICO's International transfers | ICO guidance sets out the rules on transferring email data from the UK to the EU and beyond, including the role of adequacy and the safeguards available when it does not apply. Work through it destination by destination rather than reading it once.

Adequacy is not the only route. The alternatives are an adequacy regulation, a set of standard contractual clauses, binding corporate rules for a group, an approved code or certification, or a specific derogation such as explicit consent for a one-off transfer. For routine campaign data, standard contractual clauses or binding corporate rules do the work.

Watch the direction of travel. Adequacy decisions are reviewed, and a change would not stop your sending overnight but would require a safeguard to be in place. Firms with large EU lists should hold a signed set of clauses ready rather than scramble later.

Write the answer down for each flow. One line per destination is enough:

That list is the core of an accountability record, and it takes an afternoon for most senders.

Check two: standard contractual clauses and the transfer risk assessment

Standard contractual clauses are pre-approved contract terms that bind the exporter and importer to protect the data. The UK has its own version, sometimes called the International Data Transfer Agreement, and an addendum that adapts the EU clauses for UK use. Either can work. The mistake is signing one and never reading it.

The clauses require more than a signature. They require a transfer risk assessment: a documented look at the law and practice of the destination country, the sensitivity of the data, and whether the safeguards in the contract actually hold in practice. For email marketing data, the assessment is usually short, but it must exist and it must be specific.

The ICO's A brief guide to international transfers | ICO walks through the mechanisms and safeguards, including what a transfer risk assessment should cover. Use it as the template for your own document rather than inventing a structure.

Keep the assessment proportionate. A newsletter list of business addresses in Ireland is a low-risk flow. A list of health-related signups sent to a platform with a support team in a country without equivalent protections is not. The assessment should say which one you have and why the conclusion follows.

The clauses also govern onward transfers. If your platform passes data to a subprocessor, the contract must require the platform to flow the same protections down. Ask for the subprocessor list and check that it is current, because it changes more often than the main contract does.

A worked example

A Bristol retailer sends a weekly campaign to 40,000 subscribers, of whom 9,000 are in the EU. The platform is UK-registered, hosts in Ireland and uses a support contractor in India with access to ticket data.

That is a complete answer for a flow of this size, and it fits on two pages.

Check three: where the email platform and its subprocessors sit

The platform's registered address tells you very little. What matters is where the data is stored, where it is processed, where backups sit and which third parties can reach it. A UK limited company can run entirely on infrastructure in another region.

Ask for a data processing agreement, a subprocessor list and a hosting map. The map should name regions, not countries alone, because a European region may still route support traffic elsewhere. Due diligence on an email supplier should include these documents before a contract is signed, not after the first campaign.

Where an email platform sits between the United Kingdom and EU determines which safeguards apply, so the hosting map is the document to read first. A Dublin data centre and a London one produce different answers even for the same supplier.

Check the support model. A platform with 24 hour chat staffed from a non-adequate country creates a transfer whenever an agent opens a ticket containing subscriber data. That flow needs a safeguard and a risk assessment like any other, and it is the one most often missed.

Check the analytics layer. Open and click tracking often feeds a separate product, sometimes a separate company, sometimes in a different region. If the tracking domain resolves outside the EU, the engagement data is crossing a border on every send.

Check what happens on exit. Export files, deletion certificates and backup retention all involve transfers. The contract areas to review before signing should cover deletion timelines and the format of any export, because a migration is a transfer event.

Finally, check whether the platform's own contracts are current. Clauses are updated, subprocessors change and certifications lapse. A supplier that cannot produce a signed, dated set of clauses on request is a supplier that has not done the work.

Check four: consent records and recipient location data

The transfer mechanism assumes the processing was lawful to begin with. For email marketing, that means a lawful basis, usually consent, and a record of it. Consent under the retained text has to be freely given, specific, informed and unambiguous, and it has to be demonstrable.

The retained UK GDPR text on consent and transfers is set out in Regulation (EU) 2016/679 (UK GDPR retained version), which is the version to cite when you are writing a record. Read the consent conditions and the transfer chapter together, because they answer different halves of the same question.

Recipient location data is the other half. You cannot say which transfers occur unless you know where recipients are. Country is often inferred from an IP address at signup, which is imperfect, or from a billing address, which may be a work address. Record the method and the confidence level.

Segmentation matters here. If your list includes recipients in the EU, in the United Kingdom and elsewhere, the transfer position differs by segment. A single privacy notice covering all of them is usually too vague to be useful in a record.

Data sharing with partners, list co-registration or a joint campaign adds another layer. The ICO's Data sharing | ICO guidance covers the arrangements needed when two organisations share personal data, which is what co-registration is. Get the roles clear before the data moves.

PECR sits alongside all of this. It governs electronic marketing to individuals, and it applies regardless of where the recipient lives, so a sender in the United Kingdom emailing EU recipients still works within the UK rules on consent and soft opt-in.

The UK rules that touch an email campaign from lawful basis to accessibility are worth mapping against your consent flow once a year.

Check five: deliverability effects of routing and filtering across borders

Now the inbox. Cross-border routing changes deliverability in ways that are easy to miss because the dashboard looks the same.

Sending infrastructure location affects reputation. A new IP range in a region with no sending history starts cold, and mailbox providers weight reputation partly by the infrastructure the mail arrives from. Moving a sending domain to an EU region can reset some of that history if the platform does not carry the reputation across.

Routing between the United Kingdom and EU also shifts which filtering rules apply. A message that leaves a London relay and lands in a Frankfurt mailbox passes through two sets of reputation and content signals, and each weighs the sender differently.

Authentication alignment is the next risk. SPF, DKIM and DMARC must line up with the domain in the visible From header. If a platform routes through a regional relay with a different envelope domain, alignment can break and the message lands in spam or is rejected outright.

Filtering differs by market. Mailbox providers in Germany, France and the Netherlands apply their own reputation and content signals, and local blocklists matter more than global ones. A campaign that performs well in the UK can underperform in the EU without any change to the content.

Engagement signals travel with the recipient, not the sender. If EU recipients engage less because of a language mismatch or a sending time tuned to London, the platform's routing decisions may shift that segment to a lower quality path. Watch the segment, not the account average.

Use the free reputation tools. Google Postmaster Tools gives domain and IP reputation data with a geographic breakdown, and Microsoft SNDS shows complaint and filter rates for Microsoft domains. Both are free and both are more reliable than a platform's own deliverability score.

Check the unsubscribe and preference centre path too. If it resolves to a server outside the EU, every unsubscribe is a transfer, and a slow or blocked page generates complaints that damage reputation.

A short routing check

Documenting the five checks for an accountability record

Accountability means being able to show what you did and why. For most UK senders, one document with five sections is enough, provided it is current.

Review triggers matter more than review dates. Update the record when a subprocessor changes, when a region moves, when a new market is added, when clauses are reissued or when adequacy is reviewed. Accountability and governance is mostly a habit of noticing those events.

Keep it short enough to be read. A two page record that is accurate beats a forty page file nobody opens. Attach the evidence, sign and date the summary, and store it where the marketing team can find it without asking legal.

One person should own it. In most small teams that is the marketing lead, with legal review at contract renewal. The owner's job is to notice change, not to rewrite the document every quarter.

Common questions