Northern Ireland cross-border social selling under UK GDPR and EU GDPR

What to take away

The dual data protection regimes in Northern Ireland explained

Northern Ireland sits inside the United Kingdom and inside the EU single market for goods. Those two facts pull its data protection position in opposite directions.

Domestically, the UK GDPR applies, as it does in England, Scotland and Wales. The Data Protection Act 2018 supplies the statutory framework, and the Information Commissioner's Office enforces it across the whole of the UK, including Belfast, Derry and Newry.

For Republic of Ireland prospects, the EU GDPR applies to your processing. A social seller in Belfast messaging a marketing director in Dublin is handling data that the EU regime governs.

The two texts began life identical. They have since diverged. The UK has been reforming its version, most visibly through the Data (Use and Access) Act 2025, which adjusts parts of UK data law. Treat them as sibling regimes, not the same regime.

In practice this means one LinkedIn campaign can generate records governed by two rulebooks. Your CRM does not care. Your compliance file should.

Why the border makes this unusual

The land border is not a data border. Personal data moves between Belfast and Dublin as easily as it moves between Belfast and Bangor.

What changes is the regulator, the legal basis you can rely on, and the remedies available to the person whose data you hold. A prospect in Donegal can complain to the Irish Data Protection Commission. A prospect in Fermanagh complains to the ICO.

Most Northern Ireland businesses sell into both. That is the whole point of the market.

What the ICO expects of a Northern Ireland seller

The ICO regulates you if your processing falls under UK GDPR, whatever your size. Its guidance is written for organisations of every scale, and it applies to a two-person consultancy in Armagh as much as to a utility in Belfast.

Registration and the data protection fee apply unless you are exempt. Most businesses that market to prospects are not exempt.

UK GDPR and EU GDPR: where each applies to cross-border selling

The test is not where you are. It is whose data you are processing and why.

UK GDPR applies when you process personal data in the context of an establishment in the UK, or when you offer goods or services to people in the UK. A Newry agency targeting Belfast buyers is squarely inside it.

EU GDPR applies when you offer goods or services to people in the EU, or monitor their behaviour, regardless of where you sit. A Belfast seller running paid social ads aimed at consumers in Cork is offering services in the EU.

For business-to-business social selling, the trigger is usually the prospect's location, not their job title. Work email addresses and work profiles are still personal data.

When both regimes bite at once

Dual application is the normal case for cross-border sellers, not the exception. You hold one list, and part of it is EU data.

The practical answer is to apply the stricter standard across the whole list where the cost is low. Consent records, objection handling and retention periods are cheap to standardise.

Where the regimes genuinely differ, split your list. Tag records by jurisdiction so you know which rulebook governs a deletion request.

The establishment question

Having staff or a registered office in Northern Ireland makes you UK-established. Selling into the Republic does not make you EU-established, but it can still bring you within EU GDPR's territorial scope.

If you have no EU establishment, you may need an EU representative for the EU-facing processing. Many small sellers overlook this until a complaint arrives.

International transfers and ICO guidance for Northern Ireland sellers

Here is the relief. Sending personal data from Northern Ireland to the Republic of Ireland is not a restricted international transfer under UK GDPR, because Ireland is in the EEA.

Sending it the other way is equally unrestricted. The border is a customs and regulatory boundary, not a data transfer boundary.

The difficulty sits behind that. Your CRM vendor may host in the United States. Your agency may sit in Manchester with a support team in Manila. Your group parent may be in Frankfurt with servers in Singapore.

Each of those is a restricted transfer, and each needs a lawful transfer mechanism. The ICO's international transfers guidance sets out the mechanisms available and the transfer risk assessment the ICO expects.

That guidance is also the practical starting point for EU-facing transfers, because the mechanisms overlap heavily even where the paperwork differs.

Transfer mechanisms you can actually use

Vendors are the usual weak point

Most small sellers never transfer data themselves. Their tools do it for them.

Ask each vendor where data is stored, where support staff sit, and which sub-processors they use. Get the answer in writing before you sign.

If a vendor cannot answer, that is your answer. This is the same discipline covered in selecting a B2B social selling supplier, where legal identity and data terms belong in the decision record.

Market access and compliance when trading across the border

Market access for services is not the same as market access for goods. Selling social media management or consulting into the Republic does not require a customs declaration.

What it does require is a contracting position. Decide whether you contract with the Irish client directly or through an Irish entity, because that choice determines who is the controller.

Tax follows the same logic. VAT registration, place of supply rules and reverse charges for cross-border B2B services are HMRC and Irish Revenue questions, not data protection questions, but they arrive in the same conversation.

Advertising claims are a separate regime again. The CAP Code, UK GDPR and PECR apply to how you promote and contact prospects in the UK, and the Irish equivalent applies to Irish audiences.

What changes when you cross the border

Contract terms, governing law and jurisdiction clauses need to name the right country. A Belfast standard terms document is not automatically suitable for a Dublin client.

Complaints routes differ. An Irish client unhappy about marketing contact goes to the Irish Data Protection Commission, not the ICO.

Currency, invoicing and payment terms change. None of that is data protection, and all of it affects whether the engagement survives.

Prove the reason to engage before you prospect

Market access is not permission to message. You still need a reason to contact a specific person, and a record of it.

That discipline matters more across the border, where the applicable regime may not be obvious from the prospect's profile. Start with before entering B2B social selling and prove the reason to engage each account.

Personal data, lawful basis and prospect rights under both regimes

A work email address, a job title and a LinkedIn profile URL together identify a person. That is personal data under both regimes.

So is a note in your CRM saying a prospect seemed interested in a demo. So is a screenshot of a conversation.

You need a lawful basis before you process any of it. The ICO's guide to lawful basis explains the six options and how to choose between them.

For cold B2B social selling, legitimate interests is the usual choice. It requires a legitimate interest, a necessity test and a balancing exercise against the prospect's rights.

Consent is rarely the right basis for cold outreach, because it is hard to obtain and easy to withdraw. Where you rely on it, you must be able to prove it.

Prospect rights you must be able to honour

The ICO's guide to individual rights covers the rights that apply to the prospect records in your CRM.

Access matters most in practice. A prospect can ask what you hold, where it came from and who you shared it with.

Objection matters next. If a prospect objects to direct marketing, you must stop. There is no balancing test left to run.

Erasure, rectification and portability all appear in cross-border lists, usually because a record was tagged with the wrong jurisdiction.

Keeping the two regimes straight in one CRM

Tag every record with the jurisdiction that governs it. A single field is enough.

Apply the shorter retention period where the two regimes differ. It is simpler than maintaining two deletion schedules.

Keep your privacy notice in two versions if you sell into both markets, and link the right one from the right channel.

Breach reporting duties across two regimes

A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data. A prospect list emailed to the wrong recipient counts.

Under UK GDPR you must report a reportable breach to the ICO within 72 hours of becoming aware of it, where it risks people's rights and freedoms. You must also tell the affected individuals without undue delay where the risk is high.

Under EU GDPR the same 72-hour clock runs, but the notification goes to the Irish Data Protection Commission for EU-affected data, or to the lead supervisory authority in the relevant member state.

If a breach touches both UK and EU records, you may be notifying two regulators about one incident. Prepare for that before it happens.

The 72-hour clock in practice

Where breaches usually start

Most cross-border breaches in social selling come from the same few places. A shared spreadsheet with open link access. A departing employee taking a contact list. A vendor misconfiguration that exposes lead forms.

None of these are exotic. All of them are preventable with access controls and a leavers process.

A cross-border compliance checklist for Northern Ireland social sellers

Work through this before your next campaign, and again when a vendor or a market changes.

One more step sits outside the list. Train the people who run the accounts. A compliant process that nobody follows is a documented liability.

If your team sends private messages as part of outreach, remember that private social messages count as electronic mail under UK electronic marketing rules, which brings PECR into the same conversation as data protection. The wider groundwork is in data protection for B2B social selling, which maps the same issues from source to objection.

Common questions