Data checks when reviewing a Belfast web design agency

What to take away

Data checks when reviewing a Belfast web design agency

When reviewing a Belfast web design agency for an EU-facing project, check where personal data goes. A client in Newry selling into Dublin, or a Belfast agency running a shop for a Cork retailer, may involve personal data moving between the UK and the EU.

That does not make the work harder in principle. It makes the paperwork more specific. Since Brexit, the UK is a third country for EU data protection purposes, and the EU's decision on UK adequacy is what keeps ordinary transfers flowing without extra safeguards.

For a website design company, the practical question is where personal data actually goes. Contact forms, newsletter signups, order records, analytics and support tickets all generate personal data. Each one has a destination, and that destination decides the transfer position.

Northern Ireland agencies also handle a split market. Some clients trade only in Northern Ireland and Great Britain. Others sell into the Republic of Ireland and the wider EU. The two groups need different contract wording, even when the website build is identical.

For wider UK jurisdiction context, see the site's guide to mapping regulations by jurisdiction; this article focuses on personal-data routes in Belfast projects.

One more local factor: many Belfast agencies buy hosting, email and analytics from suppliers based in the United States or the EU. Those supplier choices are transfer decisions too, and they sit with the agency, not only with the client.

UK adequacy and the agency's fallback plan

UK adequacy is the EU's finding that the UK's data protection framework offers protection essentially equivalent to the EU's. It lets personal data move from the EU to the UK without a separate transfer tool such as standard contractual clauses.

The decision is Commission Implementing Decision (EU) 2021/1772 of 28 June 2021. It was adopted with a four-year sunset that took it to 27 June 2025, the Commission extended it in June 2025 to 27 December 2025, and it renewed the decision on 19 December 2025, so the current expiry is 27 December 2031.

The finding is time limited. It is reviewed, and it can be changed. A Belfast agency that builds its whole EU-facing process on adequacy alone is exposed if the position shifts, so the sensible approach is to hold a fallback mechanism in the contract from the start.

The fallback tools already exist. The ICO issued two UK tools under section 119A of the Data Protection Act 2018: the International Data Transfer Agreement (IDTA) and the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses. Both came into force on 21 March 2022.

If the EU decision were not renewed, an exporter in the EU would need the 2021 EU standard contractual clauses, Commission Implementing Decision (EU) 2021/914 of 4 June 2021. Module Two covers controller to processor transfers and Module Three covers processor to processor transfers.

The Addendum is built to sit alongside those clauses, so a Belfast agency can cover both directions in one contract. What to do now, while the decision stands: keep the destination record current, name the fallback tool in the contract, and revisit it if the Commission signals a change.

EU transfers in the other direction, from the UK to the EU, are treated as permitted under the UK's own adequacy regulations. That covers a Belfast agency sending client data to a processor in Dublin, Warsaw or Madrid.

The ICO's international transfers guidance is the working reference here. It explains when a transfer needs a transfer risk assessment, what safeguards are recognised, and how to record the decision.

A transfer only happens when data leaves the UK to a controller or processor in another country. Sending data from Belfast to a server in Belfast is not a transfer. Sending it to a server in Frankfurt is.

That distinction is easy to lose in a project plan, because hosting is often described by brand rather than region. Ask the supplier which region holds the data, and get the answer in writing before the build starts.

Roles matter as much as routes. The ICO's guidance on controllers and processors explains who carries which duty, and it is the reference to use when a client asks who is responsible for a leaked form submission.

Hosting and access checks for EU-facing projects

Hosting location is the single decision that most often turns a domestic build into an EU transfer. It is also the decision clients understand least, because the control panel rarely names the country.

Then match the region to the data. A UK-only audience is usually fine on UK or EU hosting. A client with EU customers may prefer EU hosting to simplify its own position. A client with US customers may end up with a US region and a transfer mechanism.

Latency is a real constraint, and it is sometimes used to justify a region that creates a transfer. Test it. Dublin, London and Amsterdam are close enough that the difference rarely justifies a weaker data position.

Region names are checkable. AWS eu-west-1 is Ireland and eu-west-2 is London, Google Cloud europe-west2 is London, and Microsoft Azure UK South is London.

Backups and disaster recovery count as hosting locations too. A UK primary with a US backup is still a US transfer, and the same is true of support access from an overseas team.

Where the agency is the processor, its own vendors are sub-processors. The client needs to know who they are, where they sit and what happens if one changes. Vendor checks covering identity, data and exit checks are the place to record that.

Security duties run alongside all of this. The ICO's security guidance sets out what is expected of hosted client data, and it applies whether the server sits in Belfast or Berlin.

Worked example: a Belfast agency and a Dublin retailer

A Belfast agency wins a build for a Dublin retailer. The site runs on EU hosting, the CMS is licensed from a US vendor, and the agency's support desk is in Belfast.

Personal data flows: customer orders sit in the EU region, the US vendor sees licence and support data, and the Belfast team accesses order records for maintenance.

Documentation: a processing agreement, a sub-processor list, a short transfer risk assessment and a record of the hosting region. That is enough to answer the retailer's questions without a scramble.

Contract checks for EU-facing projects

Contract wording is where the transfer analysis becomes enforceable. A Belfast agency should not rely on a verbal understanding about hosting regions or sub-processors.

Start with roles. Name the client as controller and the agency as processor, or set out joint controller terms if the agency uses the data for its own purposes. Ambiguity here causes most disputes.

The site's list of seven records that keep a commission honest names them: processing agreement, sub-processor list, change of region clause, audit right, retention schedule, breach notification route and transfer record.

Two clauses are often missed. The first is a change of region clause, so a host migration cannot silently create a new transfer. The second is an audit or information right, so the client can ask for evidence without a formal dispute.

Where the client is in the Republic of Ireland, expect the client's own advisers to ask about the UK's adequacy position and the agency's sub-processors. A short, accurate pack answers both.

Records to request for a Belfast web design project

Record keeping is the other duty. Article 30 of the UK GDPR requires a record of processing activities, and the exemption for organisations with fewer than 250 staff does not apply where processing is regular rather than occasional. Client website work is regular.

In practice, one record per client project covers it: the categories of data, the hosting region, the sub-processors, who can reach the data from where, and the transfer tool for each destination. The ICO's Accountability Framework and the documentation section of its Guide to the UK GDPR describe the level of detail expected.

Northern Ireland adds a border, not a second regulator. The UK GDPR and the Data Protection Act 2018 apply in Belfast as they do in Birmingham. The ICO maintains a Northern Ireland office in Belfast, and it is the body a client complains to.

An EU-based client may still ask for EU GDPR wording in the contract, because that client answers to its own regulator.

A project table for checking data routes

Use this table when reviewing an agency's EU-facing project, before hosting is chosen. It turns a vague conversation about data into a decision the client can sign off.

Run the table as a checklist on every EU-facing commission.

Keep the completed table with the contract. If the EU's adequacy finding on the UK changes, that record is what lets a Belfast agency respond in days rather than weeks.

Common questions