How Brexit changed UK agency work for EU and Irish creator campaigns

What to take away

What changed for UK agencies after Brexit

Brexit ended the automatic free flow of personal data from the EU to the UK. A creator list sent from a Dublin brand to a London agency now needs a lawful transfer mechanism, usually the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

The UK kept the EU GDPR text in domestic law as the UK GDPR, alongside the Data Protection Act 2018. That retained framework still governs how you process creator and audience data. You can read the retained text at Regulation (EU) 2016/679 (UK GDPR as retained).

The European Commission adopted an adequacy decision for the UK in June 2021. It allows personal data to flow from the EU to the UK without extra safeguards. The Commission extended that decision in June 2025. The extension has a stated expiry date; check the ICO guidance for the current position.

Trade in services changed too. Selling agency services into the EU now involves customs and tax questions that did not arise inside the single market. GOV.UK sets out the practical side at Buying and selling outside of Great Britain - GOV.UK.

Northern Ireland sits under different rules again. Under the Windsor Framework, data flows from the EU to Northern Ireland continue largely as before, while Great Britain follows the UK regime. An agency with a Belfast office and a London office may run two transfer analyses for the same campaign.

UK GDPR transfer rules for EU and Irish clients

A transfer happens when personal data leaves the UK for a country without UK adequacy regulations. Sending a creator shortlist to a brand in Dublin is a transfer. So is storing campaign data on a server in Frankfurt.

The ICO's International transfers | ICO guidance, current version, explains the restricted transfer test and the tools available. Read it before you sign an EU brief, not after.

There are four main routes for a UK agency sending data to the EU or Ireland:

The harder direction is inbound. An Irish brand sending creator data to a UK agency relies on the EU's adequacy decision for the UK, not on UK rules. If that decision changes, the Irish brand needs its own mechanism, usually the EU standard contractual clauses.

Agency contracts often place this burden on the agency. Push back. The exporter of the data is the party that must secure the transfer, and in an inbound flow the exporter is the EU client.

VAT place of supply on cross-border creator work

The place of supply rules decide which country taxes a service. For B2B services, as a rule, supply is generally deemed to take place where the customer is based. HMRC explains the detail in Place of supply of services (VAT Notice 741A) - GOV.UK.

For an agency, that means an Irish limited company client usually takes the supply in Ireland. You do not charge UK VAT. You may need to report the sale on your VAT return as a reverse charge supply, and the Irish client accounts for Irish VAT.

Consumer clients are different. If a private individual in France buys a service from your UK agency, the place of supply can be the UK, and UK VAT may apply. Most brand work is B2B, but creator prize fulfilment and consumer-facing events can fall on the other side.

Advertising services have their own treatment in some cases. The place of supply for advertising to a non-business customer can be where the advertising is performed. A campaign shot in Manchester for a French consumer audience may not follow the general rule.

Gifted products add another layer. When a brand sends free product to a UK creator, HMRC may treat the gift as a supply for VAT purposes if the total exceeds the business gift threshold of £50 per recipient per year. The creator may owe income tax on the value.

An EU brand shipping product into the UK also faces import VAT and customs declarations.

Keep the evidence. A valid VAT invoice for an EU client needs the client's VAT number, the reverse charge wording and the correct rate. Validate the number on VIES, the EU VAT number validation tool. Missing numbers turn a clean zero-rated supply into a UK VAT liability.

Contract clauses UK agencies now need

A pre-2016 agency contract will not survive an EU brief. The areas of an influencer-agency contract that deserve a second read now include data transfer, tax and territory.

Start with the parties and the territory. Name the contracting entity, its Companies House number and its VAT number. State which countries the campaign covers and which law governs the deal.

Add a data transfer clause. It should name the mechanism (UK Addendum, IDTA or adequacy), the roles of each party and the process for handling a data subject request. It should also say who pays if the transfer mechanism has to change.

Add a VAT clause. It should state the place of supply, the rate applied and who bears any change in tax treatment. A gross-up clause protects you if HMRC reclassifies the supply.

Add an intellectual property clause. Say who owns the creator content, for how long, in which territories and on which platforms. EU brands often want a broad licence; creators often want a narrow one.

Add a liability clause that survives a transfer failure. A data breach involving EU residents can trigger fines under both regimes. Cap your exposure or insure it.

Add an exit clause. It should cover deletion of creator data, return of assets and the wind-down of platform access. Without it, you may keep processing data you no longer need.

The wider set of duties across advertising, consumer law, privacy and rights should inform these clauses. A contract that ignores the CAP Code or the CMA guidance will not protect you in a dispute.

Irish and EU brand expectations on disclosure

Irish brand campaigns usually carry the same disclosure rules as UK ones, but the enforcement route differs. The Advertising Standards Authority for Ireland applies its own code, and the Competition and Consumer Protection Commission enforces consumer law.

In the UK, the ASA and the CAP Code require ads to be obviously identifiable. The CMA's influencer guidance adds that hidden advertising can breach consumer protection law. Both apply when a UK agency runs a campaign for an Irish brand targeting UK consumers.

Disclosure labels matter. In the UK, #ad and #advertisement work. In Ireland, the ASAI and CCPC expect labels such as #ad, #gifted or #sponsored. Ambiguous tags such as #sp or #collab may not. The label must be visible before a user engages, not buried in a hashtag block.

EU brands often expect stricter consent for audience data. If a campaign involves an email list or a lookalike audience, the brand may ask for GDPR-grade consent records. UK agencies should be ready to show the lawful basis.

Platform rules sit on top. Meta, TikTok and YouTube each have their own branded content tools and disclosure settings. The regulations, codes and platform rules that apply can differ by market, so check each platform's policy for the countries in scope.

Language matters too. A campaign for an Irish audience may need Irish English copy and local spelling. A campaign for Germany may need German-language disclosure. Do not assume one English label covers the EU.

Handling creator data that crosses borders

Creator data includes names, addresses, bank details, audience insights and sometimes special category data such as health or political views. The personal data in an influencer campaign often spans more categories than the brief suggests.

Map the flow before you start. List every system that touches creator data, where it is hosted and who can access it. A US-based CRM, an EU-based analytics tool and a UK payroll system create three different transfer questions.

Apply data minimisation. If the Irish brand only needs aggregate performance figures, do not send the raw creator list. If the brand needs bank details for payment, send them through an encrypted channel with a named recipient.

The Data Protection Act 2018 provides the statutory basis for UK compliance, including the rules on law enforcement processing and the ICO's powers. You can read it at Data Protection Act 2018.

Set retention periods. Creator data should be deleted when the campaign ends and the payment clears, unless a contract or tax rule requires longer. Tax records usually need six years.

Handle subject access requests within one month. If an EU resident makes a request to an Irish brand and the data sits with your UK agency, agree in the contract who responds and how.

Run due diligence on vendors. The path from data provenance to a tested exit should include a transfer review for any tool that stores data outside the UK.

A transfer checklist for the next EU brief

Use this before you sign the statement of work. It covers the transfer, the tax and the contract in one pass.

A worked example shows how this fits together. A Manchester agency wins a brief from a Dublin skincare brand. The campaign uses twenty UK creators and one German creator.

Step 1: the agency checks the inbound flow. The Dublin brand sends creator data to Manchester. The EU adequacy decision for the UK covers it, so no extra mechanism is needed today.

Step 2: the agency checks the outbound flow. It sends campaign data to a German analytics vendor. The UK has adequacy regulations for the EU, so the flow is covered.

Step 3: the agency checks VAT. The Dublin brand is a business with a valid VAT number, so the place of supply is Ireland. The agency does not charge UK VAT and notes the reverse charge.

Step 4: the agency checks the contract. It adds a UK Addendum clause, a VAT gross-up clause and a content licence limited to the UK and Ireland for twelve months.

Step 5: the agency checks disclosure. UK creators use #ad; the German creator uses the German label required by local rules.

Step 6: the agency sets retention. Creator data is deleted ninety days after final payment, except tax records kept for six years.

The agency already has the clause and the register entry. The Irish brand would need to put EU standard contractual clauses in place for the inbound flow.

Common questions