Post-Brexit data transfers in programmatic: EU-UK adequacy, SCCs and records

What to take away

Where UK adequacy stands for EU data flows today

The UK's adequacy status rests on the EU-UK adequacy decisions, two separate findings adopted in June 2021. One covers the UK GDPR and the other covers the law enforcement regime.

The decisions govern transfers from the European Economic Area to the United Kingdom, which is why a UK agency can take EU audience data from a German publisher or a French DSP without a new transfer mechanism. They apply to organisations in all EEA countries, and personal information can flow freely from the EEA within their scope.

The ICO's guidance on receiving personal information from the EEA records that the European Commission renewed its two original adequacy decisions for the UK, with the amended decisions adopted on 19 December 2025. Adequacy is a finding the Commission can revisit, so UK agencies should treat it as a live condition to monitor, not a settled fact.

The practical effect is that most EU to UK transfers in a programmatic campaign do not need standard contractual clauses today. The UK GDPR still applies to the data once it lands in the UK, and the ICO's guidance sets out how to handle it.

A London agency buying EU inventory through a UK entity is usually inside the adequacy umbrella.

Adequacy does not cover transfers from the UK to the European Union. Those are covered by the UK's own adequacy regulations, which recognise the EU as adequate. The asymmetry matters: the EU decision is the one subject to review by the Commission, while the UK side is a domestic instrument.

Adequacy is a country-level finding, so Scotland, Wales, the North West and the South East share London's transfer position. Regional differences show up in vendor mix and client base, not in the legal test.

What the EU-UK adequacy decisions cover and what they exclude

The decisions cover personal data transferred from the European Economic Area to the United Kingdom under the EU GDPR for general processing and, separately, under the Law Enforcement Directive. Programmatic advertising falls under the first.

They do not reach transfers to countries outside the UK that lack their own adequacy finding. A UK agency that receives EU data and then sends it to a US ad server cannot rely on EU-UK adequacy for that second hop. It needs a separate transfer route, with standard contractual clauses the usual choice, plus a transfer risk assessment.

Law enforcement and national security purposes sit under the separate law enforcement decision, not the general one that matters for advertising.

The decisions do not remove the need for a lawful basis under the UK General Data Protection Regulation. Adequacy is a transfer tool, not a permission to process. A programmatic campaign still needs consent or legitimate interests, and PECR still governs cookies and device access. The guide to GDPR consent for programmatic advertising covers that side.

The decisions also depend on the UK's own regime staying equivalent. If the United Kingdom changes its data protection rules, for example through the Data (Use and Access) Act, the Commission can revisit adequacy. Agencies should keep an eye on ICO statements and Commission reviews rather than assume the current position holds.

Standard contractual clauses and transfer risk assessments for ad tech

Where adequacy is not applicable, standard contractual clauses serve as the default option. The European Commission adopted a new set of SCCs in 2021, and the UK has its own International Data Transfer Agreement and addendum.

For programmatic advertising, the choice depends on which end of the transfer you are on.

SCCs matter most on routes that do not run between the United Kingdom and European Union, such as a UK agency sending campaign data to a US ad server. An EU publisher sending data to a UK agency can rely on adequacy. A UK agency sending the same data onward cannot.

A transfer risk assessment is a documented look at the destination country's laws and whether they undermine the safeguard. It is not a formality. For US transfers, the assessment should consider surveillance law and the redress available to data subjects.

The ICO's transfer risk assessment guidance explains what a TRA is, when you need one and how to complete one, and notes that UK legislation now calls it a data protection test. Each step needs evidence. A campaign that runs through five vendors may need five assessments or one covering the chain.

SCCs are not self-executing. The parties must complete the annexes, describe the data, the purpose and the retention period. A signed but blank annex is a common audit failure. The data protection review cycle should include checking that annexes match the live campaign.

Practical data flows: audience syncs, clean rooms and measurement pixels

Audience syncs move hashed or pseudonymous identifiers from an advertiser or publisher to a platform. Syncs that run between the United Kingdom and European Union are usually covered by the UK's adequacy status. If the sync continues to a US platform, it needs SCCs and an assessment.

Hashed data can still be personal data if it can be linked back to a person.

Clean rooms are a bigger question. A data clean room lets two parties match audiences without sharing raw data. But the matching process still involves a transfer if the clean room sits outside the UK or EU. The clean room operator is usually a processor.

UK and EU clean room providers often host in the UK or EU to keep the transfer simple. That is a selling point, but it does not remove the need for a lawful basis or a controller processor contract. The advertiser and the clean room operator still need terms that meet Article 28.

Measurement pixels are the most fragmented flow. A single page can fire pixels from several EU ad tech vendors, each sending data to a different country. The transfer map for one campaign can run to a dozen destinations. Each destination needs a lawful basis and, where adequacy does not apply, a safeguard.

Measurement pixels belong in the reporting design from the start.

The programmatic rules and ethics guide covers how PECR and the UK GDPR interact with these flows. The short version: consent for cookies, a lawful basis for the data, and a transfer tool for each cross-border hop.

Vendor due diligence for EU-based programmatic partners

EU ad tech vendors are common in UK campaigns, from DSPs in France to verification tools in Germany. Due diligence should start with the vendor's data residency and end with its breach history. The vendor due diligence checklist covers the main areas.

A vendor with an EU entity and a US parent is a common pattern. The EU entity may be the contracting party, but the parent may access the data. That access is a transfer. The contract should name the parent and cover the access.

Due diligence is not a one-off. A vendor that moves its data centre or is acquired creates a new transfer. The review cycle should be at least annual, and sooner if the vendor changes ownership or sub-processors.

The commercial contracts article explains how to put these terms into a framework agreement or an insertion order. Transfer clauses belong in the framework, not the order, so they survive individual campaigns.

Documenting transfers for ICO scrutiny

The ICO does not approve transfers in advance. It investigates complaints and audits. If it asks, you need to show what you transferred, where it went, and why the safeguard was adequate. A folder of signed SCCs with no assessment is not enough.

Records of processing should include every transfer, the destination country, the safeguard and the assessment. Article 30 records are the starting point, but they often miss ad tech hops. Add a transfer schedule to the record.

Roles matter here because the role decides who is liable. A UK agency acting as a controller for its own campaign is liable for the transfers it instructs. If it acts as a processor for a client, the client is the exporter for some purposes and the agency for others.

The minimum documentation for a cross-border programmatic campaign is short enough to keep current:

A worked example: a Manchester retailer runs a programmatic campaign with a UK agency, a French DSP and a US measurement vendor. The EU to UK hop is covered by adequacy.

The UK to US hop needs the UK addendum and an assessment. The agency documents both, names the US vendor as a sub-processor, and reviews the file each year.

If adequacy is withdrawn, transfers between the United Kingdom and European Union would need SCCs too. That is the scenario to plan for. A transfer register that already lists the hop makes the switch a matter of adding a safeguard, not rebuilding the map.

Common questions