Data transfers, VAT and contract terms for UK and EU cross-border software deals

What to take away

Post-Brexit data transfer rules for UK firms using EU tools

The UK GDPR sits alongside the EU GDPR, and the two regimes have not stayed identical. For a UK company using an EU-based tool, personal data often moves in both directions: employee records, customer lists, support tickets.

The ICO sets out the rules for these flows in its International transfers guidance, and that is the first place to look before you assume a vendor is covered.

Since the UK left the EU, the EU has treated the UK as adequate for data protection purposes. Most EU to UK transfers can therefore continue without extra paperwork. The reverse direction is not automatic.

If a UK firm sends personal data to an EU processor, or to a group company in the EU, the UK GDPR transfer rules apply. You need a lawful transfer mechanism, not just a contract.

Two questions decide most cases. Where is the data going, and what is the legal basis for sending it? For a UK firm buying an EU-based tool, the vendor is often the processor and the UK firm is the controller. That makes the UK firm responsible for the transfer mechanism.

Data sharing is a related but separate issue. When you pass data to a partner, a group company or a joint venture, the ICO Data sharing guidance explains how to do it lawfully. That matters for operations software because integrations often push data into third party systems.

A common mistake is to assume that an EU vendor's own GDPR compliance covers the UK side. It does not. The UK addendum exists precisely because the two regimes need a bridge. Our guide to UK rules for business productivity software sets out the wider compliance picture.

ICO international transfers and the UK addendum

The ICO international transfers guidance is the regulator's own explanation of when a transfer happens, what safeguards are available and what records you must keep. It covers the UK GDPR transfer rules, the adequacy regulations and the appropriate safeguards. Read it before you agree a data processing addendum with an EU vendor.

The UK addendum is the mechanism that lets UK firms rely on the EU standard contractual clauses. In practice, you take the EU clauses, attach the UK addendum, and the combined document works for UK GDPR transfers.

The ICO publishes the addendum and explains how to complete it. Without it, an EU vendor's standard clauses may not cover UK transfers.

There are other routes. Binding corporate rules suit large groups. The international data transfer agreement is the ICO's own standalone tool. For most mid-sized UK firms, the UK addendum is the quickest route because vendors already have EU clauses in place.

A transfer risk assessment is not a legal requirement in every case, but the ICO expects you to be able to show why your chosen safeguard is appropriate. Keep the assessment with the contract. If the vendor changes subprocessors, recheck it.

Records matter. The ICO expects you to document transfers, the mechanism used and the countries involved. That record is also useful when a customer asks how their data is handled, and when you review risk scenarios in your own supplier base.

VAT treatment for EU-based software and EU clients

Post-Brexit VAT treatment for software depends on who is buying and where they belong. The place of supply rules decide which country's VAT applies.

For business to business supplies of digital services, the general rule is that the supply is where the customer belongs. For business to consumer supplies, it is where the supplier belongs, unless the use and enjoyment rules shift it.

The Value Added Tax Act 1994 is the primary legislation behind the records and invoices you must keep, and HMRC applies it through notices and Making Tax Digital.

If you buy an EU-based tool for your UK business, the vendor should not charge EU VAT when the reverse charge applies. You account for it through your UK VAT return instead.

If you sell software or digital services to EU business customers, you generally do not charge UK VAT. You need the customer's VAT number and evidence of their business status.

If you sell to EU consumers, you may need to register under the non-union one stop shop in one EU member state, or the import one stop shop for goods.

Invoices must show the right detail. For cross-border business to business supplies, include both VAT numbers, a description of the supply, the tax point and the reverse charge wording where relevant. HMRC expects these records to be kept for six years, or ten years if you use the VAT One Stop Shop scheme, according to its VAT record-keeping guidance.

A frequent error is to charge UK VAT to an EU business customer. That creates a double charge and a refund problem. Check the customer's status and location before you invoice.

Contract terms for cross-border operations software

Cross-border contract terms decide what happens when something goes wrong. Four clauses carry most of the weight: the data transfer mechanism, the VAT clause, the governing law and the exit route. Get these right and the rest of the agreement is easier to live with.

The data transfer clause should name the mechanism, whether that is the UK addendum, the international data transfer agreement or an adequacy decision. It should also list subprocessors and the countries where data is stored. Vague wording such as "appropriate safeguards" is not enough.

The VAT clause should state who accounts for VAT, under which rules, and what happens if a tax authority disagrees. For EU-based tools sold to UK businesses, the clause should confirm that the reverse charge applies and that no EU VAT is charged. It should also cover invoicing and credit notes.

Governing law and jurisdiction matter more after Brexit. An EU vendor may default to the law of its own member state. That is not automatically wrong, but you should know what it means for enforcement. If the contract is governed by English law, disputes go to English courts.

The exit route should cover data return, deletion and transition assistance. If the vendor holds your operational data, you need a defined way to get it back in a usable format. Reading a productivity software contract is easier when you know which clauses to compare, and the same discipline applies to cross-border deals.

Buying and selling outside Great Britain: practical steps

The GOV.UK guidance on Buying and selling outside of Great Britain is the starting point for the customs, tax and regulatory steps that apply when you trade with the EU.

It covers imports, exports, rules of origin and the paperwork that goes with them. Use it to build your own process rather than relying on a vendor's summary.

These steps are not a one-off. Vendors change subprocessors, tax rules change, and contracts renew. A short annual review keeps the position current. It also gives you something to show a customer or an auditor. Our Data protection for productivity software guide covers the purpose by purpose checks.

For public sector work, procurement rules add another layer. Crown Commercial Service frameworks and Digital Marketplace listings set their own terms. Scottish procurement uses Public Contracts Scotland. Check those routes before you assume a commercial contract is enough.

If you sell into the EU, you may also face local registration duties. Some member states require a fiscal representative or a local VAT number. The GOV.UK guidance points to the relevant rules, but local advice is often needed.

The overall aim is a repeatable process. Buying and selling outside Great Britain is not a single decision, it is a set of checks you run whenever a supplier or customer crosses a border.

ONS international trade data as context

The Office for National Statistics international trade data is the official picture of UK trade with the EU and the rest of the world. It covers goods and services, imports and exports, and the balance of trade.

Use it to sense-check your own assumptions about how much trade has shifted since 2021.

The data shows that EU trade has not collapsed, but the mix has changed. Some firms have moved activity to the UK, some have moved it to the EU, and some have absorbed the extra paperwork. The aggregate figures will not tell you what to do, but they will tell you whether your own experience is typical.

For operations and finance teams, the useful move is to compare your own EU trade share with the national picture. If your share has fallen faster than the average, the cause is probably internal, not macroeconomic. If it has held up, your processes are working.

The ONS publishes its trade data in a consistent format, which makes it usable for planning. It is not a compliance source. It is context. Treat it as one input among several when you review your cross-border operations.

Where the data is most useful is in board papers and budget rounds. A single chart of UK EU trade, next to your own numbers, is more persuasive than an assertion that Brexit changed things. It also keeps the discussion grounded in official figures rather than anecdote.

A cross-border contract checklist

Use this checklist before you sign or renew any EU-based tool, or any contract with an EU customer. It is deliberately short. The aim is to catch the four or five issues that cause most problems.

If any box is unticked, do not sign. Ask the vendor for the missing document. Most EU vendors already have the UK addendum and a VAT clause, because UK customers ask for them.

For UK firms, the biggest single risk is a data transfer that nobody has documented. The second is a VAT charge that should not have been made. Both are fixable before signature and expensive afterwards.

A worked example makes the point. A Manchester firm buys a workforce tool from an Irish vendor. The vendor hosts in Ireland and uses a subprocessor in the United States. The UK firm sends employee data to the tool.

The transfer mechanism is the UK addendum plus the vendor's EU clauses. The vendor does not charge Irish VAT because the reverse charge applies.

The contract is governed by Irish law, so the firm checks enforcement and the exit route. All four checks are recorded. That is the standard to aim for.

Common questions