Rules and ethics
Cross-border attribution after Brexit for UK and EU campaigns
Cross-border attribution after Brexit depends on the UK adequacy decision, standard contractual clauses and ICO transfer guidance for UK and EU measurement data.
Attribution across UK and EU campaigns depends on where records travel, who can reach them and what the reporting needs to show. A campaign can use regional data or cross-border transfers, but each choice has different consequences for precision, safeguards and documentation. The practical comparison is between a design that assumes and one that maps those choices.
Keep measurement useful without centralising event records
Regional reporting can support cross-border decisions without gathering personal event records in one place. The design may give up user-level detail or speed, so choose it with the campaign question in mind and record what the resulting measures can and cannot show.
| Weak version | Better version |
|---|---|
| Assume that every event needs to be brought together for attribution. A central join can create an international transfer and make reporting depend on a route the organisation cannot support. | Keep personal data in its region and combine suitable results. Regional aggregation, clean rooms and modelled attribution can support cross-border reporting without moving raw event records, although precision or update speed may be lower. |
Three regional attribution designs
Regional aggregation
- What moves
- Aggregates only
- User-level joins
- Lost
- Key control
- Minimum cell size
- Precision
- Directional
Clean rooms
- What moves
- Outputs only
- User-level joins
- Inside the room
- Key control
- Compute location
- Precision
- High on matched data
Modelled attribution
- What moves
- Model parameters
- User-level joins
- None
- Key control
- Per-region models
- Precision
- Lower at user level
With regional aggregation, each area calculates conversion counts, exposure counts and modelled conversions, then shares aggregates that cannot be traced to individuals. This loses user-level joins but can retain directional reporting. Set a minimum cell size and suppress smaller rows to reduce the risk of identifying people from the results.
A clean room can support matching in a controlled environment without either party seeing the other party's raw records. If it runs in the EU and the UK team receives only outputs, check where its computing and storage take place. Modelled attribution can also combine regional results; marketing mix modelling, geo holdouts and incrementality tests are options to weigh against the required attribution outputs.
Trace the route before deciding what covers it
The transfer position depends on each leg of the campaign's data route, not simply on the platform's location. Map collection, analysis and support access separately, including later recipients, so the safeguards chosen correspond to the countries and organisations actually involved.
| Weak version | Better version |
|---|---|
| Treat movement from the EU to the UK, movement in the opposite direction and later access from another country as one transfer under a single approval. That can leave a modelling service or support team outside the review. | Draw the route in separate legs. The EU adequacy decision covers most personal data moving from the EU and EEA to the UK without extra safeguards. It does not cover UK-to-EU movement or onward access in another country. |
What UK adequacy covers
Covered
- EU to UK flows
- Yes, no extra safeguards
- Onward transfer to US or India
- —
- National security and immigration
- —
- Duration
- —
Not covered
- EU to UK flows
- —
- Onward transfer to US or India
- Needs own lawful basis
- National security and immigration
- Outside scope
- Duration
- Can be suspended or repealed
For a campaign covering Germany, France or the Netherlands, conversion events, hashed identifiers and exposure logs can generally be sent to a UK measurement platform. A different country may also access those records through modelling, support or a subcontractor, so check the route beyond the initial transfer. Use the UK campaign rules when reviewing those choices.
Each direction of travel has its own mechanism:
- EU or EEA to UK:the European Commission's adequacy decision for the UK, first adopted as Implementing Decision (EU) 2021/1772 and renewed on 19 December 2025, lets personal data flow without extra safeguards.
- UK to EU or EEA:the UK treats EEA states as adequate under transitional adequacy provisions in Schedule 21 to the Data Protection Act 2018, so no further safeguard is usually needed. The EU decision above does not govern this leg.
- UK to a third country:use UK adequacy regulations where the country is covered, such as the UK-US data bridge for certified US companies, or the ICO's International Data Transfer Agreement or UK Addendum, with a transfer risk assessment.
- EU to a third country:use the EU standard contractual clauses in Implementing Decision (EU) 2021/914, or an adequacy decision where one exists.
The ICO's international transfers guidance explains the UK legs, and the European Commission's pages explain the EU legs.
The adequacy decision is conditional, rather than permanent. The Commission renewed it on 19 December 2025, after considering the Data (Use and Access) Act 2025, and it now runs to 27 December 2031 unless extended. It can still be suspended or repealed if UK data protection law diverges from EU rules, so keep the campaign plan responsive to that possibility.
Put the parties' purpose and duties on record
A transfer mechanism does not define the whole relationship between campaign partners. Record why they use the information, what each party decides and what happens to the records after measurement, so the purpose and responsibilities are clear alongside the route.
| Weak version | Better version |
|---|---|
| Treat a transfer mechanism as a complete agreement between a UK advertiser and an EU publisher. This can leave purpose, lawful basis, controller roles, retention and onward recipients unresolved. | Set out the parties, purpose, data categories, lawful basis, retention period and roles in a data-sharing arrangement. If both parties decide why and how data is processed, record their joint-controller status and allocate responsibility for requests. |
What the data sharing agreement needs
- Name the parties and their roles
- State the purposejoint campaign measurement
- List the categories of data
- Give the lawful basis
- Set the retention period
- Name the transfer mechanism for each leg
For attribution, the purpose is usually joint measurement of campaign performance. Identify the data precisely: hashed identifiers, mobile advertising identifiers, cookie IDs and IP addresses remain personal data when they can single out a person. Aggregated counts are not personal data where aggregation is genuine and cannot be reversed.
Agree how long each party keeps shared data and what evidence it will provide when data is deleted. Onward sharing adds another recipient and may create another transfer. If a publisher passes advertiser data to a verification vendor, map that step and identify its mechanism before the campaign starts.
Match the contract wording to each data flow
A signed clause only helps when it describes the parties, destination and information in the actual campaign. Compare the services agreement and its annexes with the route, rather than treating a signature or generic schedule as evidence that every transfer has been addressed.
| Weak version | Better version |
|---|---|
| Attach standard wording with a blank or generic annex and assume the transfer is settled. Without details of the data, purpose, duration and recipient, the documents may not describe the campaign's actual processing. | Match the clauses to the parties and direction of travel. Standard contractual clauses can provide a mechanism where adequacy does not apply. Attribution often uses the controller-to-processor module; a UK transfer may need the UK International Data Transfer Agreement or an addendum adapting EU clauses. |
Clause annexes for attribution data
- Name hashed email and device identifiers
- List IP addresses and event timestamps
- State purposecampaign measurement and reporting
- Give transfer duration
- Identify the recipient
- Complete a transfer risk assessment
Complete the annexes with data categories, purpose, duration and recipient. For attribution, identify event timestamps and describe the purpose as campaign measurement and reporting. The standard contractual clauses should correspond to the transfer being made; the contract must still reflect the actual processing.
A transfer risk assessment considers whether destination-country laws undermine the protection offered by the clauses. Adequacy usually answers that question for EU-to-UK flows; UK-to-US movement needs an assessment of surveillance access and redress. If a subcontractor operates elsewhere, map that recipient and check that equivalent terms apply.
Clauses do not provide a missing lawful basis. The mechanism addresses the transfer question, not the rest of the processing review. Include supplier terms, security, deletion and subprocessor checks in the same review, and retain the assessment even where its conclusion is brief.
Check who can access the data, not only where it is stored
A regional cloud label does not show every country from which attribution data can be viewed. Review processing and access locations together, including support and subcontractor activity, because remote access may matter even if no file is downloaded or physically moved.
| Weak version | Better version |
|---|---|
| Ask only which cloud region stores event data. Support teams, content delivery networks and analytics subprocessors may then sit outside the review, despite access from another country. | Ask for the countries where processing and access take place. The ICO treats data as transferred when it is sent to a recipient outside the UK or made accessible from there. Request a country map that includes support access, not just the storage region. |
Three questions for every renewal
- 1Which countries will process the data?
- 2Which transfer mechanism covers each leg?
- 3Who is the controller for each purpose?
At renewal, ask which countries process the data, which mechanism covers each transfer leg and who acts as controller for each purpose. The map should include cloud infrastructure, content delivery and analytics subprocessors, as well as the countries where support staff can view event data.
Keep the privacy notice specific about international transfers and measurement instead of relying on a generic statement that data may go abroad. Retain the flow record for an ICO request or a complaint from someone who was not told about a transfer. Review vendor terms as ICO guidance changes under the 2025 Act.
Make the campaign record traceable from start to finish
A campaign record should let an ICO reviewer or enterprise client follow each system and recipient, see the mechanism for each leg and understand the design choice. Bring the route, purpose, recipient countries and measurement approach together before launch rather than relying on a signed clause alone.
| Weak version | Better version |
|---|---|
| Store a signed transfer clause and assume the campaign file is complete. That leaves the data flow, lawful basis, remote access, recipient countries and regional design undocumented. | For each campaign moving measurement data between the UK, EU or a third country, keep the flow map, mechanism for each leg, any risk assessment, completed annexes, subprocessor list, sharing terms, retention schedule and privacy-notice wording. |
Transfer documentation pack order
- Map the flow, including support access
- Identify the mechanism for each leg
- Complete clause annexes
- Run the transfer risk assessment
- File the sharing agreement
- Record retention and deletion evidence
- List every system, country and recipient, consistent with the data flow record.
- Note the lawful basis for each purpose under the UK GDPR or EU GDPR, as applicable.
- Name the mechanism for every legadequacy, clauses, the UK addendum or a listed exception.
- Store the transfer risk assessment, completed annexes and subprocessor details, including change-notice periods.
- Keep the sharing agreement, retention schedule, deletion evidence and privacy-notice wording.
- Record the regional design choice if data is aggregated or modelled instead of transferred.
A practical sequence is to map systems and support access, match each leg to adequacy, clauses or an exception, complete annexes, assess destination laws, and store the signed terms with the campaign file. Revisit the record if subprocessors change, adequacy is reviewed or ICO guidance changes.
For example, a UK retailer may work with a French publisher and a UK measurement vendor: French impressions and conversions move to the UK vendor under adequacy, then are modelled in a UK data centre. If support in India can access EU event data, document that onward route, its clauses, risk assessment and subprocessor entry.
