How to prospect across the UK and Ireland border after Brexit

What to take away

What Brexit changed for UK and Ireland prospecting

Brexit split what was once a single data protection space. Before 2021, the UK and Ireland both followed EU GDPR. Now the UK has its own retained version, the UK GDPR, while Ireland follows EU GDPR. For sales teams, that means two rulebooks, not one.

Prospecting across the border is still possible. The UK holds an adequacy decision from the EU, so personal data can flow from Ireland to the UK without new safeguards. The reverse also works under the UK's own adequacy regulations. But adequacy is not permanent. It can be suspended or withdrawn.

The practical effect is that you cannot assume one privacy notice, one consent record or one suppression list covers both countries. You need to know which law applies to each prospect. If your company is in the UK and you contact someone in Ireland, Irish data protection law may apply to that processing.

Market differences also matter. Irish buyers often work in US multinationals, financial services and tech. UK buyers spread across manufacturing, retail, professional services and the public sector. Your messaging and channel mix should reflect that.

Trade data helps you find the right accounts. The Office for National Statistics publishes international trade statistics that show which UK businesses export or import, a useful signal for cross-border prospecting. See International trade - Office for National Statistics for sector-level data.

One more change: the UK can now diverge from EU rules. The Data (Use and Access) Act 2025 is an example. It adjusts some marketing data rules, so you must track both UK and Irish positions.

Dual UK GDPR and Irish data protection duties explained

When you prospect across the UK and Ireland, you may be subject to two regimes at once. UK GDPR applies to processing carried out by UK organisations, or by organisations targeting UK residents. Irish data protection law, which implements EU GDPR, applies when you target people in Ireland or process data in Ireland.

Both regimes share core principles. These include lawfulness, fairness, transparency, purpose limitation and data minimisation. Accuracy, storage limitation, integrity and confidentiality also apply. But the details differ. The UK GDPR is the retained EU regulation as amended by UK law. You can read the retained text at Regulation (EU) 2016/679 (UK GDPR).

One key difference is the role of the regulator. The Information Commissioner's Office (ICO) enforces UK GDPR and PECR. In Ireland, the Data Protection Commission (DPC) enforces EU GDPR. If you operate in both, you may need to deal with both regulators.

Both regulators publish a last updated date on their guidance pages, so check the ICO and DPC pages before you act.

Controller and processor roles matter for lead generation. If you buy a prospect list, you are likely a controller for your own outreach. The list provider may be a controller or processor.

The ICO explains these roles in its guidance on Controllers and processors | ICO. Get this wrong and you can be liable for someone else's breach.

Accountability is another shared duty. You must document your processing, keep records, and carry out data protection impact assessments for high-risk activities. High-risk could include large-scale profiling or automated decision-making.

Brexit also changed the UK's data protection regime. The Data (Use and Access) Act 2025 reforms some marketing data rules, including how you can rely on legitimate interests and how you handle cookies. Check Data (Use and Access) Act 2025 for the changes that affect prospecting.

If you are new to UK rules, our guide on prospecting software data protection explains what England buyers need to know.

Adequacy decisions and international transfers of prospect data

Adequacy decisions are the simplest way to move prospect data between the UK and Ireland. The EU Commission adopted an adequacy decision for the UK in June 2021. It allows personal data to flow from the EEA, including Ireland, to the UK without additional safeguards.

The UK also made its own adequacy regulations for the EEA, so data can flow the other way.

But adequacy is not a free pass. It only covers transfers between the UK and the EEA. If your prospecting stack involves a vendor in the US, India or elsewhere, you need a transfer mechanism. That could be the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another approved tool.

The ICO sets out the rules on transferring prospect data internationally in its International transfers | ICO guidance. Read it before you sign up to any tool that stores data outside the UK or EEA.

Adequacy can be revoked. The EU reviews it periodically. If the UK diverges too far from EU law, the decision could be withdrawn, and transfers would need safeguards overnight. Build flexibility into your contracts.

For prospect data, transfers happen in several ways. You might export a list from a UK CRM to an Irish email platform. You might use a US-based enrichment tool. Or your sales team might access data while travelling. Each is a transfer.

Document your transfers. Keep a record of what data goes where, under which mechanism. If you use standard contractual clauses, make sure they are the right version for the UK.

Irish organisations sending data to the UK can rely on the EU adequacy decision. UK organisations sending data to Ireland can rely on the UK's adequacy regulations. But if you are in the UK and your Irish prospect data is stored in the US, you need a transfer mechanism for that leg too.

Market differences between UK and Irish B2B buyers

The UK and Ireland are close, but B2B buying differs. The UK market is larger and more varied. Greater London, South East England, the North West and Scotland are distinct markets in their own right.

The West Midlands, Yorkshire and the Humber, the East of England and Wales have their own sector strengths too. Ireland is smaller but more concentrated, with Dublin dominating tech, finance and professional services.

Irish buyers often work for US multinationals. That means longer sales cycles, more stakeholders and a strong focus on compliance. UK buyers in small and medium-sized enterprises may decide faster, but they are also more price-sensitive.

Sales culture differs too. In Ireland, personal relationships and referrals carry weight. In the UK, buyers may respond to cold outreach if it is relevant and well-timed. Both markets dislike generic spam.

Language and tone matter. Irish English uses different idioms and spellings. UK English varies by region. If you use one template for both, it will read as foreign to at least one audience.

Data sources differ. Companies House provides UK company data. Ireland has the Companies Registration Office. Both are public, but formats and update cycles differ. Your enrichment tool should handle both.

Industry events and associations can help. The Chartered Institute of Marketing (CIM) and the Institute of Sales Professionals (ISP) are UK-focused. In Ireland, the Marketing Institute of Ireland and Sales Institute of Ireland are useful. techUK and Innovate UK support technology firms that often sell across the border.

When you plan campaigns, segment by country and region. A message that works in London may not work in Cork. Test small before you scale.

Building one prospecting tools stack for both islands

A single stack can cover the UK and Ireland, but it must be configured for both. Start with your data sources. You need UK and Irish company data, contact data and intent signals. Use providers that are transparent about their lawful basis and update frequency.

Here is a step-by-step approach to building your stack.

Vendors such as Salesforce, Microsoft Dynamics 365 and HubSpot publish UK or EEA data residency options and dual UK/EU GDPR commitments. Check the product tier, DPA and sub-processor list before you sign.

Costs depend on seats, contact volume and hosting region; vendors often quote separately for data residency and DPA review, so ask for a written quote rather than assume the standard plan covers dual compliance.

Use this vendor checklist before you buy:

Some UK-focused tools ignore EU GDPR. Others are built for the US and treat both markets as an afterthought.

Worked example: Manchester and Cork

You want to prospect 500 facilities managers in Greater Manchester and 200 in Cork. In the UK, you rely on legitimate interests for B2B corporate subscribers, with a PECR-compliant opt-out in every email.

In Ireland, you use the narrower soft opt-in only for existing customers; for cold B2B email to corporate subscribers, you include an opt-out and record the basis.

Your consent log has separate UK and Irish rows. Your suppression list is split: a Manchester opt-out stops UK mail only; a Cork opt-out stops Irish mail only.

Your CRM is hosted in the UK, and your email platform is hosted in Ireland, so the transfer sits inside UK adequacy and EU adequacy. A US enrichment tool would need the UK International Data Transfer Agreement or the UK Addendum, and you would document that leg separately.

If you need to check prospecting software UK regulations before a campaign, do it early. It is easier to change tools than to unwind a non-compliant campaign.

Consider whether your team should own its prospecting channels or rent an audience. Owning channels gives you more control over data and consent.

Before you scale, learn how compliance rules must be set.

Consent, soft opt-in and ePrivacy differences to watch

Consent rules differ between the UK and Ireland. Under UK PECR, you can rely on the soft opt-in for email marketing to existing customers. You must have obtained their details in the course of a sale or negotiations, and you must offer an opt-out at every message. The soft opt-in does not apply to cold lists.

In Ireland, the ePrivacy Regulations implement the EU ePrivacy Directive. The soft opt-in exists but is narrower. It applies only to electronic mail for the purpose of direct marketing of similar products or services to existing customers. The Irish Data Protection Commission expects a clear opt-out in every message.

For B2B email, the UK allows corporate subscribers to be emailed without consent if you include an opt-out. But sole traders and some partnerships are treated as individuals. In Ireland, the rules are similar but enforcement may differ.

Cookies and tracking require consent in both countries, but the UK's Data (Use and Access) Act 2025 may change some cookie rules. Always check the latest ICO guidance.

Here is a comparison table for quick reference.

Use this table as a starting point, not legal advice. Check the current rules before each campaign.

One practical step is to keep a consent log. Record when and how consent was given, what it covers, and when it expires. If you buy data, get proof of consent from the vendor.

Suppression lists must be country-specific. If someone unsubscribes in Ireland, do not assume they want to be suppressed in the UK. But if they ask to be forgotten, you may need to suppress globally.

Soft opt-in does not cover SMS or phone calls in the same way. For calls, check the UK's TPS and Ireland's NDD. These are do-not-call registers.

Finally, train your team on the differences. A quick checklist before each campaign can save fines and reputations.

Common questions