Post-Brexit data transfers: a small business CRM guide

What to take away

How Brexit changed data adequacy for UK businesses

Before Brexit, a small business CRM in Leeds or Glasgow sat inside the EU's single data protection regime. The EU GDPR applied directly, and moving EU client data to a server in Manchester was an internal EU transfer with no extra paperwork. That ended when the transition period closed.

The UK left the EU's data protection framework on 31 January 2020 and the transition period ended on 31 December 2020. From 1 January 2021, the UK became a third country for data protection purposes. EU client data flows into the UK needed a legal basis that third-country transfers require.

The EU solved the immediate problem with an adequacy decision for the UK, first adopted in June 2021. That decision let personal data move from the EU to the UK without extra safeguards. It was due to expire in June 2025, then the EU extended it to 27 December 2025 while it finished its review.

In December 2025 the European Commission adopted a new adequacy decision for the UK under Article 45 of the EU GDPR, running to 27 December 2031.

Adequacy is not permanent and it is not unconditional. The European Commission can suspend it if the UK diverges from EU data protection standards. The EU's review looked at UK rules on international transfers, bulk data retention and redress for EU citizens. Your small business CRM does not control those things, but your EU clients will ask about them.

UK businesses also gained their own transfer regime. The Secretary of State makes adequacy regulations, and under them the UK treats the EEA — the EU plus Norway, Iceland and Liechtenstein — as adequate, so data can flow from the UK to those countries without extra safeguards. The UK's adequacy regulations also cover Andorra, Argentina, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay. That asymmetry matters: EU to UK flows rest on the EU's adequacy decision, while UK to EU flows rest on UK regulations.

Different parts of the UK face this differently. A software firm in Greater London with French clients, a manufacturer in the West Midlands with German distributors and an agency in Scotland with Irish customers all rely on the same adequacy decision. The practical difference is how much EU client data they hold and how their CRM vendor routes it.

Brexit also changed the trade paperwork around data. If you sell services into the EU, your contracts and your data clauses travel together. GOV.UK guidance on buying and selling outside Great Britain covers the commercial side, and the data side sits alongside it.

What lawful CRM data flows to EU clients now require

Lawful EU client data flows into your CRM need three things: a lawful basis for processing, a transfer mechanism for the international move, and a record of both. Most small businesses have the first and forget the second.

The lawful basis is ordinary UK GDPR territory. You need a basis such as contract performance or legitimate interests for holding EU client contact details, order history and support notes. That basis does not change because the client is in the EU.

The transfer mechanism is the extra layer. If the EU Commission has found the UK adequate, the transfer from an EU controller to you in the UK needs no standard contractual clauses. The adequacy decision does the work.

If your CRM vendor then moves that data to a data centre outside the UK and EEA, a second transfer happens and it needs its own mechanism.

Adequacy does not cover everything. It does not cover data you transfer onward to a country the EU has not found adequate, and it does not cover data you process for EU public authorities. It also does not stop an EU client from demanding extra contractual protections as a condition of the deal.

Here is a simple decision path for a UK small business CRM holding EU client data.

That path takes an afternoon for most firms. It also answers the questionnaire an EU client's procurement team will send you. If you sell into the public sector in Germany or the Netherlands, expect that questionnaire to be detailed.

Your CRM vendor may already publish a data processing addendum and a sub-processor list. Vendors such as HubSpot, Salesforce, Pipedrive, Zoho and Freshsales publish these, and some offer EU or UK data residency — check whether that option exists on the plan you actually buy. Read the addendum against your own map. A vendor that says it stores data in the EU may still route support tickets through a US team, which is a separate transfer.

International transfers, safeguards and the ICO position

The ICO international transfers guidance is the reference point for UK businesses moving personal data abroad. It explains the transfer mechanisms the UK recognises and the assessment you must do before relying on them.

The UK recognises several safeguards. Adequacy regulations cover the EEA and a list of other countries and territories. Standard contractual clauses, known as the International Data Transfer Agreement or the UK Addendum to the EU clauses, cover most other cases, and the ICO publishes templates for both. For transfers to the United States, the UK extension to the EU-US Data Privacy Framework — the UK-US data bridge — works where the US importer is certified under it. Binding corporate rules and certain derogations cover narrower situations.

For most small businesses, standard contractual clauses are the practical tool. You sign them with the importer, or your CRM vendor signs them on your behalf as part of the contract. The clauses must match the transfer: the right parties, the right data categories and the right destinations.

The ICO also expects a transfer risk assessment, and it publishes its own transfer risk assessment tool to help you carry one out. That is a documented look at the laws and practices of the destination country and whether they undermine the safeguards. For a UK to US transfer, that assessment is more than a tick box, unless the importer is certified under the UK extension to the EU-US Data Privacy Framework. For a UK to EEA transfer, you do not need one because adequacy applies.

The ICO can take action against UK controllers who transfer data without a mechanism. It can also act on complaints from data subjects. The fines regime under the UK GDPR applies, and the ICO's approach to international transfers has been to ask for evidence rather than accept assurances.

There is a practical link to your wider compliance. The rules that apply to your CRM depend on what you do with the data, and a short guide to what sets each regime off helps you work out your role: controller, joint controller or processor.

If your CRM vendor refuses to sign standard contractual clauses or to document its sub-processors, that is a signal. It may mean the vendor has not mapped its own transfers. The ICO guidance on international transfers is the document to send them.

The 2019 exit regulations and retained UK GDPR text

The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, usually called the 2019 exit regulations, are the legal bridge between EU and UK data protection law. They amended the EU GDPR and the Data Protection Act 2018 so both worked on exit day.

Those regulations created the UK GDPR. They changed references from EU institutions to UK ones, adjusted the territorial scope and set up the transfer regime the UK uses. They also preserved the structure of the EU rules, which is why UK and EU law still look similar.

Retained EU GDPR text is the version of the EU GDPR that Parliament kept in UK law. It is the text your CRM compliance work sits under. When people say UK GDPR, they usually mean this retained text as amended by the 2019 exit regulations and later laws.

Retention does not mean the text is frozen. Parliament can amend it, and it has. The Data (Use and Access) Act 2025 changed parts of the UK GDPR, including some definitions and the rules on automated decision-making and subject access. The ICO explains what the Act does and what it leaves in place.

The retained text still contains the core duties that touch a CRM: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy and storage limitation. Integrity and confidentiality sit alongside them, as does accountability. Those duties apply to EU client data held in your CRM just as they apply to UK customer data.

The exit regulations also matter for the transfer regime. They set out how the UK recognises adequacy and how the Secretary of State can make adequacy regulations. That is the power behind the UK's decisions on the EEA and other countries.

For a small business, the practical point is that you have one main text to follow, the UK GDPR, plus the Data Protection Act 2018 and the 2025 Act. You do not need to apply the EU GDPR directly unless you offer goods or services to people in the EU or monitor their behaviour.

If you do target EU customers, the EU GDPR can apply to you directly under its territorial scope. Then Article 27 of the EU GDPR may require you to appoint a representative in the EU, and you may face EU supervisory authorities. That is a separate question from the adequacy decision, which only covers transfers.

CRM vendor contracts when data crosses borders

CRM vendor contract clauses decide who is responsible when data crosses a border. Most small businesses sign the vendor's standard terms and never check them against their own data map.

A workable contract names the parties and their roles. It should say whether the vendor is a processor acting on your instructions or a controller in its own right. That determines who answers a data subject request and who signs the transfer clauses.

The contract should list the sub-processors and their locations. If the vendor uses a cloud host in Ireland and a support team in the Philippines, both matter. The contract should give you notice of changes to sub-processors and a right to object.

The contract should name the transfer mechanism. If the vendor moves EU client data from the EU to the UK, it relies on EU adequacy. If it moves data from the UK to a third country, it needs standard contractual clauses or another safeguard, plus a transfer risk assessment.

The contract should cover security, breach notification and audit. It should also cover deletion and return of data at the end of the deal. A vendor that cannot delete your data on exit leaves you with a retention problem.

Use a due diligence process that ties the exact service to the proof. Ask for the data processing addendum, the sub-processor list, the security certifications and the transfer impact assessment. If the vendor cannot produce them, treat that as a finding.

Here is a comparison of the common contract positions you will see.

The UK Government Digital Marketplace is a useful source for contracts that already meet public sector standards. If you sell to UK public bodies, those terms are a benchmark. If you sell to EU clients, their procurement terms will be stricter still.

Handling EU client data in a small business CRM

Handling EU client data in a small business CRM is mostly about discipline. The rules are familiar; the difficulty is keeping the records current as your vendor and your client list change.

Start with a data map. List the fields you hold on EU clients, where each field came from, why you hold it and who can see it. A CRM that stores marketing preferences, support notes and billing details holds several categories, not one.

Set retention periods per category. EU client contact details may need a different retention period from transaction records, which you may need for tax. HMRC rules on record keeping set a floor for financial records, and data protection rules set a ceiling for everything else.

Give an owner for every disclosure. A named person should handle requests from EU clients, questions from your vendor and any breach notification. Without an owner, transfer queries sit unanswered.

Train the people who use the CRM. Sales staff who paste client details into a personal spreadsheet create a transfer you have not mapped. Support staff who email a client list to a colleague abroad do the same.

Check your marketing tools. If your CRM connects to an email platform with servers outside the UK and EEA, that connection is a transfer. The same applies to analytics, chat widgets and call recording tools.

Keep the paperwork. Store your transfer risk assessments, your signed clauses and your vendor addenda where you can find them. An EU client's procurement team may ask for them at short notice.

Review annually and after any vendor change. A new CRM module, a new sub-processor or a new country of operation can change your transfer position. Put the review in the calendar rather than waiting for a problem.

Reviewing transfers after the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 changed parts of the UK's data protection law. It received Royal Assent in 2025, and its provisions come into force in stages on dates set by commencement regulations, so check the position that applies to you. The ICO explainer sets out what the Act does and the reforms that follow it, including changes to definitions and to some transfer provisions.

The Act kept the UK's adequacy-based transfer regime, so the structure you already use still applies. It also gave the ICO a new structure and powers, which affects how complaints and investigations are handled.

Some changes reduce paperwork. Others clarify when you can rely on legitimate interests or how you handle automated decisions. None of them removes the need for a transfer mechanism when data leaves the UK and EEA.

The practical task is a review. Take your data map, your vendor list and your transfer records, and check them against the current ICO guidance. Update anything that refers to the pre-2025 position.

Check your EU adequacy exposure too. The EU's new adequacy decision for the UK runs to 27 December 2031, but it can be suspended if UK law diverges. Track UK data protection consultations and EU announcements as part of your annual review.

If you sell into the EU, keep an eye on your EU clients' own obligations. They must record transfers to you and may need their own safeguards if adequacy lapses. A short note in your contract explaining the adequacy basis helps them and protects the relationship.

Finally, align the data review with the commercial review. When you renegotiate a supply contract or a distributor agreement, check the data clauses at the same time. The GOV.UK guidance on buying and selling outside Great Britain is a sensible starting point for the trade side.

Common questions