Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
UK GDPR restricts transferring personal data outside the UK unless an appropriate safeguard is in place. Most small businesses do this without realising it — using US-based email, CRM, HR or cloud storage tools, or outsourcing customer support overseas — because “transfer” includes remote access to data, not just physically sending it. Where the destination country doesn’t have UK “adequacy” status, businesses need a recognised transfer mechanism: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU’s Standard Contractual Clauses, or reliance on a specific adequacy regulation, such as the one covering the UK-US Data Bridge for US organisations certified under the Data Privacy Framework.
The UK-US Data Bridge, live since October 2024, makes transfers to certified US organisations more straightforward, but it only applies where the receiving US company has actually self-certified — a check many businesses skip, wrongly assuming any US provider is automatically covered. Meanwhile, the Data (Use and Access) Act 2025 introduced a new “data protection test” for future UK adequacy decisions, and the EU periodically reviews the UK’s own adequacy status, both of which can change what safeguards businesses relying on EU data need going forward. Getting the transfer mechanism wrong doesn’t just risk ICO enforcement — it can also leave contracts with suppliers or customers technically unenforceable on data protection terms.
