Post-Brexit review data transfers for Northern Ireland retailers

What to take away

The UK GDPR, EU GDPR and Windsor Framework position for Belfast retailers

A Belfast retailer selling across the UK and into the Republic of Ireland or the wider EU does not choose between UK GDPR and EU GDPR. Both can apply to the same review platform, depending on who wrote the review and where the processing happens.

The starting point is the Data Protection Act 2018, which sets out how UK data protection law operates alongside the retained EU law that became UK GDPR.

Under the Windsor Framework, Northern Ireland keeps alignment with a defined list of EU rules, and data protection sits within that alignment for processing that falls in scope. A retailer in Belfast can therefore be subject to EU GDPR obligations for some processing while the ICO regulates the UK GDPR side.

The two regimes share a common ancestry. Principles, lawful bases and rights look familiar, but the supervisory authority, the transfer rules and the remedies differ.

For review data the practical question is which regime governs a given review. A review left by a shopper in Manchester and stored on a server in Belfast is a UK-facing processing activity. A review left by a shopper in Dublin may bring EU GDPR into play.

The retailer's establishment matters too. A company established in Northern Ireland that offers goods to people in the EU can fall within EU GDPR's territorial scope for that offering.

The ICO's UK GDPR guidance and resources is the working reference for the UK side, covering principles, lawful basis and accountability. Read it alongside your EU-side policies rather than assuming one document covers both.

For England's equivalent position, the rules are set out in this guide to commerce reviews data protection.

Where the regimes diverge for reviews

Both regimes treat a review as personal data when it identifies a person, directly or indirectly. A display name plus an order reference can identify someone. A photo attached to a review usually does too.

The divergences that matter for retail teams are narrower than the shared principles suggest:

A Belfast retailer with one review platform and two markets therefore needs two transfer stories, not one. That is the single most common gap found in Northern Ireland ecommerce operations.

Storing review data when you sell into both markets

Storage location drives the analysis. If review data sits in a Belfast data centre and never leaves the UK, the UK transfer rules are not engaged for that copy.

The moment a copy goes to a support desk in another country, a moderation vendor, or a marketing analytics platform outside the UK, a transfer occurs and a transfer tool is needed.

The same logic applies on the EU side. Review data relating to EU shoppers that is exported from the EU to a UK platform is an EU-to-UK transfer. The UK has an adequacy position from the EU, which simplifies many of these flows.

But adequacy is a status that can be reviewed, so relying on it without a fallback is a risk worth naming in your records.

Northern Ireland review data often ends up in three places at once: the primary store, a backup region, and a moderation or analytics tool. Each destination is a separate flow with its own legal basis and its own safeguards.

A worked example: Belfast retailer, two markets

Take a Belfast retailer with a Shopify storefront, a review app that stores content in Ireland, and a moderation team in the Philippines.

That structure is ordinary, but it is rarely written down. Writing it down is the difference between a defensible position and an improvised one.

Choosing where review data lives

For most Northern Ireland retailers the simplest defensible setup is to keep primary review storage in the UK or the EU and to treat every other location as an exception with its own paperwork. This reduces the number of transfer tools in play and makes the record of processing activities shorter.

Where a platform insists on storing review data in the United States, the transfer analysis is unavoidable. The UK Extension to the EU-US Data Privacy Framework can provide a route for UK transfers to certified US organisations, and the EU-US Data Privacy Framework can do the same on the EU side.

Certification status must be checked at the time of the transfer, not once at contract signature.

Named ICO guidance on transfers, rights and lawful basis

Three areas of ICO guidance do most of the work for review platforms. The first is the UK GDPR guidance already cited, which covers lawful basis and accountability. The second is the ICO's Individual rights - guidance and resources, which matters because reviewers hold rights over their review content.

Reviewers can ask for access to their review data, for correction of inaccurate content, and for erasure in the right circumstances. A review platform that cannot locate a reviewer's records across the store, the app and the moderation tool will struggle to answer those requests inside the statutory window.

The ICO's rights guidance sets out what each right covers and the exemptions that may apply.

The third area is the ICO's Data sharing | ICO guidance. Review data is shared constantly: with the software vendor, with moderation suppliers, with analytics providers and sometimes with group companies. The data sharing guidance covers the difference between a controller-to-controller sharing arrangement and a controller-to-processor arrangement, which determines what the contract must say.

Lawful basis for publishing a review

Publishing a review is a processing operation in its own right. Most retailers rely on legitimate interests for publishing, balancing the commercial interest in social proof against the reviewer's expectations. Consent is sometimes used for marketing reuse of review content, such as putting a quote in a paid advertisement.

The distinction matters because consent can be withdrawn. If a retailer builds a review wall on consent and then cannot unpick the consent, it has a problem. Legitimate interests, documented with a legitimate interests assessment, is usually the more durable basis for the core publishing activity.

Special category data in reviews

Reviews occasionally contain health information, for example a supplement review that describes a medical condition. That is special category data and needs an Article 9 condition, not just a lawful basis. Moderation rules that strip or flag such content reduce the exposure, but they do not remove the need to handle it correctly when it appears.

Transfer tools and safeguards for customer review software

Transfer tools are the mechanisms that make a restricted transfer lawful. For UK outbound transfers the main options are an adequacy regulation made under UK law, the International Data Transfer Agreement, and the International Data Transfer Addendum to the EU Standard Contractual Clauses.

For EU outbound transfers the options are an EU adequacy decision, the EU Standard Contractual Clauses, and binding corporate rules for intra-group flows.

The choice usually follows the destination. If the destination country has a UK adequacy regulation, no further tool is needed for that leg. If it does not, an IDTA or the Addendum is the standard route, supported by a transfer risk assessment.

The transfer risk assessment is where most retail teams underinvest. It is not a formality. It asks whether the law and practice of the destination country undermine the safeguards in the contract, and it should be revisited when circumstances change.

Safeguards beyond the contract

The contract is the floor, not the ceiling. Useful supplementary measures for review data include encryption in transit and at rest with keys held in the UK or EU, pseudonymisation of reviewer identifiers before analytics use, and access controls that limit moderation staff to the fields they need.

For Northern Ireland retailers, keeping encryption keys inside the UK or EU is a practical safeguard that is easy to explain to a regulator and easy to verify in an audit. It also survives a change of subprocessor better than a contractual promise alone.

Vendor selection questions

When assessing customer review software, ask where review content is stored, where backups are held, which subprocessors touch the data, and which transfer tool the vendor offers. A vendor that cannot answer these questions in writing is a transfer risk in itself. For a structured approach, see this guide to commerce reviews vendor due diligence.

Documenting review data flows for Northern Ireland operations

The record of processing activities is the backbone of the whole position. It should list each processing activity involving review data, the purpose, the categories of data, the recipients, the retention period and the transfer details. For a Belfast retailer this record is the document a regulator will ask for first.

A data flow map is the practical companion. Draw the route of a review from submission to publication to analytics, marking every border it crosses. Most teams find at least one flow they had not considered, often a support tool or an email marketing platform.

Ownership matters as much as documentation. Someone must own the review dataset and the vendor relationships around it, otherwise transfer questions sit unanswered between marketing, IT and legal. The split of responsibilities is set out in this piece on commerce reviews data and source ownership.

A documentation checklist

Retention and deletion of review content

Review content is often kept indefinitely because it is useful marketing material. That habit conflicts with storage limitation. Define a retention period, apply it, and make sure deletion reaches backups and vendor systems as well as the live store.

If a reviewer asks for erasure, the retailer needs to know whether the review is published, syndicated, cached or copied into an analytics tool. Each copy is a place the deletion must reach. That is why the flow map and the retention schedule belong together.

Keeping the position current

Transfer law moves. Adequacy decisions are reviewed, new frameworks appear, and the ICO updates its guidance. A Belfast retailer selling into both markets should diarise a review of its transfer position at least annually, and sooner when a vendor changes its hosting region.

The same discipline applies to the review platform itself. When a vendor migrates to a new cloud region, the transfer analysis changes even though the contract has not. Treat hosting changes as a trigger for review, not as an operational detail.

Common questions