What ICO rules govern UK data flows for multilingual social campaigns into the EU?

What to take away

What ICO international transfers guidance means for multilingual social campaigns

The ICO is the UK regulator for data protection and electronic marketing. Its international transfers guidance is the starting point for any campaign that moves personal data out of the UK, including to EU markets. Read it before you brief a media plan, not after.

A multilingual campaign rarely keeps data in one place. A London agency loads an audience list, a Dublin platform team builds lookalikes, and a Warsaw creative studio sees performance cuts. Each hop is a transfer.

UK GDPR does not ban transfers. It requires a lawful route, plus a transfer risk assessment where the route is not adequacy. The ICO guidance sets out those routes and what a transfer risk assessment should cover.

The guidance also draws a line between a transfer and mere transit. Data passing through EU servers without being accessed or stored elsewhere is not automatically a restricted transfer. Campaign tooling makes that line hard to hold, so document your reasoning.

For teams running several languages, the practical risk is sprawl. Welsh, Polish and German ad variants may sit in different ad accounts, each with its own data processing terms. The ICO expects you to know where the data goes. That is the same discipline set out in our guide to Data protection for multilingual campaigns.

One common mistake is treating the EU as one destination. It is a set of member states with different supervisory authorities. A complaint about a German ad variant lands with a German authority, not the ICO, even if the controller is British.

UK GDPR transfer routes when campaign data moves into the EU

Adequacy is the simplest route. The UK recognises the EU, plus Norway, Iceland and Liechtenstein, as adequate. Sending campaign data from a UK controller to an EU processor normally needs no extra transfer mechanism.

Adequacy is not permanent and not unconditional. It can be reviewed, and it does not cover onward transfers from the EU to a third country. If your EU agency sends data to a US ad platform, that onward leg needs its own basis.

The reverse direction is the one people forget. An EU brand sending data to a UK agency is an EU transfer, governed by EU rules, and needs an EU-side mechanism. UK adequacy helps here too, but the paperwork sits with the EU exporter.

Where adequacy does not apply, the main routes are:

Pick the route before contracts are signed. Retrofitting an IDTA into a live campaign means re-papering every agency and platform in the chain, in every language, under time pressure.

PECR and consent rules for multilingual social advertising

PECR is the UK's electronic marketing rule set, and it runs alongside UK GDPR. It covers email, SMS, calls and, importantly for social, the storage of information on a user's device.

The ICO's Guide to Privacy and Electronic Communications Regulations | ICO explains the consent standard for electronic marketing. Consent must be specific, informed and freely given, and it must name the organisation.

Paid social ads are not email, so the soft opt-in does not apply. If you are targeting people by email address or phone number through a custom audience, you need PECR-compliant consent for that channel.

Language changes the consent text, not the standard. A Welsh-language consent banner must be as clear as the English one. A translated banner that buries the ad partner list is still non-compliant.

Consent must also be recorded. Keep the wording, the language, the timestamp and the source for each consent event. When a campaign runs in four languages, that means four versions of the record, not one translated after the fact.

PECR enforcement sits with the ICO, and fines are issued against the sender or the instigator. An agency that builds and sends the campaign can be in scope alongside the brand. That risk belongs in your commercial contracts, not in a verbal understanding.

Cookies, tracking and storage technologies in cross-border campaigns

Social platforms drop cookies and similar technologies on your behalf. PECR regulation 6 covers that storage and access, and it applies regardless of where the platform sits.

The ICO's Online tracking | ICO guidance sets out expectations for cookies and tracking. Consent must be collected before non-essential storage, and rejecting must be as easy as accepting.

Ad measurement pixels are non-essential. Conversion tracking, retargeting and audience matching all depend on them. If your banner offers accept and reject but the reject path still fires a pixel, the consent is not valid.

Cross-border adds a wrinkle. A pixel set by a UK controller on an EU user's device may trigger both UK and EU consent duties, depending on where the user sits and which entity is the controller.

The measurement layer is where campaigns quietly leak data. A translated landing page that loads a different tag manager from the English version creates a second, undocumented flow. Audit tags per language, not once for the campaign.

Consent rates also differ by market. German users reject tracking more often than UK users in many sectors, which distorts cross-market comparison. Our piece on measurement mistakes covers how that skew shows up in reports.

Data sharing between UK brands and EU agencies

Most multilingual campaigns are a joint effort. The UK brand holds the customer data, the EU agency builds the creative, and the platform measures the result. Each pair is a data sharing arrangement.

The ICO's Data sharing | ICO guidance covers how to structure those arrangements. You need a clear basis for sharing, a written agreement, and a defined purpose.

Decide who is controller and who is processor for each activity. Audience building is usually controller-to-controller. Media buying on instruction is processor work. Mixed roles in one contract cause most disputes.

Data minimisation matters more across borders. If the Warsaw studio only needs ad copy and market notes, do not send it the customer list. Pseudonymise where the creative task allows.

Retention must be agreed per party. A platform may hold campaign data for its own product purposes long after your retention period ends. Say so in the contract, and check the platform terms.

Sub-processors are the weak link. An EU agency using a Turkish editing tool has created another transfer. Require prior notice of sub-processors and a right to object.

Practical steps before a UK-EU multilingual campaign goes live

Work through these in order. Each one produces a document you can show the ICO if a complaint arrives.

Then run this pre-launch checklist:

Two UK quirks are worth building in. The Welsh Language Commissioner's standards may require Welsh-language customer communications for public bodies in Wales, which affects consent text. In Scotland, Gaelic is a minority language with its own expectations, though not a general legal duty for private marketers.

Keep the evidence together. A single folder per campaign, with the flow map, the contracts, the consent records and the tag audit, is enough for most queries. Our guide to Mapping UK rules shows how to sequence that work geographically.

Where the Data (Use and Access) Act 2025 changes the picture

The Data (Use and Access) Act 2025 amends UK data protection law. For marketers, the changes touch transfers, cookies, complaints and automated decision-making.

On transfers, the Act gives the Secretary of State a broader power to recognise adequate jurisdictions and to approve new transfer mechanisms. That should mean more routes over time, but the detail arrives through secondary legislation.

On cookies, the Act narrows the consent exception for certain low-risk purposes, including some analytics and security uses. It is not a free pass for advertising pixels. Ad measurement still needs consent.

Complaints handling changes too. Controllers get a defined window to respond to data subject complaints before a complaint goes to the ICO. That means a documented process, not an inbox.

The Act also adjusts the rules on automated decision-making, which matters if your campaign tooling scores or segments audiences automatically. Check whether a decision is solely automated and whether a safeguard applies.

Nothing in the Act removes the need for a lawful transfer route. Adequacy decisions, IDTAs and the Addendum all remain in use. What changes is the menu, and the pace at which new options appear.

Review your transfer register once the secondary legislation lands. Until then, keep using the routes you have, and keep the evidence. A marketing dashboard that flags missing consent records per market will catch most gaps before an audit does.

One more thing to watch. The ICO's International transfers | ICO guidance is updated as the Act is commenced, so dated printouts go stale quickly. Link to the live page in your internal wiki rather than saving a PDF.

Common questions