How to check a US attribution vendor's data transfers from the UK

What to take away

What the EU adequacy decision does and does not cover for UK buyers

The EU adequacy decision is often the first thing a UK buyer hears about when a US attribution vendor explains its compliance story. It matters, but not in the way sales teams sometimes imply.

The EU adequacy decision is a finding by the European Commission that a third country provides an adequate level of protection for personal data. It lets data flow from the EU to that country without extra safeguards.

For a UK buyer, the EU adequacy decision is relevant only if the data is leaving the EU, or if the vendor's European entity is the contracting party. If your attribution software contract is with a UK entity and the data goes from the UK to the US, the EU adequacy decision is not the mechanism you rely on.

The UK has its own regime.

The UK's adequacy regulations are separate from the EU's. The ICO publishes the list of countries and territories the UK treats as adequate, and that list is what a UK controller should check first.

The adequacy regulations page sets out how the UK's adequacy findings work, including the UK's own extensions for US data flows.

Where the confusion bites is the US. The EU-US Data Privacy Framework is an EU mechanism. The UK has its own extension, the UK-US data bridge, which is not the same instrument.

A US attribution vendor that is certified under the EU framework may or may not be on the UK extension list. Check the UK list, not the EU one.

The EU adequacy decision also does not cover onward transfers. If your US attribution vendor sends data to a sub-processor in another country, the vendor still needs a lawful route for that onward transfer. Adequacy at the first hop does not travel automatically.

For UK procurement teams, the practical point is simple. Ask the vendor which legal route applies to UK-origin data, and ask for the document that proves it. If the answer is only "EU adequacy", the answer is incomplete.

The UK's own transfer mechanisms after the UK-US data bridge

The UK-US data bridge is the UK's extension to the EU-US Data Privacy Framework. It allows UK controllers to send personal data to US organisations that are certified under the UK extension, without needing a separate transfer mechanism for that flow.

The UK-US data bridge: supporting documents collection explains how the extension works and which US organisations are covered.

The bridge is not a blanket permission for all US vendors. It applies to organisations that have certified to the UK extension of the framework. If your attribution vendor has not certified, the bridge does not help you. You fall back on the IDTA, the addendum or another appropriate safeguard.

The bridge also does not remove the need for a transfer risk assessment. The UK approach expects a risk-based assessment even where a mechanism is in place. The ICO's international transfers guide sets out the checks a UK controller should make, including the role of the transfer risk assessment.

A common pattern in attribution software procurement is a US vendor that is certified under the EU framework but not the UK extension. The vendor's privacy page says "Data Privacy Framework certified" and the UK buyer assumes the bridge applies. It may not. Ask for the certification scope and the UK extension entry.

The bridge can also be withdrawn or changed. The UK government has shown willingness to adjust its adequacy findings, so treat the bridge as a current position rather than a permanent one. Record the date you checked and the evidence you saw.

If you are investigating an attribution vendor, the transfer route should sit alongside the commercial and technical checks, not after them. A vendor that cannot name its UK transfer route is a vendor that has not thought about UK buyers.

Standard contractual clauses, the IDTA and the addendum compared

Standard contractual clauses are pre-approved contract terms that controllers and processors can use to legitimise a restricted transfer. The UK has its own versions: the International Data Transfer Agreement (IDTA) and the International Data Transfer Addendum to the EU Standard Contractual Clauses. The ICO's appropriate safeguards page explains when each applies.

The IDTA is a standalone UK instrument. It is designed for transfers from the UK to a third country and is the default choice for new UK contracts. The addendum is for organisations that already use the EU standard contractual clauses and want to extend them to UK transfers. It sits alongside the EU clauses rather than replacing them.

A US attribution vendor will often have EU standard contractual clauses in place already. That is useful for EU data, but it does not automatically cover UK data. The addendum is the usual fix. If the vendor refuses to sign the addendum, ask why, and get the answer in writing.

The IDTA and the addendum both require a transfer risk assessment. They are not tick-box documents. The clauses allocate responsibility, but the controller still has to assess the risk in the specific transfer.

When you review attribution contracts, clause by clause, the transfer clauses should be read with the data processing agreement, the sub-processor terms and the audit rights. A transfer clause without audit rights is hard to enforce.

Watch for vendors that present the EU standard contractual clauses as if they were the UK instrument. The two are related but not interchangeable. The UK addendum is what makes the EU clauses work for UK-origin data.

Running a transfer risk assessment on a US attribution vendor

A transfer risk assessment is the documented process of assessing whether the destination country's laws and practices undermine the protections in the transfer mechanism. The ICO's transfer risk assessment guidance sets out the method.

For a US attribution vendor, the assessment should cover the data categories, the volume, the onward transfer chain and the vendor's ability to resist government access requests.

The assessment is not a one-off. Revisit it when the vendor changes sub-processors, when the bridge changes, or when your own data use changes. Attribution software often expands in scope after the first year, and the transfer picture changes with it.

If you are selecting attribution software, put the transfer risk assessment in the same workstream as the technical evaluation. The two inform each other, especially when the vendor's architecture determines where data sits.

A practical device is a transfer risk assessment checklist you can reuse across vendors. Keep it short enough that procurement will actually fill it in.

The output should be a short memo, not a binder. A named owner, a mechanism, a residual risk statement and a review date are enough to show you did the work.

Vendor documentation to request before signing an attribution software contract

Ask for the documents before the commercial terms are agreed. Vendors are more forthcoming during procurement than after signature. The list below is the minimum for a US attribution vendor handling UK personal data.

If the vendor cannot provide the signed transfer instrument, ask for the draft and a timeline. A draft is not a substitute for a signed document, but it shows intent. If the vendor cannot provide a sub-processor list, that is a problem, because onward transfers are where many US attribution vendors lose control of the data.

The vendor's privacy policy is not enough. Policies describe intent; contracts and certifications describe obligations. Ask for the documents that create the obligation.

When you are choosing attribution tools by admission file, the transfer documentation is part of the admission file. A vendor that cannot produce it should not reach the shortlist, however good the attribution model looks.

For UK buyers, the ICO's international transfers guide is the reference point for what good looks like. Use it to frame the request, and cite it in your internal papers.

Red flags in a US attribution vendor's transfer paperwork

Some problems recur. A vendor that says the UK-US data bridge covers everything is overstating it. The bridge covers certified organisations and specific flows, not all transfers to the US.

A vendor that offers only EU standard contractual clauses for UK data is missing the UK addendum. That is fixable, but it tells you the vendor has not separated the UK from the EU in its compliance work.

A vendor that cannot name its sub-processors, or lists them as "various", is a vendor with an onward transfer problem. You cannot assess risk you cannot see.

A vendor that has no transfer risk assessment of its own, and no willingness to support yours, is asking you to take the risk on its behalf. That is not a partnership.

A vendor that claims the EU adequacy decision covers UK data is confusing two regimes. It may be a sales simplification, but it is the kind of simplification that ends up in a contract.

A vendor that will not sign the IDTA or addendum without an indemnity that shifts all transfer risk to you is worth a second look. Indemnities are negotiable, but the starting position tells you how the vendor sees the risk.

Finally, a vendor that cannot produce a breach history, or says it has never had one, deserves a follow-up question. Ask about incidents at the parent company and at any acquired entities.

Common questions