View of the Lagan River with the Belfast skyline, showcasing modern and historic architecture.
Photo by Donovan Kelly on Pexels

Rules and ethics

Marketing analytics across Belfast and Ireland

Marketing analytics across Belfast and Ireland: practical guidance on consent, data transfers and attribution for campaigns spanning two jurisdictions.

What to take away

  • Marketing analytics for Belfast teams works best when you treat UK and EU data flows as two connected pipelines, not one.
  • Receiving personal information from the EEA is lawful under UK GDPR, but the ICO expects a documented transfer mechanism and a record of it.
  • Currency handling and VAT place of supply are separate questions: one affects reported revenue, the other affects what you charge and remit.
  • Northern Ireland attribution needs a shared customer key, a single reporting currency and campaigns tagged by jurisdiction from day one.
  • Overlapping campaigns on both sides of the border distort channel comparisons unless you deduplicate users before you model credit.

UK and EU data flows across the Irish border from Belfast

A Belfast team running campaigns in Ireland is moving personal data between two legal regimes. The UK runs on UK GDPR and the Data Protection Act 2018, with the ICO as regulator. Ireland runs on EU GDPR, with the Data Protection Commission in Dublin. The rules rhyme, but they are not the same text.

UK GDPR vs EU GDPR

UK GDPR

Regulator
ICO
Law
DPA 2018
Hashed email
Personal data
Device IDs
Count
Session field
Country needed

EU GDPR

Regulator
DPC Dublin
Law
EU GDPR
Hashed email
Personal data
Device IDs
Count
Session field
Country needed

That matters most for identifiers. A hashed email collected in Dublin and matched to a Belfast CRM record is a transfer of personal data, even if the hash never leaves your warehouse. Device identifiers and IP addresses count too.

If you are mapping personal data and device tracking, row by row, the jurisdiction of collection is a field you need, not an afterthought.

Northern Ireland's position is unusual. The Northern Ireland Act 1998 set the constitutional baseline for devolved governance, and data protection has since been shaped by the UK's post-Brexit settlement rather than by Brussels.

In practice, a Belfast analyst can lawfully process data under UK rules while a Dublin colleague processing the same customer must follow EU rules.

Practical consequence: your tag management, consent banner and retention schedule need to know which side of the border a session started on. Most analytics stacks do not capture that by default. Add a country field at collection, and keep the consent record with it.

A consent management platform such as OneTrust and a tag manager such as Google Tag Manager can pass consent status and jurisdiction to permitted tags. Configure them so the consent record stays associated with the session.

Receiving personal information from the EEA and what it means here

When data travels from Ireland into the UK, the UK is the recipient. The ICO's guidance on receiving personal information from the EEA sets out what a UK controller should have in place. It is short, and it is the document your legal reviewer will ask for.

EEA-to-UK transfer checklist

  • Transfer rests on recognised mechanism
  • Record the transfer in a register
  • Review the transfer periodically
  • Update privacy notice for importer
  • Assess third-country processor flows
  • Align retention with exporter

The core expectation is that the transfer rests on a recognised mechanism, and that you can show what it is. For most Belfast marketing teams that means either an adequacy-based route or standard contractual clauses, depending on the data and the exporter.

For an Ireland-to-UK transfer, record whether the European Commission's adequacy decision for the UK covers the data flow. The UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses and a transfer risk assessment (TRA) are relevant to restricted transfers from the UK to a third country; they do not replace documenting the incoming route.

The ICO also expects you to record the transfer, review it, and give individuals clear information about it.

Three things go wrong most often. First, the importer signs the clauses but nobody updates the privacy notice. Second, the data flows through a processor in a third country without a fresh assessment. Third, retention is set by the exporter and ignored by the importer. Each is fixable with a line in a register.

If you are negotiating the paperwork with an agency or platform, attribution contracts, clause by clause is a useful companion. It forces the data role question early, which is where most cross-border disputes actually start.

Currency handling and VAT place of supply for cross-border campaigns

Currency handling is the quieter problem. A campaign that spends in euros and reports in sterling will show a different return on ad spend depending on the rate you pick.

Currency and VAT choices

Currency handling

Convention
Fixed monthly rate
Alternative
Daily transaction rate
Rule
Do not mix
Report impact
ROAS changes
Split line
Media vs fee

VAT place of supply

Convention
Customer location
Alternative
Reverse charge
Rule
B2B outside UK VAT
Report impact
Invoice only
Split line
Disbursement vs service

Pick one convention and write it down: either a fixed monthly rate from a published source, such as HMRC's monthly exchange rates, or the daily rate at transaction time. Record the source and period, apply it consistently within a report, and ask finance to confirm whether the same convention is suitable for tax reporting.

For business-to-business services, the place-of-supply rules in the VAT Act 1994 and HMRC's VAT Notice 741A, Place of supply of services, generally put the supply where the customer belongs. The EU VAT Directive applies the corresponding general rule in Ireland. A Belfast agency billing an Irish business client will generally not charge UK VAT, with the client accounting for Irish VAT under the reverse charge, subject to the service and customer status.

This is where the reporting gets interesting. VAT place of supply affects what you invoice, not what you measure, but the two get tangled when platform fees, media spend and management fees sit on one line. Split them. Media spend is usually a disbursement; your fee is the service.

HMRC guidance on cross-border services is a starting point. VAT Notice 741A, Place of supply of services, is the detailed HMRC reference for place of supply; check current HMRC registration guidance separately. Keep the invoices and the attribution reports aligned by period, or your finance team will reconcile two different versions of the same campaign.

Currency handling and VAT place of supply

Currency handling

What it affects
Reported revenue and ROAS
Main risk
Inconsistent FX rates across reports
Who owns it
Analytics lead
Fix
One documented rate convention

VAT place of supply

What it affects
Invoicing and remittance
Main risk
Wrong VAT treatment on fees
Who owns it
Finance lead
Fix
Confirm customer status and location

Overlapping campaigns measuring audiences on both sides of the border

Belfast sits within easy reach of Dublin, Newry and Dundalk, and audiences do not respect the border. A single paid social campaign can reach users in both jurisdictions within a few miles. If your reporting splits them by country, you will see two smaller, noisier datasets instead of one useful one.

Cross-border campaign checklist

  • Every session carries jurisdiction attribute
  • Consent records stored with session
  • One FX convention documented
  • VAT treatment confirmed with finance
  • Users deduplicated on stable key

There is a middle path. Keep the campaign unified for delivery, but tag every session with a jurisdiction attribute. Then report both ways: a combined view for performance, and a split view for compliance and budget. This avoids the common failure where a strong Irish result is buried inside a weak UK average.

The same person can appear as a UK user on one device and an Irish user on another, particularly with shared accounts. Deduplicate on a stable, consented first-party customer ID before you assign credit, or your conversion counts will exceed your sales.

Choose one attribution model, such as last-click or data-driven attribution, and apply it consistently to combined and jurisdiction-split reports. Do not add the results from those two views together.

When you are comparing tooling for this, comparing attribution pricing structures on identical fields is a practical way to see what each vendor charges for cross-border segmentation before you commit.

  • Every session carries a jurisdiction attribute at collection.
  • Consent records are stored with the session, not separately.
  • One FX convention is documented and applied consistently.
  • VAT treatment on fees is confirmed with finance.
  • Users are deduplicated on a stable key before credit assignment.
  • Retention periods are set per jurisdiction, not globally.
  • The transfer mechanism for EEA data is recorded and reviewed.

Setting up attribution when one audience spans two jurisdictions

Use the same jurisdiction field throughout the analytics platform. For example, in Google Analytics 4 (GA4) register it as a session-scoped custom dimension; in Adobe Analytics map it to an eVar; in HubSpot store it in a custom property.

Consider a Belfast retailer that sells online in both Northern Ireland and the Republic, spends in euros on Meta and sterling on Google, and reports in sterling. Belfast retailer

Cross-border attribution setup

  1. Define customer key and jurisdiction
  2. Separate money layer by currency
  3. Tag campaigns by jurisdiction
  4. Apply and log transfer mechanism
  5. Reconcile monthly before publishing

Step one: Map where data is collected and attach the jurisdiction and consent record to each session.

Step two: Pass the jurisdiction field through your tag manager and analytics platform, using the same field definition in each system.

Step three: Record the transfer route for EEA data and review any onward transfers separately.

Step four: Set one reporting currency and FX convention; keep media spend, platform fees and your service fee distinguishable in reports and invoices.

Step five: Deduplicate on a stable, consented first-party customer ID, then report both combined and jurisdiction-split results using the same attribution model.

Step five is the one teams skip. Cross-border attribution fails quietly when refunds, currency and jurisdiction are handled in three different places.

Before you sign anything, investigating an attribution vendor before procurement is worth the hour. Ask how they handle jurisdiction fields, FX conventions and EEA transfers in writing. A vendor that cannot answer all three will cost you more in reconciliation than it saves in licence fees.

Common questions

Does UK GDPR adequacy cover data coming from Ireland?
The UK has an adequacy arrangement with the EU, which is the usual basis for EEA to UK transfers. It is reviewed periodically, so confirm the current position with the ICO guidance before relying on it.
Which currency should a Belfast team report in?
Sterling is the practical default for UK-based reporting, with euro spend converted at one documented rate. What matters is consistency, not the choice of currency.
Is VAT charged on attribution services sold to an Irish client?
Usually not by the UK supplier, because business-to-business services are supplied where the customer belongs. The Irish client accounts for VAT under the reverse charge. Confirm the customer's status first.
Can one attribution model serve both jurisdictions?
Yes, if jurisdiction is captured as a session attribute and the model reports both combined and split views. Without that attribute, the model will blend two different consent and retention regimes.
What is the biggest cross-border attribution mistake?
Treating the border as a reporting filter rather than a data collection field. By the time the data reaches the dashboard, the jurisdiction information is usually gone.

More in Rules and ethics