Marketing automation software: Belfast compliance setup

What to take away

Configuring marketing automation software for two rule sets

Candidate platforms for a Belfast shortlist include HubSpot, Dotdigital, Klaviyo, Brevo, ActiveCampaign and Mailchimp — assess each one on whether its workflows can represent UK and Irish rules separately, rather than on its template gallery. For Belfast teams, the review should verify jurisdiction-specific consent, suppression, branching and transfer-record handling in the product itself.

Four questions separate them:

Treat these as capabilities to verify, not assumed features. In a trial account of each shortlisted platform, create UK and Irish test contacts, exercise the relevant branches and withdrawals, and check the exported records. Record the outcome as a short dated review note per platform, and do not infer that custom fields or branching alone provide jurisdiction-scoped suppression.

Where to configure the split in each shortlisted platform

This list is a starting point for your trial. Platform behaviour changes, so confirm each point against the vendor's current documentation and your own test contacts.

In every case, create a UK and an Irish test contact, withdraw consent for one, and confirm the other still receives the correct message. Keep the dated result as the review note for that platform.

Two data protection regimes in one Belfast automation setup

Belfast sits in a jurisdiction where marketing operations routinely touch two legal systems.

The United Kingdom operates under UK GDPR and the Data Protection Act 2018 (the UK rules guide sets out the wider legal questions). The Republic of Ireland operates under the EU GDPR and the Data Protection Act 2018 (Ireland). Both derive from the same source text, but they are enforced by different authorities and interpreted through different national guidance.

The ICO enforces in the UK. The Data Protection Commission (DPC) enforces in Ireland.

UK controllers also have a registration duty: the ICO's annual data protection fee is set in three tiers of fees based on the size and turnover of the organisation, with tiers 1 to 3 raised in February 2025 from £40, £60 and £2,900 to £52, £78 and £3,763. Check the ICO's fee page for the figure in force, and treat it as a fixed annual cost of the Belfast setup.

That split is not a technicality. It changes breach notification clocks, subject access response times and the lawful bases you can rely on for direct marketing. A Belfast marketing operations lead needs the automation platform to hold both rule sets and apply the correct one at the point of send.

The UK GDPR is the EU GDPR as retained in UK law by the European Union (Withdrawal) Act 2018 and since amended, so Regulation (EU) 2016/679 is largely the same text read on the EU side. It is the starting point for consent, breach and transfer duties in both jurisdictions, and Belfast teams should check the wording their platform is configured against in the regulation itself rather than in a vendor summary.

Northern Ireland also has its own legislative record, which affects how some UK-wide provisions are applied locally. The Northern Ireland legislation section on legislation.gov.uk is where Belfast teams verify the local position rather than assuming a Great Britain default.

Separating UK GDPR duties from Irish data protection duties

The cleanest approach is to treat jurisdiction as a first-class field in the automation platform. Every contact record carries a jurisdiction tag: UK or IE. Every workflow branches on that tag before it does anything else.

In most platforms this is a custom contact property named Jurisdiction with the values UK and IE — HubSpot and Klaviyo work this way — plus a first workflow condition: if Jurisdiction = IE, follow the Irish path; otherwise follow the UK path.

UK GDPR duties for Belfast teams include the ICO's expectations on lawful basis, transparency and individual rights. Irish data protection duties cover the same broad categories, but they are applied through the DPC's own guidance and supervisory practice.

For a notifiable personal data breach, the controller must notify the relevant authority without undue delay and, where feasible, within 72 hours of becoming aware. In the UK the route is the ICO's personal data breach reporting form; in Ireland it is the DPC's breach notification form. A platform breach log does not submit a notification by itself, so name an owner in each jurisdiction and check the applicable route for each case.

Data sharing rules for cross-border UK and Ireland campaigns are set out by the ICO, and they apply whether the sharing is between group companies or with a processor. The ICO's data sharing guidance is the reference Belfast teams should map their workflow branches against.

These are separate legal questions, not one question asked twice. Treating UK and Irish duties as a single compliance task is the most common error in Belfast cross-border automation.

Currency and VAT handling across the border

Currency and VAT handling across the border is where marketing automation meets finance, and where Belfast teams lose time if the platform cannot hold two tax logics.

Sterling and euro pricing must both exist in the platform if you run paid campaigns, gated content with a price, or event registrations on both sides of the border. A single-currency setup forces manual conversion and creates inconsistent customer experiences.

VAT is the harder problem. UK VAT applies to sales in the United Kingdom and Irish VAT applies to sales in the Republic of Ireland; the standard UK rate is 20 per cent and the standard Irish rate is 23 per cent. Pass jurisdiction and customer type to the finance system, and confirm whether a transaction is in scope and how it must be invoiced with HMRC on the UK side or Revenue on the Irish side before you configure a tax-triggered workflow.

Your automation platform does not calculate VAT, but it must pass the correct jurisdiction and customer type to whatever does.

Northern Ireland has a distinct position on goods movements under the Windsor Framework, which affects some cross-border transactions. The scheme that covers goods moving from Great Britain to Northern Ireland is the UK Internal Market Scheme, so that is the point to check when a campaign can generate a physical order.

A practical rule: if a workflow can trigger an invoice, it must carry a VAT jurisdiction field. If it cannot trigger an invoice, keep the currency field anyway for reporting.

Cross-border data flows and transfer records

Cross-border data flows between the UK and Ireland are transfers for data protection purposes, even though the two countries are close neighbours. The UK has adequacy regulations for the EU, and the European Commission renewed its adequacy decisions for the UK in December 2025, so both remain in place until 2031. The paperwork still exists.

The ICO's international transfers guidance explains the mechanisms available and the records you must keep. Belfast teams should read the ICO's guidance on international transfers before configuring any workflow that moves contact data between UK and Irish systems.

Transfer records are not a one-off exercise. Every new integration, every new sub-processor and every new automation branch that moves data across the border adds a record. A CRM sync, a webinar registration tool, a live chat widget and an analytics tag each count. If your platform cannot produce a transfer log, you are relying on manual reconstruction during an audit.

A simple transfer record contains: the data categories, the sender, the recipient, the mechanism relied on, and the review date. Five fields. Name the mechanism rather than writing "adequate safeguards": on the UK side that means the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and on the EU side the EU Standard Contractual Clauses or an adequacy decision. The ICO's transfer risk assessment tool is the companion document for the risk analysis behind the mechanism. If your automation platform stores those five fields against each integration, you are ahead of most Belfast teams.

Consent and suppression lists that must not merge by accident

Consent and suppression list separation is the operational heart of Belfast cross-border automation. If a contact withdraws consent in Ireland, that withdrawal applies to Irish processing. It does not automatically apply to UK processing unless the contact also withdraws there.

Merging the two lists creates two failures. First, you suppress people who have not withdrawn, which costs revenue. Second, you fail to suppress people who have withdrawn in the other jurisdiction, which creates a compliance risk.

The fix is to hold consent state per jurisdiction per contact. A single contact record can be opted in for UK email and opted out for Irish email. The automation platform must respect both states independently.

Suppression lists work the same way. A global suppression list is convenient but wrong for cross-border operations. Use jurisdiction-scoped suppression, with a separate global list only for hard bounces and abuse complaints.

Validate consent records before building campaign logic on top of them. Migrations are where this goes wrong, so move permission evidence first when changing platforms. The instruction is simple: check the evidence, then automate.

Withdrawals and objections need the same care. Record how objections and withdrawals travel through the workflow, because that record is what proves compliance months later.

A worked Belfast campaign split across both regimes

Here is a hypothetical example. A Belfast software company runs a webinar campaign targeting operations managers in Belfast, Dublin and Cork. The campaign uses email, SMS, calls and owned web journeys, and each channel carries its own consent rules on each side of the border.

Consent rules by channel

The workflow has six checks:

Record currency, VAT and transfer details in the same workflow, but do not treat them as channel-specific steps. The table below maps the two regimes.

Common questions