Cross-border outreach UK GDPR transfers and call rules

What to take away

UK GDPR adequacy decisions and what they cover

Adequacy decisions are one route for cross-border outreach UK GDPR transfers. UK GDPR Article 45 provides for UK adequacy regulations, while the EU GDPR (Regulation (EU) 2016/679) has its own adequacy decisions. The UK’s Data Protection (Adequacy) (United States of America) Regulations 2023 (SI 2023/1028) give effect to the UK-US Data Bridge for eligible transfers. Adequacy applies only within the relevant decision’s scope and does not remove other data protection or marketing duties.

For UK agencies, the practical point is this: the EU and EEA are covered by UK adequacy decisions. That means you can transfer prospect data to an EU supplier, or store it in an EU data centre, without drafting standard contractual clauses for that leg.

The same applies to countries like Switzerland, Japan, Canada and New Zealand under UK adequacy rules.

The United States is not generally covered by a UK adequacy decision, but the UK-US Data Bridge—the UK Extension to the EU-US Data Privacy Framework—provides a limited adequacy route. It applies only where the US recipient is certified under the framework and the transfer is within the scope of that certification. For other transfers, use an applicable UK GDPR transfer mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

But that decision is subject to review, so keep an eye on it. The European Commission’s adequacy decision for the UK under the EU GDPR is Commission Implementing Decision (EU) 2021/1772. The EU has an adequacy decision for the UK, so data can flow from the EU to the UK without extra clauses.

But that decision is subject to review, so keep an eye on it.

When you rely on adequacy, document it. Note the country, the decision and its scope. For example, if you use a data centre in Dublin, record that Ireland is covered by UK adequacy. For a US-based CRM, check whether the recipient is covered by the UK-US Data Bridge; if it is not, record the transfer mechanism you rely on instead.

Adequacy does not cover every transfer. It covers transfers to a country, not to a specific organisation. If you send data to a company in an adequate country that then sends it onward to a non-adequate country, you need to check the onward transfer rules. That is a common gap in agency supply chains.

Standard contractual clauses for transfers to the EU and US

Standard contractual clauses are the fallback when adequacy does not apply. They are pre-approved contract terms that bind the exporter and importer to protect personal data. The UK has its own International Data Transfer Agreement and Addendum, while the EU has its own standard contractual clauses.

For UK to EU transfers, you often do not need standard contractual clauses because of adequacy. But if you are transferring data from the EU to the UK, the EU side may still want to put standard contractual clauses in place as a belt-and-braces measure. Some EU clients insist on them regardless of adequacy.

For UK-to-US transfers, first check whether the recipient is certified under the UK-US Data Bridge and whether the transfer falls within that certification. If it does not, you will generally need an appropriate safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, and a transfer risk assessment. The Information Commissioner’s Office (ICO) publishes a Transfer Risk Assessment tool for this.

UK GDPR, which sits alongside the Data Protection Act 2018, sets out the transfer routes. Article 46 provides for appropriate safeguards, including applicable contractual clauses and binding corporate rules approved under Article 47 for transfers within a corporate group. Article 49 contains derogations for specific situations, such as the individual's explicit consent or a transfer necessary for a contract with the individual; these are not a routine substitute for an adequacy decision or appropriate safeguard. Record the transfer route you use and why it applies.

When you sign standard contractual clauses, you need to map the data flow. Who is the exporter? Who is the importer? What categories of data are involved? What is the purpose? For appointment setting, that might be name, job title, business email, phone number and notes on the prospect's interest.

Standard contractual clauses are not a one-off. You need to review them when the law changes or when your sub-processors change. If you switch to a new US email tool, you need to check whether it offers standard contractual clauses and whether it can meet the UK Addendum.

A common mistake is to rely on standard contractual clauses without a transfer risk assessment. The clauses alone are not enough if the destination country's laws undermine them.

If you are an agency handing prospect data to a client, you need to decide who is the controller and who is the processor. That affects which standard contractual clauses module you use.

The EU standard contractual clauses (Decision 2021/914) come in four modules: Module 1 controller to controller, Module 2 controller to processor, Module 3 processor to processor and Module 4 processor to controller. The UK Addendum keeps that numbering, and you record the module you rely on in Table 2 of the Addendum.

The ICO requires controllers to pay a data protection fee under the Data Protection (Charges and Information) Regulations 2018 unless an exemption applies. Complete the ICO’s fee self-assessment and keep a record of your fee or exemption status.

The ICO's guidance on direct marketing using electronic mail is a useful starting point for the outreach side, but it does not replace transfer rules. You can find it at ICO rules for email outreach.

US state privacy laws and how they affect UK outreach

US state privacy laws are not a single law. They form a patchwork; California, Colorado, Connecticut, Virginia and Utah are among the states with comprehensive regimes, and Texas, Oregon and Montana are among the states that have since added their own. These laws can apply to businesses processing residents’ personal data when the relevant scope and threshold tests are met.

The main statutes have different effective dates and thresholds.

For UK agencies, the key question is whether your client is covered. If your client sells to California residents and meets the thresholds, the California Consumer Privacy Act as amended applies. That law gives consumers the right to know, delete and opt out of the sale or sharing of personal data. It also requires notices at collection.

B2B outreach is not exempt. California's law covers business contact data. If you are emailing a California-based prospect on behalf of a client, that prospect may have rights. You need a way to honour opt-outs and deletion requests.

State laws differ in how they define a covered consumer and whether they exclude people acting in a commercial or employment context. California’s CCPA, as amended by the California Privacy Rights Act, can cover business contact data; do not assume that the same rules apply to B2B contact data under every other state law. Check the client’s coverage, the data and its use, and the rights the applicable law provides before setting up opt-out, access or deletion processes.

The practical impact on UK outreach is that you need to be able to identify which state a prospect is in and apply the right rules. That is harder than it sounds. A business email address does not always reveal the state. You may need to rely on the prospect's self-identification or your client's data.

US state privacy laws also affect how you handle opt-outs. If a prospect says stop, you must suppress them across the client's systems, not just your agency's. Your client may also need to update its privacy notice to mention your agency as a processor.

There is no generally applicable comprehensive federal US privacy law that replaces these state regimes. A UK agency should check the laws in the states relevant to its client and prospects, including their scope and thresholds, rather than assume that one national standard applies.

The Data (Use and Access) Act 2025 is a UK law, not a US one, but it affects how UK agencies can use B2B data. It changes some rules on cookies and marketing. You can read it at Data (Use and Access) Act 2025.

Email consent differences between the UK, EU and US

Email consent differences are one of the biggest operational headaches for cross-border outreach. The EU GDPR (Regulation (EU) 2016/679) can apply to a UK agency under its territorial-scope rules, including where the agency offers services to or monitors people in the EU; UK GDPR continues to govern processing within its scope in the UK. For electronic marketing, the EU framework is the ePrivacy Directive 2002/58/EC, implemented through national rules.

A UK agency with no establishment in the EU should assess whether its processing falls within EU GDPR Article 3(2). Where it does, Article 27 generally requires an EU-based representative unless an exemption applies.

In the UK, the Privacy and Electronic Communications Regulations (PECR) govern electronic mail. PECR allows B2B email to corporate subscribers without prior consent if certain conditions are met. The soft opt-in applies when you have obtained the email in the course of a sale or negotiations and you offer an opt-out.

For sole traders and some partnerships, the rules are stricter.

The EU is not uniform. The ePrivacy Directive is implemented through national law: Germany’s Act Against Unfair Competition (UWG), section 7, generally requires prior consent for advertising email, subject to an existing-customer exception; the Netherlands’ Telecommunications Act (Telecommunicatiewet), Article 11.7, sets rules for unsolicited electronic messages; and France’s Code des postes et des communications électroniques (CPCE), Article L.34-5, provides rules for direct marketing. France’s CNIL and the Netherlands Authority for Consumers and Markets (ACM) publish relevant guidance; Germany’s UWG rules are also enforced through civil proceedings, alongside GDPR supervision by the competent German data-protection authorities. Check the applicable national rule before sending.

In the US, the CAN-SPAM Act allows unsolicited commercial email as long as you include a clear opt-out, a physical address and accurate headers. There is no prior consent requirement. California’s Business and Professions Code also contains anti-spam provisions, including restrictions on deceptive commercial email.

The practical approach for a UK agency is to segment by jurisdiction. For UK prospects, PECR governs electronic marketing and UK GDPR requires a lawful basis; legitimate interests does not replace PECR consent where consent is required. For EU prospects, check the member state’s ePrivacy rules as well as the EU GDPR. For US prospects, follow CAN-SPAM and any applicable state law.

Your email platform needs to support these differences. You may need separate templates or suppression lists. You also need to record the consent basis for each prospect. If you rely on legitimate interests, document your legitimate interests assessment.

The ICO has been active on direct marketing enforcement. In 2017 it fined Keurboom Communications Ltd £400,000 over 99.5 million automated nuisance calls. The ICO's guidance on direct marketing using electronic mail is essential reading for SDR teams. It explains the soft opt-in, the opt-out and the rules on corporate subscribers.

If you are unsure, the safer route is to use a lawful basis that works across jurisdictions. That often means consent, but consent is harder to obtain and maintain. Many agencies use legitimate interests for B2B and document it carefully. The internal article on prospect data explains how to handle data when you pass it to a client.

Telephone and social outreach across borders

Before live marketing calls to UK numbers, screen the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS). PECR’s live-call rules in regulation 21 generally prohibit calls to registered numbers unless valid consent applies; automated marketing calls fall under regulation 19 and have separate consent requirements.

US agencies should assess the Telephone Consumer Protection Act (TCPA), FTC Telemarketing Sales Rule and National Do Not Call Registry. The CAN-SPAM Act made explicit that the TCPA applies to calls and faxes originating outside the US, so a UK dialling location is not a reason to ignore it (TCPA cross-border scope). The FTC’s Telemarketing Sales Rule also sets restrictions on the hours of the day and night when unsolicited calls can be made to consumers, as its governing statute directs; its amendments require additional records and prohibit material misrepresentations in B2B calls (FTC telemarketing rules). Check the National Do Not Call Registry for consumer calls and any applicable state rules.

The ePrivacy Directive does not create one uniform EU rule for telemarketing calls; national rules and do-not-call arrangements vary. For example, Germany’s Act Against Unfair Competition (UWG), section 7, regulates unsolicited advertising calls, while France’s Bloctel register and Article L.223-1 of the Consumer Code are relevant to consumer calls. Check the destination country’s rules and whether they distinguish business and consumer recipients.

For social direct messages, assess applicable data-protection and direct-marketing rules as well as the platform’s terms. For LinkedIn outreach, check the LinkedIn User Agreement and Professional Community Policies, including their restrictions on unauthorised automation and scraping.

Time-zone strategy for UK agencies selling abroad

Time-zone strategy is not just about when to call. It affects email open rates, call connect rates and the quality of your outreach. A UK agency selling to US prospects cannot run a 9 to 5 UK schedule and expect to reach California.

The UK is on Greenwich Mean Time in winter and British Summer Time in summer. The US spans multiple time zones. When it is 9am in London, it is 1am in Los Angeles and 4am in New York. That means your US outreach needs to be scheduled outside normal UK hours.

For EU prospects, the time difference is smaller. Central European Time is one hour ahead of the UK in winter. Eastern European Time is two hours ahead. That means you can call EU prospects from 8am UK time and still catch them at 9am or 10am local.

A practical time-zone strategy for UK agencies is to split the day into blocks. Use early morning for EU calls. Use late afternoon and early evening for US East Coast. Use late evening for US West Coast, or schedule emails to arrive at 8am local time.

The table below shows the same windows in UK time.

Those offsets hold in winter and summer, apart from the weeks each spring and autumn when the UK and US change clocks on different dates.

Email scheduling is easier than calling. Most email platforms let you schedule sends by time zone. You can set a campaign to deliver at 8am in the prospect's local time. That avoids the problem of sending at 2am.

Calling is harder. If you are calling US prospects, you need SDRs who are willing to work shifts. Some agencies use a follow-the-sun model. Others use a split shift, with some SDRs starting early and others finishing late. That affects recruitment and retention.

Your time-zone strategy should also consider the prospect's industry. Financial services prospects may have early starts. Tech prospects may work later. You can adjust your windows based on the sector. The internal article on channel strategy covers how to choose between email, phone and social for different markets.

Do not ignore local holidays. American public holidays such as Thanksgiving and Independence Day are not UK holidays. EU countries have their own public holidays. If you send outreach on a holiday, you waste the send and may annoy the prospect. Build a holiday calendar for your key markets.

Building a cross-border outreach record that stands up

A cross-border outreach record is your evidence that you complied with data protection and marketing rules. It should cover every prospect you contact, whether by email, phone or social.

Start with the lawful basis. For each prospect, record whether you rely on consent, legitimate interests or the soft opt-in. If you rely on legitimate interests, record the assessment. If you rely on consent, record when and how it was given.

Record the data source. Did you buy a list? Did you scrape it? Did the client provide it? Each source has different risks. Bought lists are risky under UK GDPR because the seller may not have valid consent. Client-provided data is safer if the client has a lawful basis.

Record the transfer mechanism. If the data goes outside the UK, note whether you rely on adequacy, such as the UK-US Data Bridge for a certified recipient, or an appropriate safeguard such as standard contractual clauses. For a restricted transfer relying on contractual safeguards, keep the signed clauses and transfer risk assessment; record any Article 49 derogation and why it applies.

Record opt-outs and objections. If a prospect asks you to stop, record the date and the method. Make sure the suppression is shared with the client and any sub-processors. A suppression that only lives in your agency's CRM is not enough.

Record your retention period. How long will you keep the prospect data? UK GDPR requires you not to keep it longer than necessary. Set a retention schedule and stick to it. For appointment setting, a common period is 12 to 24 months after last contact.

Use a checklist to audit your cross-border outreach. Here is one you can adapt:

A worked example helps. Suppose a London agency runs outreach for a software client targeting California. The agency buys a list of US business emails from a UK data broker. It sends emails from a UK server and stores replies in a US CRM.

The lawful basis for the emails is legitimate interests, but the agency must assess whether the broker had a valid basis. The transfer to the US CRM needs standard contractual clauses and a transfer risk assessment. The emails must include an opt-out. The agency must honour California opt-out rights. The record must show all of this.

If the agency cannot show the broker's basis, it should not use the list. That is a common failure in cross-border outreach. The ICO can fine up to 4% of global turnover or £17.5 million, whichever is higher, for UK GDPR breaches. PECR fines are lower but still significant.

The UK government's export strategy covers market entry and regulation support: Export strategy: Made in the UK, Sold to the World - GOV.UK.

International trade data from the Office for National Statistics is relevant for agencies serving exporters and importers, because it shows which markets are growing. You can find it at International trade - Office for National Statistics.

For the UK side of consent, the internal article on Cold calls or consent first sets out what PECR requires for calls and emails.

Common questions