5 checks for UK and EU cross-border loyalty schemes after Brexit

What to take away

Check one: UK GDPR transfer mechanisms after Brexit

Britain left the EU data protection regime on 31 January 2020, and the transition period ended on 31 December 2020. Since then the UK has operated its own version of the GDPR, read with the Data Protection Act 2018.

The Data Protection Act 2018 sets the framework the Information Commissioner's Office enforces for cross-border transfers of member data.

The EU GDPR text still matters because it was retained in UK law, and because your Irish or German members sit under the EU version. The General Data Protection Regulation (GDPR) is the reference point for what EU members can demand from your scheme.

The practical check is simple. Map every flow of member data from the UK to an EU processor, then confirm the transfer tool. The UK International Data Transfer Agreement, the International Data Transfer Addendum to the EU standard contractual clauses, and adequacy regulations are the main routes.

An adequacy finding for the EEA lets data flow into the UK, but it does not cover UK-to-EU exports.

For most loyalty schemes, the UK Addendum is the workhorse. It bolts UK terms onto existing EU standard contractual clauses, so one contract can serve both directions. Check that the addendum is signed by the right legal entities, not just the trading names.

A transfer risk assessment is separate from the contract. It asks what could go wrong for the member if the data is accessed abroad, and what supplementary measures reduce that risk. The ICO expects this to be documented, not assumed.

Watch the Data (Use and Access) Act 2025, which changes parts of the UK regime. The Data (Use and Access) Act 2025 | ICO explains the changes affecting marketing data use, including how recognised legitimate interests may work. Scheme owners should check whether their referral triggers still rely on consent alone.

For referral marketing software, the transfer question usually lands on the vendor. Ask where member records are hosted, which sub-processors touch them, and whether support staff outside the UK can see them. If the answer is vague, the transfer mechanism is not in place, whatever the contract says.

One more trap: group structures. A UK scheme owner with an Irish subsidiary may be transferring data inside its own group, which still needs an intra-group agreement and a lawful transfer route. Brexit did not create a domestic exemption.

Check two: VAT treatment across Britain, Ireland and the EU

VAT treatment is the check most often missed, because loyalty rewards look like marketing spend rather than taxable supply. HM Revenue & Customs treats many rewards as a supply for VAT purposes, and the place of supply rules decide which country gets the tax.

A discount on a future purchase is usually not a separate supply. A voucher, a gift card or a cash incentive can be. The EU voucher rules, in place since 2025, split vouchers into single-purpose and multi-purpose, and the UK has its own voucher treatment.

That divergence matters when a member in Dublin redeems a reward bought from a London scheme.

Ask three questions for each reward. Who supplies it, where is it consumed, and is it a discount or a distinct supply? If the reward is consumed in Ireland or Germany, local VAT may apply, and the scheme may need to register there or use a fiscal representative.

Points schemes add another layer. Points earned on UK sales and redeemed against EU goods can create a supply in the EU. The VAT base is usually the cost of the reward to the scheme, not its face value, but that depends on the structure.

Keep evidence. HMRC expects records that link reward redemptions to the correct VAT treatment. A spreadsheet of redemptions by country, with the reward type coded, is enough for most schemes. Without it, an inspection becomes a negotiation.

If the scheme operates through an EU partner, agree in writing who accounts for VAT on the reward. Put that in the commercial contracts with the partner, alongside the data terms. A partner that issues rewards in its own name may be the supplier for VAT, which changes your exposure.

Currency and invoicing also matter. Sterling and euro rewards create separate VAT lines, and invoices must show the correct VAT amount in the currency of the supply. Do not net rewards against marketing fees without checking the VAT effect.

Check three: consumer-law divergence in scheme terms

Consumer-law divergence is the quiet risk. Scheme terms drafted for Britain may not satisfy Ireland or the EU, even when the wording looks identical.

In Britain, the Consumer Rights Act 2015 and the Consumer Protection from Unfair Trading Regulations 2008 govern fairness and misleading actions. The Competition and Markets Authority enforces them, and since 2025 it has had stronger direct enforcement powers, including fines without going to court. The Advertising Standards Authority still rules on ad claims.

In Ireland, the Consumer Rights Act 2022 applies, with the Competition and Consumer Protection Commission enforcing. In the EU, the Unfair Commercial Practices Directive and the Consumer Rights Directive set the baseline, and each member state adds its own rules.

The differences that bite loyalty schemes are usually these. Pre-contract information duties differ in detail. Automatic renewal and cancellation rights differ. Price reduction claims, such as was/now pricing, are treated differently. And the remedies for a breach of the terms differ.

Points expiry is a common flashpoint. A term that lets points expire after 12 months without a reminder may be fair in one country and unfair in another. The safest approach is a reminder before expiry, sent to the member, with a clear route to use the points.

Referral rewards raise another issue. If a member refers a friend and the friend does not qualify, the terms must say so before the referral, not after. Hidden qualification criteria are a misleading action in most of these jurisdictions.

Check consent, disclosure and ad claims in your scheme terms before launch. The consent, disclosure and ad claims rules apply to how you describe the reward, not just how you collect the data. A claim that a reward is always available, when it depends on stock, is the kind of statement the CMA and the ASA both watch.

One practical step. Keep a country-by-country table of the terms that change, and version it. When you update the UK terms, check whether the Irish and EU versions need the same change or a different one.

Check four: consent and e-marketing across borders

Consent and e-marketing rules still split after Brexit. In the UK, the Privacy and Electronic Communications Regulations, known as PECR, sit alongside UK GDPR. In the EU, the ePrivacy Directive does the same job, implemented differently in each member state.

The practical difference is consent wording. PECR allows soft opt-in for existing customers in some cases, where the contact details were obtained in the course of a sale and the marketing is about similar products. Several EU states do not allow that, or allow it more narrowly.

A single opt-in tick box rarely covers both. If your referral marketing software sends the same welcome email to a member in Manchester and a member in Munich, the wording and the lawful basis need to work in both places.

Granularity matters. EU regulators expect separate consent for different channels, such as email, SMS and push. UK guidance is less prescriptive but still expects consent to be specific. Build the preference centre so a member can choose channels and countries.

Record keeping is the audit trail. Keep the time, source, wording and scope of each consent. If a member withdraws consent, the suppression must reach every system, including the referral platform and any partner.

Referral invites are a special case. When a member invites a friend, the friend's data is often collected before any relationship exists. That is a new contact, and the invite email may need its own lawful basis. Do not assume the member's consent covers the friend.

Check the vendor's default settings. Many referral marketing software products ship with pre-ticked boxes or bundled consent. Those defaults fail PECR and several EU regimes. Configure the platform so consent is unbundled, and document the change.

Check five: data sharing with EU partners

Data sharing with EU partners is where schemes most often lose control. A referral network with an Irish retailer, a German fulfilment house and a UK scheme owner creates several roles at once.

The Data sharing | ICO guidance sets out what a data sharing agreement needs: purpose, lawful basis, categories of data, retention, security and the rights process. That applies whether the partner is a controller or a processor.

Get the roles right. The Controllers and processors | ICO guidance explains the difference and what each must do. A partner that decides who gets a reward is usually a controller for that decision, even if it also processes data for you.

If the partner is in the EU and you are in the UK, the transfer needs a mechanism. If the partner is a processor, the contract needs the UK Addendum or the IDTA. If the partner is a controller, you need a controller-to-controller agreement plus a transfer risk assessment.

Run vendor due diligence before sharing member data. Ask for the partner's security certifications, sub-processor list and breach history. A partner that cannot produce them is a transfer risk you cannot mitigate.

Set retention limits. Member data shared for a referral campaign should be deleted or returned when the campaign ends, unless there is a separate lawful basis to keep it. Put the deadline in the contract and check it.

Log every share. A simple register of what was shared, with whom, when and under which agreement, is the evidence the ICO expects if a member complains. It also helps when a partner changes ownership.

Building a cross-border referral marketing software checklist

Use this checklist before you add an EU country to a UK scheme. It covers the five checks above, in the order that reduces risk fastest.

The table below shows which check applies to which part of a cross-border scheme.

Then turn the checklist into a launch sequence.

A London scheme wants to launch in Ireland and the Netherlands. It signs the UK Addendum with its Dutch software vendor. It registers for VAT in Ireland because rewards are consumed there. It rewrites the points expiry term to include a reminder.

It splits consent by email and SMS, and signs controller-to-controller terms with its Dublin partner. The launch takes an extra six weeks, but the scheme avoids a transfer complaint and a VAT assessment.

Review the checklist twice a year. The Data (Use and Access) Act 2025 is still bedding in, and EU member states continue to implement the voucher and consumer rules. A scheme that passes in September may need a change by the following spring.

Common questions