
Rules and ethics
Belfast corporate communications and the cross-border rules after Brexit
Corporate communications in Belfast now straddle two data regimes, two broadcast regulators and two media markets, so cross-border teams need a clear rulebook.
What to take away
- Corporate communications in Belfast now runs under two data protection regimes: UK GDPR, enforced by the ICO, for UK-facing work, and EU GDPR, enforced by the Data Protection Commission, for Republic of Ireland audiences.
- Ofcom still regulates broadcast and on-demand output in Northern Ireland, while Irish outlets fall under Coimisiún na Meán.
- EU-facing disclosure after Brexit means prospectus and marketing material for EU investors must follow the EU Prospectus Regulation and be filed with the Central Bank of Ireland or another EU competent authority, not the UK version.
- Media relations across the Irish border differ in deadline culture, embargo practice and the use of freelancers.
- The Northern Ireland Executive sets devolved policy that shapes public sector comms, but it does not regulate private sector marketing.
- The Northern Ireland Protocol, revised by the Windsor Framework, is the framework that shapes how Northern Ireland sits between the two rulebooks.
What changes for Belfast teams working across the Irish border
Belfast sits closer to Dublin than to London, yet the rulebook splits at the border. Since the UK left the EU, a single campaign can fall under two legal regimes. The withdrawal agreement created the Northern Ireland Protocol, which the Windsor Framework later revised, and both left data protection, broadcasting and financial disclosure rules to diverge over time.
One Campaign, Two Rulebooks
UK side
- Privacy notice
- UK version
- Consent wording
- UK GDPR
- Disclosure footnote
- UK rules
- Public sector tone
- Belfast-specific
- Media contact
- Press office queue
EU/Irish side
- Privacy notice
- EU version
- Consent wording
- EU GDPR
- Disclosure footnote
- EU rules
- Public sector tone
- Dublin/London
- Media contact
- Named spokespeople
For a comms team, that means one press release may need two versions of its privacy notice, two sets of consent wording and two disclosure footnotes. The work is not doubled in cost, but it is doubled in checks.
Northern Ireland also has its own devolved administration. The Northern Ireland Executive controls health, education and infrastructure messaging, so public sector campaigns often carry a Belfast-specific tone that does not travel to London or Dublin.
Cross-border media relations add a practical layer. Dublin newsrooms work to Irish time and Irish news cycles, and they expect direct contact with named spokespeople rather than a UK press office queue.
ICO and UK GDPR considerations for cross-border communications
The Information Commissioner's Office (ICO) enforces UK GDPR and the Data Protection Act 2018 in Northern Ireland. Its UK GDPR guidance and resources set out how to handle personal data, international transfers and individual rights.
ICO Cross-Border Data Checks
- Lawful transfer mechanism for Irish subscribers
- Do not assume UK adequacy is permanent
- Audit trailsource and date per contact
- UK representative for overseas controllers
- EU representative for UK controllers
If your Belfast team sends a newsletter to subscribers in the Republic of Ireland, the transfer of that data out of the EU needs a lawful mechanism. The UK holds an adequacy decision, but that decision is reviewed and can be changed. Where adequacy does not cover a transfer, the mechanisms are the EU standard contractual clauses (SCCs) for data leaving the EU, and the International Data Transfer Agreement (IDTA) or the UK addendum to the SCCs for data leaving the UK. Do not assume adequacy is permanent.
Consent records matter more across the border. UK electronic marketing rules sit in PECR, while the Republic of Ireland applies its own ePrivacy Regulations (S.I. No. 336 of 2011), so a UK-style soft opt-in may not satisfy them. Keep a clear audit trail for every contact, including the source and the date.
On the EU side, the Data Protection Commission (DPC) is the Irish supervisory authority for EU GDPR, and the body Irish subscribers, employees and customers would deal with. The ICO also expects a UK representative for some overseas controllers, and Article 27 of EU GDPR requires an EU representative for many UK controllers targeting EU residents. Check which side of the border your entity sits on before you launch.
For teams handling employee or customer data in both jurisdictions, read our guide to personal data in corporate communications for the post-DUAA position.
Ofcom considerations for broadcast and online content
UK communications regulator Ofcom regulates broadcasters, video-on-demand services and some online content across the UK, including Northern Ireland. Its broadcasting code covers harm, offence, accuracy and impartiality.
Ofcom vs Irish Broadcast Rules
Ofcom (UK)
- Impartiality
- Due impartiality
- Elections
- UK output
- Referenda
- UK code
- Online safety
- Online Safety Act
- Check point
- At commissioning
Irish rules
- Impartiality
- Different balance
- Elections
- Differ in timing
- Referenda
- Irish timing rules
- Online safety
- Not covered
- Check point
- At transmission
A Belfast production company making a programme for a UK broadcaster answers to Ofcom. The same programme streamed to Irish viewers may also fall under Irish rules, so rights and compliance need checking at commissioning, not at transmission.
Political coverage is the sharpest difference. Ofcom's due impartiality rules apply to UK broadcast output, while Irish broadcast rules on referenda and elections differ in timing and balance. A single panel discussion can breach one code and not the other.
Online safety duties also reach user-to-user services with UK users. If your brand runs a forum or comments section, you may hold duties under the Online Safety Act, and Ofcom is the regulator. For social channels, our note on social media disclosure rules covers the labelling expectations.
EU-facing disclosure after Brexit
EU-facing disclosure after Brexit is the area most often missed. UK companies raising money from EU investors can no longer rely on a UK prospectus passport. They must follow the EU Prospectus Regulation and file with the Central Bank of Ireland, the Irish competent authority for prospectus approval, or with the equivalent authority in the EU state where the offer is made.
Two Sign-Offs Per Campaign
UK side
- Prospectus
- No UK passport
- Regulator
- FCA
- Marketing materials
- FCA rules
- Filings
- Takeover Panel
- Sign-offs
- One
EU side
- Prospectus
- EU Prospectus Regulation
- Regulator
- Irish/EU regulator
- Marketing materials
- Prospectus-like duties
- Filings
- Companies House
- Sign-offs
- One
Marketing materials count as disclosure. A pitch deck, a factsheet or a social post aimed at EU investors can trigger prospectus-like duties if it is a public offer. Keep a clear record of who received what, and when.
Financial promotions add another layer. The Financial Conduct Authority (FCA) rules apply to UK promotions, while the Central Bank of Ireland and other EU regulators apply their own. A single campaign to both audiences needs two sign-offs.
Listed companies should also check the UK Takeover Panel for UK-listed shares and the Irish Takeover Panel for Irish-listed shares, plus Companies House filing timelines, which have not moved in step with EU rules. For a wider map of which UK rules apply by purpose, see UK rules reach corporate communications.
Media relations differences between Belfast and Dublin outlets
Belfast and Dublin newsrooms share a language but not a rhythm. Belfast outlets often work to UK deadlines and UK embargo conventions. Dublin outlets may publish earlier and treat embargoes more loosely.
Named media relations differences across the Irish border include:
- Embargo practiceUK desks usually honour a stated time; Irish desks may publish once they have the story.
- Freelance useIrish titles rely more on stringers, so brief both staff and freelancers.
- Contact routeDublin editors prefer a direct mobile number, not a shared press inbox.
- Spokesperson locationan on-the-record voice in Belfast may be treated as a UK voice, not a local one.
- Language nuance: Irish media may expect Irish spelling and Irish English terms in shared copy.
Build a contact list that names individuals on both sides. A single cross-border distribution list will misfire.
Worked example: one announcement released on both sides of the border
A Belfast fintech plans to announce a funding round. It wants coverage in Belfast, Dublin and London, and it will email 4,000 subscribers, half in the Republic of Ireland.
Here is the release sequence:
Worked example
- Legal check. Confirm whether the announcement is a financial promotion in the UK and a public offer in the EU. If yes, prepare two disclosure footnotes.
- Data check. Split the subscriber list by jurisdiction. Apply UK GDPR wording to UK contacts and EU GDPR wording to Irish contacts. Log consent sources.
- Media check. Send Belfast and London releases under UK embargo. Send Dublin releases with an earlier time and a named Irish contact.
- Broadcast check. If a video version runs on a UK channel, clear it against Ofcom rules. If it runs on an Irish channel, clear it again.
- Record check. Keep the final versions, consent logs and approvals for at least the retention period your regulator expects.
Use this checklist before any cross-border release:
- Two privacy notices, one for UK contacts and one for EU contacts
- Consent records with source and date for every recipient
- Two disclosure footnotes if the announcement touches fundraising
- Named media contacts in Belfast, Dublin and London
- Separate embargo times for UK and Irish outlets
- Broadcast clearance logged for each territory
- Retention schedule agreed with legal
If the announcement goes wrong, a rehearsed plan matters more than a perfect press release. Our crisis communications plan for UK SMEs sets out the steps.



