passport, travel, customs, borders, passport, passport, passport, passport, passport
Photo by jackmac34 on Pixabay

Rules and ethics

Belfast corporate communications and the cross-border rules after Brexit

Corporate communications in Belfast now straddle two data regimes, two broadcast regulators and two media markets, so cross-border teams need a clear rulebook.

What to take away

  • Corporate communications in Belfast now runs under two data protection regimes: UK GDPR, enforced by the ICO, for UK-facing work, and EU GDPR, enforced by the Data Protection Commission, for Republic of Ireland audiences.
  • Ofcom still regulates broadcast and on-demand output in Northern Ireland, while Irish outlets fall under Coimisiún na Meán.
  • EU-facing disclosure after Brexit means prospectus and marketing material for EU investors must follow the EU Prospectus Regulation and be filed with the Central Bank of Ireland or another EU competent authority, not the UK version.
  • Media relations across the Irish border differ in deadline culture, embargo practice and the use of freelancers.
  • The Northern Ireland Executive sets devolved policy that shapes public sector comms, but it does not regulate private sector marketing.
  • The Northern Ireland Protocol, revised by the Windsor Framework, is the framework that shapes how Northern Ireland sits between the two rulebooks.

What changes for Belfast teams working across the Irish border

Belfast sits closer to Dublin than to London, yet the rulebook splits at the border. Since the UK left the EU, a single campaign can fall under two legal regimes. The withdrawal agreement created the Northern Ireland Protocol, which the Windsor Framework later revised, and both left data protection, broadcasting and financial disclosure rules to diverge over time.

One Campaign, Two Rulebooks

UK side

Privacy notice
UK version
Consent wording
UK GDPR
Disclosure footnote
UK rules
Public sector tone
Belfast-specific
Media contact
Press office queue

EU/Irish side

Privacy notice
EU version
Consent wording
EU GDPR
Disclosure footnote
EU rules
Public sector tone
Dublin/London
Media contact
Named spokespeople

For a comms team, that means one press release may need two versions of its privacy notice, two sets of consent wording and two disclosure footnotes. The work is not doubled in cost, but it is doubled in checks.

Northern Ireland also has its own devolved administration. The Northern Ireland Executive controls health, education and infrastructure messaging, so public sector campaigns often carry a Belfast-specific tone that does not travel to London or Dublin.

Cross-border media relations add a practical layer. Dublin newsrooms work to Irish time and Irish news cycles, and they expect direct contact with named spokespeople rather than a UK press office queue.

ICO and UK GDPR considerations for cross-border communications

The Information Commissioner's Office (ICO) enforces UK GDPR and the Data Protection Act 2018 in Northern Ireland. Its UK GDPR guidance and resources set out how to handle personal data, international transfers and individual rights.

ICO Cross-Border Data Checks

  • Lawful transfer mechanism for Irish subscribers
  • Do not assume UK adequacy is permanent
  • Audit trailsource and date per contact
  • UK representative for overseas controllers
  • EU representative for UK controllers

If your Belfast team sends a newsletter to subscribers in the Republic of Ireland, the transfer of that data out of the EU needs a lawful mechanism. The UK holds an adequacy decision, but that decision is reviewed and can be changed. Where adequacy does not cover a transfer, the mechanisms are the EU standard contractual clauses (SCCs) for data leaving the EU, and the International Data Transfer Agreement (IDTA) or the UK addendum to the SCCs for data leaving the UK. Do not assume adequacy is permanent.

Consent records matter more across the border. UK electronic marketing rules sit in PECR, while the Republic of Ireland applies its own ePrivacy Regulations (S.I. No. 336 of 2011), so a UK-style soft opt-in may not satisfy them. Keep a clear audit trail for every contact, including the source and the date.

On the EU side, the Data Protection Commission (DPC) is the Irish supervisory authority for EU GDPR, and the body Irish subscribers, employees and customers would deal with. The ICO also expects a UK representative for some overseas controllers, and Article 27 of EU GDPR requires an EU representative for many UK controllers targeting EU residents. Check which side of the border your entity sits on before you launch.

For teams handling employee or customer data in both jurisdictions, read our guide to personal data in corporate communications for the post-DUAA position.

Ofcom considerations for broadcast and online content

UK communications regulator Ofcom regulates broadcasters, video-on-demand services and some online content across the UK, including Northern Ireland. Its broadcasting code covers harm, offence, accuracy and impartiality.

Ofcom vs Irish Broadcast Rules

Ofcom (UK)

Impartiality
Due impartiality
Elections
UK output
Referenda
UK code
Online safety
Online Safety Act
Check point
At commissioning

Irish rules

Impartiality
Different balance
Elections
Differ in timing
Referenda
Irish timing rules
Online safety
Not covered
Check point
At transmission

A Belfast production company making a programme for a UK broadcaster answers to Ofcom. The same programme streamed to Irish viewers may also fall under Irish rules, so rights and compliance need checking at commissioning, not at transmission.

Political coverage is the sharpest difference. Ofcom's due impartiality rules apply to UK broadcast output, while Irish broadcast rules on referenda and elections differ in timing and balance. A single panel discussion can breach one code and not the other.

Online safety duties also reach user-to-user services with UK users. If your brand runs a forum or comments section, you may hold duties under the Online Safety Act, and Ofcom is the regulator. For social channels, our note on social media disclosure rules covers the labelling expectations.

EU-facing disclosure after Brexit

EU-facing disclosure after Brexit is the area most often missed. UK companies raising money from EU investors can no longer rely on a UK prospectus passport. They must follow the EU Prospectus Regulation and file with the Central Bank of Ireland, the Irish competent authority for prospectus approval, or with the equivalent authority in the EU state where the offer is made.

Two Sign-Offs Per Campaign

UK side

Prospectus
No UK passport
Regulator
FCA
Marketing materials
FCA rules
Filings
Takeover Panel
Sign-offs
One

EU side

Prospectus
EU Prospectus Regulation
Regulator
Irish/EU regulator
Marketing materials
Prospectus-like duties
Filings
Companies House
Sign-offs
One

Marketing materials count as disclosure. A pitch deck, a factsheet or a social post aimed at EU investors can trigger prospectus-like duties if it is a public offer. Keep a clear record of who received what, and when.

Financial promotions add another layer. The Financial Conduct Authority (FCA) rules apply to UK promotions, while the Central Bank of Ireland and other EU regulators apply their own. A single campaign to both audiences needs two sign-offs.

Listed companies should also check the UK Takeover Panel for UK-listed shares and the Irish Takeover Panel for Irish-listed shares, plus Companies House filing timelines, which have not moved in step with EU rules. For a wider map of which UK rules apply by purpose, see UK rules reach corporate communications.

Media relations differences between Belfast and Dublin outlets

Belfast and Dublin newsrooms share a language but not a rhythm. Belfast outlets often work to UK deadlines and UK embargo conventions. Dublin outlets may publish earlier and treat embargoes more loosely.

Named media relations differences across the Irish border include:

  • Embargo practiceUK desks usually honour a stated time; Irish desks may publish once they have the story.
  • Freelance useIrish titles rely more on stringers, so brief both staff and freelancers.
  • Contact routeDublin editors prefer a direct mobile number, not a shared press inbox.
  • Spokesperson locationan on-the-record voice in Belfast may be treated as a UK voice, not a local one.
  • Language nuance: Irish media may expect Irish spelling and Irish English terms in shared copy.

Build a contact list that names individuals on both sides. A single cross-border distribution list will misfire.

Worked example: one announcement released on both sides of the border

A Belfast fintech plans to announce a funding round. It wants coverage in Belfast, Dublin and London, and it will email 4,000 subscribers, half in the Republic of Ireland.

Here is the release sequence:

Worked example

  1. Legal check. Confirm whether the announcement is a financial promotion in the UK and a public offer in the EU. If yes, prepare two disclosure footnotes.
  2. Data check. Split the subscriber list by jurisdiction. Apply UK GDPR wording to UK contacts and EU GDPR wording to Irish contacts. Log consent sources.
  3. Media check. Send Belfast and London releases under UK embargo. Send Dublin releases with an earlier time and a named Irish contact.
  4. Broadcast check. If a video version runs on a UK channel, clear it against Ofcom rules. If it runs on an Irish channel, clear it again.
  5. Record check. Keep the final versions, consent logs and approvals for at least the retention period your regulator expects.

Use this checklist before any cross-border release:

  • Two privacy notices, one for UK contacts and one for EU contacts
  • Consent records with source and date for every recipient
  • Two disclosure footnotes if the announcement touches fundraising
  • Named media contacts in Belfast, Dublin and London
  • Separate embargo times for UK and Irish outlets
  • Broadcast clearance logged for each territory
  • Retention schedule agreed with legal

If the announcement goes wrong, a rehearsed plan matters more than a perfect press release. Our crisis communications plan for UK SMEs sets out the steps.

Common questions

Does UK GDPR still apply in Northern Ireland?
Yes. UK GDPR and the Data Protection Act 2018 apply in Northern Ireland, and the ICO enforces them. EU GDPR applies separately to processing that targets people in the Republic of Ireland or elsewhere in the EU.
Do I need an EU representative if my Belfast team markets to Irish customers?
Often yes. If you offer goods or services to people in the EU, or monitor their behaviour, Article 27 of EU GDPR may require you to appoint an EU representative. The Data Protection Commission is the Irish supervisory authority on the EU side, so check the threshold before you launch.
Can one press release serve Belfast and Dublin?
It can share the core facts, but not the legal footnotes or the embargo time. Prepare one lead text and two local versions with different contacts and disclosure lines.
Who regulates broadcast content in Northern Ireland?
Ofcom regulates UK broadcasters, including those based in Northern Ireland. Irish-licensed broadcasters answer to Coimisiún na Meán, so a cross-border transmission may need both clearances.
What is the biggest EU-facing disclosure risk after Brexit?
Treating a UK-approved prospectus or promotion as valid in the EU. It is not. EU-facing disclosure needs an EU filing or an exemption, and marketing material can count as disclosure.

More in Rules and ethics