Post-Brexit creative production: moving UK and EU campaign assets

What to take away

What changed for UK and EU campaign assets after Brexit

Since the UK left the EU, campaign assets made in London for a Berlin or Dublin launch cross a legal border as well as a language one. The asset file itself is data.

When it holds personal data, such as a customer list for a lookalike audience or a named talent release, the move is an international transfer under UK GDPR.

Trade rules changed too. Buying and selling outside Great Britain now covers services, digital delivery and the movement of goods such as props, printed inserts and event kit. You can read the government's own overview at Buying and selling outside of Great Britain - GOV.UK.

The market has kept moving. The Office for National Statistics publishes the trade picture at International trade - Office for National Statistics, which is a useful sanity check when finance asks whether EU campaign work is still growing.

What did not change is the need for a lawful basis. A UK brand running EU campaign production still needs a lawful basis for processing, plus a transfer mechanism if personal data leaves the UK. Creative automation can enforce both, but only if someone configures it.

A practical first step is to map where personal data quietly travels through a creative software workflow, from the brief to the review link to the final approved cut. Once that map exists, the transfer questions become specific rather than theoretical.

International transfer rules UK teams must apply to EU campaigns

The ICO sets out the rules for moving personal data out of the UK, including to the EU. The main page is International transfers | ICO. It covers adequacy regulations, the International Data Transfer Agreement and the UK Addendum to the EU standard contractual clauses.

For most UK teams, the EU is covered by an adequacy decision. That means personal data can flow from the UK to the EU without extra paperwork. The reverse flow, from the EU to the UK, is covered by the EU's own adequacy decision for the UK.

Adequacy is not a free pass. You still need a lawful basis, a privacy notice that mentions the transfer, and retention that matches the purpose. The data protection principles that underpin retention and storage are explained at Data protection principles - guidance and resources | ICO.

A transfer risk assessment is expected where you rely on a restricted transfer mechanism. It is not a one-off document. Refresh it when the vendor, the sub-processor list or the data categories change.

Creative automation helps by tagging assets with the jurisdictions they may enter. A tag can block a US render farm when the asset contains EU personal data. That is a control, not a legal answer, but it stops the accidental transfer that causes most incidents.

Asset storage and residency choices for cross-border production

Asset storage and residency is the decision about where source files, proxies and metadata physically sit. For a UK team running EU campaigns, the usual options are UK-only storage, EU-only storage, or a split with UK originals and EU proxies.

UK-only storage keeps personal data inside the UK and relies on the EU adequacy decision for any EU access. It suits teams whose EU work is mostly review and approval rather than local production.

EU-only storage puts the source file in an EU region, such as Ireland, Germany or the Netherlands. That can satisfy an EU client's procurement team and reduce the number of transfer mechanisms you need. It also means UK staff access data from outside the EU, which is a transfer in the other direction.

A split model is common in advertising. UK originals hold the brand system and the source files. EU proxies hold the localised cuts, captions and market-specific end frames. The split keeps large files close to the editors who use them.

Residency is not only about the primary region. Backups, logs, analytics, support access and disaster recovery all have a location. Ask vendors for the full sub-processor list, not just the headline region.

For a wider view of how files move through a creative stack, see ad creative asset management, which covers naming, rights and retention in one place.

Cost matters. EU regions often carry a small premium over UK or US regions, and egress fees can surprise finance when a campaign is versioned heavily. Model the storage and egress cost per market before you commit.

Versioning differences between UK and EU campaign assets

Versioning is where the visible differences between UK and EU campaigns live. A single source file can spawn dozens of variants, and the differences are rarely just language.

Claims and substantiation differ. A UK claim that passes the CAP Code may need different wording in Germany, where comparative claims face stricter tests. France has its own rules on promotions and price references.

Disclaimers differ in length and placement. UK ads often carry a short qualifier. Some EU markets require fuller terms, which changes the layout and the safe area for the end frame.

Formats differ. Aspect ratios, caption lengths and audio description expectations vary by market and platform. A 16:9 original may need 9:16, 4:5 and 1:1 cuts, each with its own subtitle file.

Language and typography differ. German compounds run long, which breaks button labels. French and Spanish need more characters. Arabic and Hebrew need right-to-left layouts if you run those markets from the same system.

Talent and music rights differ. A performer release for the UK may not cover EU paid media, and a music licence may be territory-limited. Versioning without rights clearance creates a legal variant, not a creative one.

This is where ad creative versioning software earns its place. It holds the source file, the localisation rules and the approval trail, so a UK change does not silently overwrite an approved EU cut.

ICO and EU guidance named, and where they diverge

The ICO is the UK regulator for UK GDPR and PECR. Its international transfers guidance is the reference point for UK teams moving campaign data to the EU and beyond. The EU side is governed by the European Data Protection Board and national authorities such as the CNIL in France and the DPC in Ireland.

They agree on the basics: lawful basis, purpose limitation, retention and transfer safeguards. They diverge on emphasis and process.

The ICO expects a transfer risk assessment where you rely on the IDTA or the UK Addendum. EU guidance leans on the transfer impact assessment under the Schrems II ruling, with a stronger focus on government access in the destination country.

Breach timelines differ. UK GDPR requires notification to the ICO within 72 hours where a breach is likely to result in a risk to rights and freedoms. EU member states apply the same 72-hour rule, but some add local registers and sector rules.

Responsibilities differ for joint controllers. EU guidance is more prescriptive about joint controller arrangements for advertising and analytics. UK guidance is lighter, but the accountability principle still applies.

Reform is moving at different speeds. The Data (Use and Access) Act 2025 changes parts of UK data law, including some transfer and research provisions. The full text is at Data (Use and Access) Act 2025.

EU law is not changing in step, so a single EU-wide policy may no longer fit both sides.

For a working map of the wider rules, including ASA and Clearcast clearance, see UK advertising, privacy and copyright rules. Clearance bodies matter because a versioned asset still has to pass the local gatekeeper before it runs.

A transfer checklist for a campaign running into the EU

Use this checklist before the first asset leaves the UK. It is written for a UK creative operations team running a campaign into one or more EU markets.

Then work through the operational steps.

A Manchester retailer runs a winter campaign into Ireland, Germany and Spain. The source file sits in a UK region. The German and Spanish cuts sit in an EU region. Talent releases are UK-only, so the EU cuts use local talent.

The team relies on the EU adequacy decision for the UK to EU flow, and on the UK Addendum for a US analytics tool. Retention is set to 90 days after the campaign ends.

The example shows the pattern: residency, mechanism and versioning are decided together, not in sequence. Creative automation makes that possible, but the decisions remain human ones.

Common questions