UK companies buying software development are working with a rulebook that quietly diverged from the EU after Brexit, a contractor tax regime that catches out buyers who assume it only affects freelancers, and day rates that make in-house-only delivery hard to justify for anything but core product work. This guide covers what actually matters when you evaluate a development partner from the UK - the compliance obligations that are yours and not your vendor's, where IR35 does and does not apply, and how to compare delivery models honestly.
01UK GDPR is not EU GDPR, and the difference is in the transfers
Post-Brexit the UK retained GDPR as 'UK GDPR', sitting alongside the Data Protection Act 2018 and regulated by the ICO. Day to day the principles are the same as the EU regime - lawful basis, data minimisation, breach notification within 72 hours, data subject rights. Teams that are already GDPR-literate do not need to relearn the fundamentals.
The divergence that matters commercially is international transfers. Moving personal data out of the UK requires either an adequacy decision or a transfer mechanism, and the UK's instrument is not the EU SCCs - it is the International Data Transfer Agreement, or the UK Addendum bolted onto EU SCCs. If your partner hands you unmodified EU SCCs for a UK contract, that is a gap. You will also need a Transfer Risk Assessment on file.
Note who carries the obligation. As the organisation deciding why and how personal data is processed you are the controller, and the compliance duty is yours. A development partner is typically a processor, which means your protection comes from the Article 28 processor terms in the contract - not from anything the vendor asserts on a capability deck.
- UK GDPR + DPA 2018, regulated by the ICO - not the EU regime by default.
- Transfers out of the UK need an IDTA or the UK Addendum to EU SCCs, plus a Transfer Risk Assessment.
- You are almost always the controller; the partner is the processor. The duty stays with you.
- Article 28 terms, sub-processor disclosure and audit rights belong in the contract, not a slide.
02IR35: where it bites and where it genuinely does not
IR35 is the single most misunderstood item in UK technical hiring. The off-payroll working rules make the end client responsible for determining employment status when engaging an individual through their own intermediary - typically a personal service company. Get the determination wrong as a medium or large business and the tax liability lands on you, not the contractor.
The critical distinction for buyers is between a contracted-out service and a supply of labour. Engaging an individual contractor who works under your direction, inside your team, on your rota, is squarely in scope. Contracting a supplier to deliver a defined outcome - with the supplier managing its own people, methods and substitution - is a business-to-business service, and the off-payroll rules do not apply in the same way.
This is not a labelling exercise. HMRC looks at the reality of the arrangement, so a statement of work that says 'outcome' while you run daily standups, assign tickets and control who does the work will be read as what it actually is. If you want to be genuinely outside the regime, the delivery model has to match the paperwork.
| Model | What it looks like | IR35 position |
|---|---|---|
| Employee | On payroll, PAYE deducted at source | Not applicable - already taxed as employment |
| Individual contractor via PSC | Works in your team, under your direction | In scope - you make the status determination |
| Umbrella company | Contractor employed by umbrella, PAYE applied | Outside off-payroll rules - PAYE already operating |
| Contracted-out service | Supplier owns outcome, staffing and methods | Off-payroll rules generally do not apply |
| Offshore delivery partner | Supplier's own employees, non-UK | Out of scope - no UK employment relationship |
03What UK delivery actually costs
London day rates for experienced contract developers sit far above most of Europe, and permanent hiring carries employer National Insurance, pension auto-enrolment, holiday and the recruitment fee amortised over an uncertain tenure. The honest comparison is not rate against rate - it is fully-loaded cost per unit of delivered work, including the months a role sits open.
Regional UK hiring outside London and the South East narrows the gap meaningfully, and the strong engineering markets in Manchester, Leeds, Edinburgh and Bristol are frequently overlooked by buyers anchored to London benchmarks. Blended models - a small permanent core owning architecture and domain knowledge, with a delivery partner providing surge capacity - tend to beat both extremes on cost and on risk.
The mistake worth avoiding is optimising purely for rate. A cheaper team that needs rework, or that cannot be held to a security and compliance standard your enterprise customers audit, is more expensive by the time it reaches production.
- Compare fully-loaded cost - NI, pension, holiday, recruitment, vacancy time - not headline rates.
- Regional UK markets offer real savings against London without a timezone or language gap.
- A permanent core plus partner surge capacity de-risks both knowledge loss and hiring lag.
- Rework and failed security review are the hidden costs that erase a cheap day rate.
04Sector rules that will land on your roadmap
If you are selling into UK financial services, the FCA's operational resilience and third-party outsourcing expectations reach your suppliers - you will need exit plans, defined tolerances for disruption and evidence of oversight. Health and care work brings NHS Digital standards, the DCB0129 and DCB0160 clinical risk management obligations and DSPT completion. Public sector procurement adds accessibility obligations, the Technology Code of Practice and often the Digital Marketplace route to market.
None of these are reasons to avoid a partner. They are reasons to check that the partner has been through the relevant assurance before, because the first time through any of these regimes is materially slower than the second.
05Evaluating a partner: the questions that actually separate them
Most vendor evaluations test the wrong things - logo slides, headcount and hourly rate. The questions that predict delivery quality are narrower and more awkward to answer, which is exactly why they work.
Ask how they handle a mid-project scope change, and what happened the last time an engagement went badly. Ask who specifically will write the code and whether you can meet them. Ask what their handover looks like if you end the relationship - a partner confident in the work will describe a clean exit without hesitating.
- Who exactly is on my team, and can I interview them before signing?
- Show me your Article 28 terms, sub-processor list and transfer mechanism for UK data.
- What does the code, documentation and infrastructure handover look like on exit?
- Describe an engagement that went wrong and what you changed afterwards.
- What is your security posture - and can you evidence it through a customer's audit?
06Where SyncTrix fits
We work with UK companies as a contracted-out delivery partner - our own engineers, our own delivery management, accountable to a defined outcome rather than supplied as labour into your team. That keeps the engagement outside the off-payroll rules by structure rather than by wording, and it means you are buying delivered software, not seats.
On data protection we contract as processor with UK-appropriate terms, including the IDTA or UK Addendum where personal data moves outside the UK, full sub-processor disclosure and audit rights. If you are weighing up in-house hiring against a partner for a specific piece of work, we are happy to give you an honest read on which one fits - including when the answer is to hire.
Topics
Lena Voss
Lead Architect · SyncTrix
Writes about the engineering decisions behind production systems - architecture, delivery and the trade-offs that only show up at scale.
Building something like this?
SyncTrix engineers AI, SaaS, platform and cloud systems for enterprises and high-growth teams. Tell us what you're shipping and we'll scope it with you.