The instruments that matter here

Six things a Northern Ireland board should know by name

• UK GDPR breach reporting. Report to the ICO within 72 hours when a breach is likely to result in a risk to people’s rights and freedoms, and tell the individuals when the risk is high. The same rule as the rest of the UK.
• EU GDPR and the Data Protection Commission. Applies to your activity in the Republic, or where you target people there. A cross-border breach may need two assessments, one per regime, and the answers can differ.
• EU adequacy decisions for the UK, renewed in December 2025 to run to December 2031. Personal data can flow from the Republic to Northern Ireland without extra transfer paperwork, although your Irish customers may still ask for it in their contracts.
• NIS2 in Ireland. Irish essential and important entities are preparing for NIS2 supply-chain obligations. If you supply them, expect security questions and contract clauses to flow down to you, whatever your own status.
• NI Cyber Security Centre. Northern Ireland’s government-led centre, working with the UK National Cyber Security Centre, publishes guidance and threat information for local organisations. We point clients to it rather than duplicate it.
• Identity and Language (Northern Ireland) Act 2022. Created an Irish Language Commissioner and a Commissioner for the Ulster Scots and Ulster British tradition, both appointed in October 2025. Their standards and guidance are aimed at public authorities, and public-sector customers may ask what language provision you can support.

Who we work with

Organisations with questions arriving from several directions

• Software, fintech and cyber firms in Belfast selling into London, Dublin and the US, each sending due diligence questionnaires with different assumptions.
• Cross-border businesses in manufacturing, agri-food, logistics and services, with sites, staff or customers in both jurisdictions.
• Suppliers to the Northern Ireland public sector, including health and social care, answering supplier cyber and data protection questions in tenders.
• Growing businesses whose insurer, bank or largest customer has started asking questions nobody inside can answer yet.

What this looks like in practice

Three Northern Ireland scenarios

These are illustrative scenarios, not client stories. We do not publish client work.

A Belfast software firm with a Dublin customer. An Irish financial services customer sends a NIS2-driven supplier questionnaire and a new contract schedule. We assess the firm against our published control set, show which clauses it can meet today, and draft the evidence pack and honest “by when” answers for the rest.

A cross-border manufacturer after a breach. A compromised mailbox exposes employee records about staff in both jurisdictions. Because our tabletop exercise had already walked the board through it, they knew there were two regulators, two tests, one 72-hour clock, and who decides.

A health and social care supplier. A digital supplier is asked how its staff use AI tools with service-user information. Our AI deployment review gives it an approved tool list, the data rules and a board record it can put in front of its customer.

How we help

The same services, with both jurisdictions in view

• Independent assessment against our 36-control set, reported on one page, like our sample board report.
• Board and executive sessions, including a cross-border breach decision walk-through.
• Tabletop exercises built around a realistic Northern Ireland incident.
• AI deployment review and Microsoft 365 Copilot readiness.
• Virtual CISO and DPO support.

Based in the Republic of Ireland? Work for organisations established there will be handled by our Irish practice, which is being set up now. Until it opens, we will tell you plainly what we can and cannot do for you under Irish law.

Doiciméid Ghaeilge

Doiciméid i nGaeilge don fhoireann agus don phobal

Is féidir linn na doiciméid a léann bhur bhfoireann agus an pobal a chur ar fáil i nGaeilge. Ceapadh Coimisinéir don Ghaeilge i dTuaisceart Éireann i nDeireadh Fómhair 2025, agus tá comhlachtaí poiblí ag cur níos mó ceisteanna ar a gcuid soláthraithe faoi sholáthar teanga.

• Treoracha don fhoireann: conas teagmhas a thuairisciú
• Fógra príobháideachta
• Litir chuig daoine a ndeachaigh sárú sonraí i bhfeidhm orthu (Airteagal 34, UK GDPR)
• Beartas úsáide inghlactha don fhoireann
• Achoimre don bhord

Molaimid tosú le doiciméad amháin agus tuilleadh a chur leis má bhaintear úsáid as.

Oibríonn ár gcomhairleoirí i mBéarla. Aistríonn aistritheoir gairmiúil daonna na doiciméid Ghaeilge. Ní úsáidimid meaisínaistriúchán do dhoiciméid rialála. Tá fáilte roimh scríobh chugainn i nGaeilge; tabhair beagán ama breise dúinn le freagra a thabhairt.

Labhair linn faoi dhoiciméid Ghaeilge

In English: we can arrange Irish-language versions of the documents staff and the public read, translated by a qualified human translator. Start with one and add more only if it is used.

Honesty about language

What we do, and what we do not claim

• Our advisers work in English. Irish documents are drafted by us in English and translated by a qualified human translator commissioned for the work, subject to availability. We will confirm the translator and timescale before you commit.
• We do not use machine translation for regulatory documents. Where a document quotes legislation, the authoritative English text sits alongside the Irish.
• If you need Ulster-Scots material, tell us and we will say plainly whether we can support it.