The ICO’s first question is whether the destination has UK adequacy regulations. Its list covers the EEA states, the Faroe Islands, Gibraltar, Guernsey, Isle of Man, Jersey, Israel, New Zealand, Switzerland, Uruguay, Argentina, Andorra and South Korea in full, and Canada, Japan and the United States in part. India does not appear on it as of 11 October 2026.
The safeguards and the data protection test
Without adequacy you need a safeguard. For a processor contract the usual choice is the ICO’s International Data Transfer Agreement (IDTA), or the UK Addendum attached to the European Commission’s standard contractual clauses. Before you rely on either, the ICO says you must complete a transfer risk assessment.
The Act changed the name and the wording of that step. The ICO’s guidance says the assessment is now called a “data protection test” in legislation. To pass it you decide, “acting reasonably and proportionately”, that the protection for people’s information is “not materially lower than in the UK after you transfer it”. The same page keeps the term TRA in its own headings. Separately, the ICO’s IDTA page says it plans to update the IDTA and the Addendum in the course of 2026 and that you should keep using the current versions, which it still said on 11 October 2026.
Three practical moves follow from that, and none needs a lawyer to start:
- Keep real people’s data out of development. If the team builds and tests on masked or synthetic records, no personal data is accessible to it, and there is nothing to assess for that work.
- Treat production access as the transfer. Decide who in the supplier’s team needs it, how the access is logged and when it is removed, then write that into the processor terms.
- Give your DPO the assessment to challenge. We prepare the facts, such as where the data sits and who can reach it, and your DPO signs the conclusion.
Whoever writes the code, the baseline security practices still apply: encryption, least-privilege access and tested backups are the evidence a transfer assessment leans on.
Who owns custom software in London
This is the one that surprises people. Under English law you do not own software just because you paid for it. The government’s guidance on copyright ownership says that when you commission a work, the first legal owner is the person or organisation that created it, “unless you otherwise agree it in writing”. Without that writing, the commissioner may get only an implied, limited, non-exclusive licence. The exception is an employee’s work in the course of employment, where the employer owns it, so code written by the supplier’s employees already belongs to the supplier, while anything from its freelancers or subcontractors has to be assigned to the supplier before the supplier can assign it to you.
Clauses that make custom software in London yours
Transferring ownership has its own formality. Section 90(3) of the Copyright, Designs and Patents Act 1988 makes an assignment ineffective unless the assignor, or someone acting for them, has signed a written document. An email saying “it’s yours” is a weak foundation for a platform you may sell or raise money against.
| Clause to ask for | Why it is there |
|---|---|
| Assignment of all work product, signed | Section 90(3): without a signed writing, ownership stays with the author |
| Assignment on creation, not on final payment | Otherwise a billing dispute can leave you running code you do not own |
| Assignments from any freelancers or subcontractors to the supplier | Employees’ work vests in the supplier under section 11(2); anyone else’s has to be assigned to it first |
| A list of third-party and open-source components, with licences | They stay under their own licences and cannot be assigned to you |
| A moral-rights waiver covering designs and documentation | The rights do not apply to the code itself (sections 79(2) and 81(2)); section 87(2) provides for a waiver in a signed written instrument |
Moral rights deserve one line of precision. Under sections 79(2) and 81(2), the right to be identified as author and the right to object to derogatory treatment do not apply to a computer program. They can still apply to the designs and documentation that ship with it, mainly where a freelancer rather than an employee made them, which is why a short waiver is worth having. Ask your solicitor to read the assignment before you sign. That is a review worth a few hours of their time.
IR35 and VAT: two questions that sound alike
Why IR35 is not the question here
Off-payroll working, usually called IR35, concerns an individual who supplies services through their own company and would have been an employee if engaged directly. HMRC’s guidance for clients says a medium or large client must decide the worker’s employment status and issue a Status Determination Statement with its reasons. A small client does not; the worker’s intermediary decides.
Buying a finished service from a supplier company is a different arrangement. The same page says that if you receive contracted-out services from a third party, such as an outsourcing company, you “will not have to apply the off-payroll working rules”, because responsibility sits with the organisation supplying the worker. It also warns against relabelling a contract to dodge the rules. So for a statement of work delivered by a supplier’s own team, the off-payroll question belongs to the supplier, not to you. One individual sitting in your stand-ups, taking your direction and billing by the day, is the situation that deserves a status check from your adviser.
How the VAT reverse charge works on an overseas invoice
Under HMRC’s place of supply guidance (Notice 741A, last updated 29 September 2022), the general rule for services between businesses is that the supply is made where the customer belongs. For a VAT-registered London firm that means the UK, and the reverse charge applies: you convert the invoice to sterling, put the VAT due on your VAT Return, and take the same amount back as a credit. GOV.UK says that means there is no tax to pay unless your business is partially exempt.
The partial exemption caveat matters to some of the firms reading this. A business whose income is largely exempt, for instance some financial and insurance activity, may not be able to reclaim the full amount, so the overseas invoice can carry a real VAT cost. GOV.UK also lists services with different rules, including electronically supplied services with nobody directly involved, land and property, and events. Notice 741A’s own example treats customised software from an overseas business as a general-rule service, but confirm the treatment with your accountant before the first invoice.
The clock: 4 hours 30 minutes in summer, 5 hours 30 in winter
The UK moves its clocks and India does not. According to GOV.UK, British Summer Time ends on 25 October 2026 and returns on 28 March 2027. Indian Standard Time stays at UTC+5:30 all year. So Ahmedabad is 4 hours 30 minutes ahead of London in summer and 5 hours 30 minutes ahead in winter.
The window that matters is the working day. 09:00 to 15:00 in London is 13:30 to 19:30 in Ahmedabad until 25 October, and 14:30 to 20:30 after it. Six hours of overlap survive the change, but they slide an hour later on our side, and the written handover lands an hour later too.
The trap is a standing meeting. If you created the invite in Ahmedabad time, it drifts by an hour for one side twice a year. Set recurring meetings in the Europe/London time zone and let the calendar do the arithmetic. A weekly demo at 10:30 London time stays at 10:30 whatever the date.
Custom software in London for FCA-regulated firms
If your firm falls under the FCA’s operational resilience rules, your supplier’s software is part of your own resilience story. The FCA’s policy statement PS21/3, published on 29 March 2021, required firms to identify their important business services, set impact tolerances and map and test them. That transition closed on 31 March 2025, the date by which firms had to be able to stay within their tolerances.
The FCA’s operational resilience page, last updated 15 September 2026, applies this to banks, building societies, insurers, payment and e-money firms and others. It also says firms remain responsible under the existing outsourcing and operational resilience rules “when they rely on services provided by third parties”. A supplier does not carry that responsibility for you, and a new system has to fit inside your impact tolerances from the day it goes live.
What you can ask a software supplier for follows from this:
- A restore test you can watch, with the time it took recorded against your tolerance.
- Staged releases with a rehearsed rollback, so a bad deploy is a short disruption.
- Exit terms that are simple because the repository and cloud account are already in your name.
Whether an arrangement is material, and what you must record or tell the regulator, is for your compliance function.
Public sector buyers and G-Cloud
Many London public bodies buy cloud services through G-Cloud, and a buyer there often asks whether a supplier with no UK entity can be used at all. The current iteration, G-Cloud 15, started on 6 August 2026, according to the agreement page. It is run by the Government Commercial Agency, which was Crown Commercial Service before it was renamed on 1 April 2026. The lots cover infrastructure and platform hosting, infrastructure software, other SaaS and cloud support services. Buyers include central government, local authorities, health, education and blue-light services.
We are not a G-Cloud supplier, and we are not eligible for frameworks that require a UK-established supplier. The agreement page does not set out supplier eligibility, so we cannot tell you whether an overseas company could apply, and we would not guess. If your procurement route is a framework, ask your commercial team how bespoke development fits its lots before you plan around a remote team. When a London studio is the only compliant route, hiring one is the right answer.
When a London studio is the better buy
None of these rules decides the question alone. They tell you which answer fits which condition, and the answer is not always us.
| If this is true | Lean towards |
|---|---|
| People must be on site for workshops, rollouts or hardware | A London studio |
| A framework or client contract requires a UK-established supplier | A London studio |
| Security policy bars production access from outside the UK, and masked data will not do | A London studio |
| The build is defined, personal data is handled in the ordinary way and your DPO will set the transfer rules | A remote team |
| Your decision-makers are free in the morning and a written handover covers the rest | A remote team |
| You want repositories, cloud accounts and the IP in your company’s name from day one | Either, if the contract says so |
Pricing is a separate decision; our guide to how the pricing models differ covers it. A written scope that names its exclusions is worth asking every supplier for, including us.
Commissioning custom software in London from a team abroad puts most of the risk in the contract: who owns the code, where data goes and who owes VAT. Copyright, data transfers, IR35, VAT, FCA oversight and G-Cloud each get a dated source below; the data rules finished coming into force in June 2026. If you want to see how we work with London firms day to day, our London page covers it. This post is the legal and tax groundwork behind that page.
QalbIT is a remote engineering team in Ahmedabad with no London office and no UK entity, so every item below is something a London buyer has asked us to put in writing. Think of us as engineers, not solicitors. Each rule is linked to the body that publishes it and dated, and your solicitor, accountant and data protection officer decide what applies to you.
What the Data (Use and Access) Act means for custom software in London
The Data (Use and Access) Act 2025 got Royal Assent on 19 June 2025 and came into force in stages. According to the government’s commencement guidance, most of Part 5, the data protection part, started on 5 February 2026. Section 103, the complaints duty, was held back to 19 June 2026 by the commencement regulations (SI 2026/82), which also brought the new transfer rules (section 85 and Schedule 7) into force on 5 February 2026. The ICO said on 23 June 2026 that all outstanding provisions of the Act are now in force. So for a system you commission this autumn, none of this is pending.
The government’s summary of the data protection changes, published 27 June 2025, lists what touches a build:
A complaints route in version one
The complaints rule is the one a product team notices first. The ICO’s notice says organisations must acknowledge a complaint within 30 days, investigate it and tell the person the outcome. That is a small workflow, and it is far cheaper to build into version one than to bolt on after an ICO letter arrives.
Sending personal data to India: what the ICO expects
The ICO defines a restricted transfer as a transfer of personal information to a separate organisation located outside the UK, and says a transfer covers making information accessible as well as sending it. An engineer in Ahmedabad who can open your production database is therefore receiving a transfer, even if nothing is ever emailed anywhere.