UK zone / uk-gdpr-idta
UK GDPR and IDTA compliant AI inference routing
Keep UK prompts on UK infrastructure, apply the UK transfer regime as code, and keep a signed receipt for every call.
Route card / UK
base_url https://uk.yttsecunet.com/v1
X-YTT-Policy uk-gdpr-idta
endpoints 4 certified, 4 providers
primary London
failover Second UK provider or UK cluster
never Dublin, for UK-only tenants
plans Growth, Enterprise, Dedicated
| Instrument | Citation | What it means for an inference call |
|---|---|---|
| UK GDPR, Chapter V | Retained Regulation (EU) 2016/679 as amended, Articles 44 to 49 | Restricted transfers out of the UK need UK adequacy regulations, an appropriate safeguard such as the IDTA or the Addendum, or an exception. The UK regime now runs separately from the EU one. |
| Data Protection Act 2018 | DPA 2018, sections 17A, 17B and 119A | Gives the Secretary of State power to make adequacy regulations (ss. 17A and 17B) and the ICO power to issue transfer documents (s. 119A), which is the basis for the IDTA. |
| International Data Transfer Agreement and Addendum | Issued under DPA 2018 s. 119A, in force 21 March 2022 | The UK's own transfer contract, plus an Addendum that adapts the EU 2021 SCCs for UK transfers. Contracts on the old EU SCCs had to move to one of these by 21 March 2024. |
| UK Extension to the EU-US Data Privacy Framework | Data Protection (Adequacy) (United States of America) Regulations 2023, effective 12 October 2023 | The UK-US data bridge. Covers transfers only to US organisations that have opted in to the UK Extension; anything else still needs the IDTA or Addendum and a transfer risk assessment. |
| Data (Use and Access) Act 2025 | Royal Assent 19 June 2025 | Reforms the UK transfer test so that a destination must offer protection that is not materially lower than the UK's. Provisions are being commenced in stages, so check commencement before relying on a specific change. |
Why UK traffic needs its own zone, not the EU one
Since the end of the transition period the UK runs its own transfer regime. UK adequacy regulations recognise the EEA, so a UK controller can send personal data to Frankfurt without a transfer tool. That is a legal permission, not a customer requirement. Many UK buyers, especially in the NHS supply chain, central government frameworks and FCA-regulated firms, write UK processing into contracts and security schedules regardless of what the law strictly needs.
The practical trap is EU-wide routing. A hyperscaler's EU cross-region inference profile or data zone may route a London request to any EU region, which is lawful under UK adequacy but breaks a contractual UK-only promise. YTT Secunet treats UK as a separate zone with its own endpoint list, so a tenant marked UK-only cannot be served from Dublin by accident, and a tenant that allows EEA processing can say so in one line of policy.
IDTA, the Addendum and transfer risk assessments
When a UK workload does need a US model, the uk-gdpr-idta pack checks that the recipient is covered by a valid mechanism before the call is made: either the UK Extension to the DPF for opted-in organisations, or a signed IDTA or Addendum referenced in the tenant's configuration. The ICO's transfer risk assessment tool expects the exporter to consider the destination's laws and the practical risk to people; the pack lets you require pseudonymization of names, NHS numbers and National Insurance numbers before any such call, and record that it happened.
- Recipient check: the endpoint's provider must map to a DPF UK Extension participant or to a contract record holding an IDTA or Addendum reference.
- Data minimisation: NHS numbers, National Insurance numbers and UK postcodes are masked in-path, with the token table kept in the London vault.
- Evidence: each receipt carries the mechanism reference, so the transfer record in your Article 30 RoPA can point to real traffic.
Supported UK endpoints
UK routing uses London regions from the major providers plus self-hosted capacity for customers who want no hyperscaler dependency. Model availability differs by region and changes often; the Sovereign Endpoints registry shows which models each UK endpoint serves today and refuses a route to a model the region does not host instead of silently falling back to an EU or US region.
Failover for UK-only tenants stays in the UK: a provider outage in London moves traffic to a second UK provider or to the customer's UK vLLM cluster. Tenants that permit EEA processing can add Dublin or Frankfurt as a last resort, and the receipt shows which path was used.
Operational resilience for FCA and PRA regulated firms
UK banks and insurers have to map important business services, set impact tolerances and manage material outsourcing under the FCA and PRA operational resilience rules and PRA Supervisory Statement SS2/21. An AI assistant used in a customer-facing service is now part of that map. YTT Secunet supports the exercise in three ways: per-region SLOs published on the status page, scenario testing by forcing a region offline in a staging tenant, and an exportable list of every endpoint and subprocessor the gateway can reach.
Where our responsibility stops
YTT Secunet enforces where inference runs and signs a receipt for it. It does not give legal advice and does not replace your DPIA or transfer impact assessment.
Each entry is a specific deployment, not a provider as a whole. The registry pins region and deployment type, and refuses a route to a model the region does not serve instead of falling back to another zone.
Microsoft Azure OpenAI
UK South, London
Regional Standard deployments; EU data zone deployments are refused for UK-only tenants.
Amazon Bedrock
eu-west-2, London
In-region model IDs only; EU cross-region profiles can leave the UK.
Google Cloud Vertex AI
europe-west2, London
Regional endpoint only; the global endpoint is refused by policy.
vLLM on customer infrastructure
Customer data centre, United Kingdom
Open-weight models under the customer's own control; common failover target.
This is the rule set the gateway evaluates for United Kingdom traffic. Your application names it in the X-YTT-Policy header, pinned to a version, and the decision is made before the request is forwarded to any provider.
- Evaluated by Open Policy Agent in the regional data plane, under 3 ms median (YTT Secunet production telemetry)
- Pack id and version are written into every signed receipt, so an auditor can match traffic to the rule that allowed it
- A denial returns HTTP 451 with the decision id and reason; there is no silent reroute
- Legal teams review changes in the visual policy editor before engineering merges them
package yttsecunet.uk_gdpr_idta
default allow := false
# UK-only tenants: UK endpoints only.
allow if {
input.tenant.domicile == "UK"
input.tenant.residency == "uk_only"
input.endpoint.jurisdiction == "UK"
}
# Tenants that accept EEA processing rely on UK adequacy regulations.
allow if {
input.tenant.domicile == "UK"
input.tenant.residency == "uk_or_eea"
input.endpoint.jurisdiction in {"UK", "EU"}
}
# Any other destination needs a recorded transfer mechanism and masking.
allow if {
input.tenant.domicile == "UK"
input.tenant.residency == "mechanism_required"
input.endpoint.transfer_mechanism in {"uk_extension_dpf", "idta", "addendum"}
input.pii.masked
}
deny contains "no UK transfer mechanism recorded" if {
not allow
}London to a second UK provider or the customer's UK cluster; EEA only if the tenant allows it. Resilience comes from a second facility or provider inside the zone. If none is healthy the gateway refuses the request rather than sending it to the nearest region across the border.
- Client app, tenant domicile UK, calls uk.yttsecunet.com
- Primary: London
- In-zone failover: Second UK provider or UK cluster
- Never: Dublin, for UK-only tenants. With no healthy in-zone endpoint the gateway fails closed with HTTP 503.
Can UK personal data go to the EU without a transfer tool?
Yes. UK adequacy regulations cover the EEA, so a transfer from London to Frankfurt does not need the IDTA. Whether your customer contracts allow it is a separate question, which is why YTT Secunet lets you set UK-only or UK-or-EEA per tenant.
What is the difference between the IDTA and the Addendum?
The IDTA is a standalone UK transfer agreement. The Addendum is a short document that adapts the EU 2021 SCCs for UK transfers, which suits groups that already run the EU SCCs. Both are issued under s. 119A of the DPA 2018.
Does the UK Extension to the DPF cover every US AI provider?
No. It covers only US organisations that are certified under the DPF and have opted in to the UK Extension. The policy checks the recipient, not just the country.
Will the Data (Use and Access) Act 2025 change our routing?
It changes the legal test for future UK adequacy decisions and transfer assessments, not the physics of where a prompt is processed. Routing rules that keep UK data in the UK stay valid; we update the uk-gdpr-idta pack as provisions commence.
Sovereign route ready
Route UK inference inside the UK zone, with proof.
Change the base URL, name the policy pack, and every response carries a signed residency receipt your DPO can verify offline.