Data transfers: the three country summaries.

How the transfer works

The data stays on our servers. The contractor sees only the prospects assigned or handed to them, in a web browser, over an encrypted connection, and keeps no copy, download, screenshot or note of it outside the CRM. It is business contact data: business names, published phone numbers and addresses, trades, call outcomes and notes about website needs. No identity documents, bank details or health information are ever shown to a contractor. We can end anyone's access at once from our side.

Each contractor's agreement includes the UK International Data Transfer Agreement (IDTA, version A1.0, issued under section 119A of the Data Protection Act 2018) as its Schedule 1, with Frame Empire as exporter and the contractor as importer. The people whose data it is, and the Information Commissioner's Office, can enforce it.

We assessed each country with the ICO's transfer risk assessment tool. All the data is low or moderate risk, so the tool asks for a short investigation of each country: its law on access by public authorities, and the human rights picture from the Foreign, Commonwealth and Development Office and Amnesty International. In all three, the conclusion is that the transfer may go ahead with the IDTA: taken as a whole, protection is not materially lower than in the UK.

A contractor signing for one of these countries confirms they have read the summary for their country below. The full assessment is theirs on request at hello@frameempire.co.uk.

Nigeria

The law on access by public authorities. The Constitution (section 37) protects the privacy of homes, correspondence and telephone conversations, subject to laws that are reasonably justifiable in a democratic society. The Nigeria Data Protection Act 2023 keeps its core principles, lawful basis and breach rules even where public authorities process data for crime, health emergencies or national security. Under the Cybercrimes Act 2015, service providers keep traffic data and release it to law enforcement on request, and intercepting content needs a judge's order; those duties fall on telecoms and internet companies, not on a person selling for us. A contractor in Nigeria also has processor duties under the Nigeria Data Protection Act that match their agreement.

What it means for this data. The people in it are UK business owners and staff, and the data is mostly already public. It is stored in the UK; a public body in Nigeria could reach it only through the contractor's device and login, which we can cut off at once. The transfer does not significantly increase the risk to them.

The Philippines

The law on access by public authorities. The Constitution (Article III, section 3) makes the privacy of communication inviolable except on a lawful court order, or when public safety or order requires it as the law prescribes, and evidence obtained in breach cannot be used. The Data Privacy Act 2012 keeps its security duties even for data collected from people abroad. Under the Cybercrime Prevention Act 2012, disclosure and search of computer data need a court warrant, and the Supreme Court struck down its power to collect traffic data in real time without one. Surveillance under the Anti-Terrorism Act 2020 needs a written order of the Court of Appeals.

What it means for this data. For the same reasons as Nigeria, and because reaching data held by a person needs a court warrant, the transfer does not significantly increase the risk to the people in it.

Pakistan

The law on access by public authorities. The Constitution (Article 14) protects dignity and, subject to law, the privacy of the home. Pakistan has no general data protection law in force yet, so the contractor's duties come from their agreement and the IDTA. Under the Prevention of Electronic Crimes Act 2016, as amended in 2025, an authorised officer can require data to be preserved or provided by written notice for up to 90 days, telling the court within 24 hours; search and seizure, disclosure of content and real-time collection need a court warrant or order. Separately, the federal government can authorise interception of calls and messages through telecommunication systems in the interest of national security; a 2024 authorisation under that power is being challenged in court.

What it means for this data. The concerns here are real and broader than in the other two countries, particularly the interception power. They concern communications on Pakistani networks and people of interest to the state. The data in our CRM is UK business contact data with no political, religious or security content, viewed over an encrypted connection to UK servers and not stored in Pakistan. The transfer does not significantly increase the risk to the people in it. Because the concerns are greater, we will look at this part again if the data protection bill becomes law or the electronic crimes law changes again.

What would change these conclusions

Any higher-risk data reaching a contractor abroad, such as identity documents, bank details or health information; a lead list exported or kept outside the CRM; a new law in one of these countries requiring disclosure of foreign data, or a court decision on Pakistan's interception power. We do not issue an agreement for any other country without UK adequacy until we have assessed that country too.

Frame Empire Ltd, registered in England and Wales, Company No. 16163944. Registered office: 4 Thameshill Avenue, Romford, Essex, RM5 3BU.