What shapes an app project in the United Kingdom
Most of what a UK app must get right is settled before a line of code: what data it takes, who is likely to use it, and which buyer or regulator will ask to see the evidence.
| Topic | What it means for your app | Decide early |
|---|---|---|
| Data protection | UK GDPR applies to the personal data an app collects, including location, contacts and device identifiers. An impact assessment is expected where the risk is high, as with tracking, health data or children's data, and reading information from the device needs consent unless it is strictly necessary | What the app collects, and which permissions it truly needs |
| Children | The Children's Code applies to apps likely to be accessed by under-18s, whether or not they are aimed at children. It expects high privacy by default, location sharing switched off and no design that nudges children to give up privacy. Apps with user-to-user features may also fall under the Online Safety Act | Who is likely to use the app, and how you know |
| Payments | Apple Pay and Google Pay are widely used, card payments need strong customer authentication, and Open Banking lets a customer approve a payment in their banking app. Digital goods sold in the app use the stores' billing | What the app sells, and which payment routes it offers |
| App stores | The competition regulator gave Apple's and Google's mobile platforms strategic market status in 2025 and has since secured commitments on app review. Further changes to store rules in the UK are possible | Who follows store policy, and how fast the app can adapt |
| Marketing messages | The regulator treats in-app marketing messages like email and text marketing, which need consent or the existing-customer exception. Push notifications need the user's permission on the device | Which messages are service, which are marketing, and the consent for each |
| Accessibility | Public sector apps must meet WCAG 2.2 at Level AA and publish an accessibility statement. Other apps fall under the Equality Act's duty to make reasonable adjustments | The level in the brief, and the devices used for testing |
| Health and public sector buyers | NHS organisations assess health apps against published digital technology criteria covering clinical safety, data protection, security and usability. Other public buyers commonly ask for Cyber Essentials | Whether you will sell to the NHS or the wider public sector |
Workflows we build for the UK market
Four journeys that show where British rules and habits change an app.
Pay by bank in an app
For apps that take payments and want an alternative to cards.
- Customer chooses pay by bank
- Picks their bank
- Banking app opens for approval
- Customer returns to your app
- Payment confirmed
- Receipt stored in the account
Child-safe onboarding
For apps that young people are likely to download.
- Age established in a proportionate way
- Privacy settings start high
- Location sharing off
- Explanations written for the age group
- Parents informed where appropriate
Repairs reporting for housing
For landlords and housing providers with tenants to serve.
- Tenant reports a repair with photos
- Appointment offered
- Engineer sees the job on their phone
- Work recorded, even without signal
- Tenant confirms completion
Membership and loyalty
For retail, leisure and hospitality brands.
- Customer joins in the app
- Card added to the phone's wallet
- Points earned at the till
- Offers sent with consent
- Rewards redeemed in store or online
What we build
Bespoke iOS and Android apps
Custom apps, native or cross-platform, built for your service. Our native vs cross-platform comparison explains how we choose.
Data protection groundwork
A data map, the technical input to your impact assessment and permission prompts that ask only for what the app needs.
Children's Code design
Age-appropriate defaults, plain explanations and an interface free of nudges, for apps that under-18s are likely to use.
Payments in the app
Wallets, authenticated card payment and pay by bank through your provider, with refunds handled in the back office.
Accessibility and assurance
Design and testing to WCAG 2.2 AA, an accessibility statement where required and the documents a public sector assessment asks for.
Release and handover
Store listings, review handling and a handover pack of code, credentials and documentation, itemised in the proposal.
What we need from you
- A description of the app and who is likely to use it
- Your data protection lead, from the first workshop
- The payment provider you use, or want to use
- Any buyer standards, such as NHS or public sector requirements
- Access to the systems the app must connect to
Ownership and licensing terms are defined in the project agreement.
A readiness checklist for a UK app launch
Before development starts
0 of 8 checkedWriting requirements? Our guide to writing a mobile app requirements document gives a structure.
What to do next
Tell us what the app is for, who is likely to use it and which systems it connects to. We will reply with an approach, the data protection points to settle first and what a first release should contain. Start a conversation or book a 30-minute call.
Common questions
Does the Children's Code apply to our app?
It applies if under-18s are likely to access the app, not only if it is aimed at them. The regulator expects you to assess that realistically, using evidence about your users. Where it applies, the app should default to high privacy, keep location sharing off, avoid nudge techniques and explain itself in language the age group understands. An app that is truly adults only should be able to show why.
Can our app take payment by Open Banking instead of cards?
Yes. With a pay by bank option, the customer approves the payment in their own banking app and returns to yours with the money on its way. There is no card number to enter or store. It suits bill payments, top-ups and larger purchases especially. Because refunds and disputes differ from cards, most apps offer it beside wallets and cards. Your payment provider must support it.
Bespoke app or white-label product?
A white-label product is quicker to launch and makes sense when your service matches what the product already does. A bespoke, or custom, app is the better choice when the journey is particular to your business, when it must connect deeply to your systems or when the app is itself the product. We will tell you if an existing product would serve you well enough.
What do we need to supply an app to the NHS or a council?
Expect an assessment. NHS organisations use published criteria covering clinical safety, data protection, technical security, interoperability and usability. Councils and other public bodies ask for accessibility to WCAG 2.2 AA with a statement, and usually for evidence of basic cyber security. Building with these in mind from the first sprint is far easier than gathering the evidence afterwards. Ask the buyer for their checklist early.
Where to go from here
Related serviceMobile App DevelopmentFrom first sketch to both app stores