What shapes a software project in the United Kingdom
British regulation of business software is mature and well documented, which makes it predictable. The work is in applying it early: six areas decide more of the design than most briefs allow for.
| Topic | What it means for your system | Decide early |
|---|---|---|
| Data protection | UK GDPR and the Data Protection Act 2018, as amended in 2025, apply to any system holding personal data. They expect a lawful basis for each use, records of processing, security matched to the risk and an impact assessment where the risk is high | Who is the controller, who are the processors, and whether an assessment is needed |
| International transfers | If a development or support team outside the UK can reach personal data, that access is a restricted transfer unless the team's country is covered by UK adequacy regulations. Otherwise it needs a transfer agreement and a risk assessment | Whether anyone outside the UK will see live data, or only test data |
| Cookies and marketing | The privacy and electronic communications regulations require consent for most cookies and for marketing emails and texts to individuals, with a narrow exception for existing customers | How consent is collected, and what the system sends |
| Accessibility | The Equality Act expects service providers to make reasonable adjustments for disabled people. Public sector bodies must meet WCAG 2.2 at Level AA and publish an accessibility statement | The standard in the brief, and who tests against it |
| VAT and digital records | Making Tax Digital requires VAT-registered businesses to keep digital records and file returns through compatible software, with digital links between the systems involved. Mandatory e-invoicing between businesses has been announced for April 2029 | Where VAT data originates, and how it reaches your accounting software |
| Payments | Businesses pay each other by Faster Payments and collect regular amounts by Direct Debit. Open Banking lets a customer pay straight from a banking app, and card payments online need strong customer authentication | Which payment methods the system initiates or reconciles |
Workflows we build for British businesses
Four systems that show how the rules above turn into screens and steps.
Quote to cash with VAT
For service and trade businesses whose quotes, jobs and invoices live in different places.
- Enquiry logged
- Quote issued with VAT shown
- Job scheduled on acceptance
- Work signed off on site
- Invoice created in the accounting package
- Paid by bank transfer or card
Direct Debit collections
For membership bodies, schools, landlords and subscription services.
- Customer completes a mandate online
- Mandate lodged with the bank
- Advance notice sent
- Collection made on the due date
- Failures retried and chased
- Ledger reconciled
Data subject request handling
For any organisation that receives requests from people to see or erase their data.
- Request logged with its deadline
- Identity confirmed
- Records gathered across systems
- Third-party details redacted
- Response sent and filed
Client portal for a professional firm
For accountants, solicitors, surveyors and advisers.
- Client invited
- Documents exchanged securely
- Tasks and deadlines visible to both sides
- Fees paid by Open Banking
- Engagement archived under the retention policy
What we build
Operational systems
Job management, CRM, scheduling, stock and finance tools made to fit the way your organisation already works.
Data protection by design
Lawful basis, retention periods, access roles and audit trails modelled in the system, with the records a regulator would expect to see.
Development on test data
Realistic synthetic data for building and testing, so live personal data stays inside your environment and under your access controls.
Accounting and VAT integration
Digitally linked connections to packages such as Xero, Sage and QuickBooks, so figures are never retyped between systems.
Accessible interfaces
Screens designed to WCAG 2.2 and tested with assistive technology, with an accessibility statement drafted for you to publish.
Legacy replacement
Old databases and desktop tools moved to a modern platform in stages. Our comparison of modernising and replacing legacy software helps choose the route.
What we need from you
- Your data protection lead or adviser, for decisions on lawful basis and transfers
- Read access to the systems being replaced or connected
- A description of who uses the system and what they do in it
- Your accountant's input where VAT or bookkeeping is touched
- One owner for scope, priorities and sign-off
Ownership and licensing terms are defined in the project agreement.
A readiness checklist for a UK project
Before development starts
0 of 7 checkedWhat to do next
Tell us what the system needs to do, who will use it and which packages it must talk to. We will reply with our approach, the data protection questions to settle first and a realistic first phase. Start a conversation or book a 30-minute call.
Still running the business on workbooks? See our guide to replacing business spreadsheets with software.
Common questions
Can a development company outside the UK work on systems that hold personal data?
Yes, with the right arrangement. Under UK GDPR, giving people in another country access to personal data is a restricted transfer. It is allowed where that country is covered by UK adequacy regulations, or where a transfer agreement approved by the regulator and a risk assessment are in place. Many projects avoid the question by building and testing with synthetic data, so that live data never leaves your control.
Does our software have to meet accessibility rules?
Public sector bodies must meet WCAG 2.2 at Level AA for websites and apps and publish an accessibility statement. For everyone else, the Equality Act requires reasonable adjustments so that disabled people can use a service, without naming a technical standard. In practice Level AA is the benchmark buyers and courts recognise. Internal systems matter too, because employers owe the same duty to their staff.
What does Making Tax Digital mean for custom finance software?
If your system produces figures that end up in a VAT return, the data has to pass to the filing software through a digital link, not by retyping or copying and pasting. The return itself is submitted by software that HMRC recognises. Most custom systems meet the rule by integrating with an accounting package that files the return. The same idea now extends to income tax for sole traders and landlords.
How do UK customers expect to pay through our software?
By the methods they already use. Businesses settle invoices by bank transfer over Faster Payments and collect regular amounts by Direct Debit. Open Banking lets a customer approve a payment from their own banking app without typing card details, and cards online go through strong customer authentication. A system should match payments to invoices automatically, whichever route the money takes, and should support Direct Debit mandates if you bill on a schedule.
Where to go from here
Related serviceCustom Software DevelopmentSoftware that fits the process you already run