Buyer Guides · 7 MIN
How to hire a software development company in the UK
A UK buyer's guide to hiring a software development company: UK GDPR contract terms, VAT, Cyber Essentials, IP, FCA-regulated work, and working hours.
To hire a software development company in the UK, define the outcome in one page, shortlist teams that show shipped work and engineer access, and put four UK-specific items in the contract: a UK GDPR Article 28 processor clause, a lawful transfer route if data leaves the UK, the correct VAT treatment, and written IP assignment. This guide covers each.
- UK GDPR requires a written contract with any processor, and the ICO lists the minimum clauses.
- If the vendor is outside the UK, a restricted transfer needs adequacy regulations, appropriate safeguards such as the IDTA, or a narrow exception.
- Business services bought from an overseas vendor are normally subject to the UK VAT reverse charge, which usually nets to zero for VAT-registered buyers with taxable sales.
- Cyber Essentials is a government-backed baseline of five technical controls, and many UK buyers ask vendors for it.
- If you are FCA-regulated, your own rules about relying on third parties apply to the vendor relationship.
- Nactore is an AI-native technology and growth company in Mumbai that works with UK companies, with contract terms scoped to each engagement.
What should a UK buyer decide before talking to vendors?
Write down the outcome, the users, the data involved, and the date you need it. Then decide three things.
- Is this a product, an integration, or an internal tool? Each needs a different kind of team.
- What personal data will the team touch? None, test data, or live customer records.
- Who owns it on your side? One named person who can make decisions weekly.
Vendors are easy to compare when every one answers the same one-page brief.
How do you compare software development companies?
Compare on evidence, not on the brochure.
| Question | Strong answer | Weak answer |
|---|---|---|
| Can I see shipped work? | Live products or code you can review | Logos only |
| Who builds it? | Named engineers you can meet | "Our team will be assigned" |
| How do you handle change? | A written change process with effect on date and cost | "We are flexible" |
| How do you test? | Automated tests and a release checklist | "QA at the end" |
| What do I own at the end? | Code, docs, and credentials, assigned in writing | Unclear |
Our guide to questions to ask a software agency before signing expands the list.
What UK GDPR terms must the contract include?
If the vendor handles personal data for you, it is your processor, and Article 28 requires a written contract. The ICO sets out the compulsory terms on its page what needs to be included in the contract. In summary, the contract must:
- Limit processing to your documented instructions, including for international transfers.
- Require confidentiality from everyone with access.
- Require appropriate security measures.
- Allow sub-processors only with your authorization, on the same obligations.
- Help you respond to data subject requests and meet your own duties.
- Delete or return the data at the end.
- Allow audits and inspections.
The contract must also state the subject matter, duration, purpose, type of data, and categories of people affected. Many buyers attach this as a data processing schedule.
What if the vendor is outside the UK?
Sending personal data to, or making it accessible by, a separate organization outside the UK is generally a restricted transfer, subject to the ICO's conditions. The ICO says you need one of three routes: adequacy regulations, appropriate safeguards such as the IDTA, the Addendum, or binding corporate rules, or a limited exception. See its brief guide to international transfers. We go deeper on the India case in UK GDPR and data transfers to India.
The simplest way to reduce risk is design. Let engineers build and test with synthetic or masked data, and keep live personal data in a UK or EEA region where possible.
How does VAT work when you buy from an overseas supplier?
HMRC's VAT Notice 741A on the place of supply of services says the general business-to-business rule puts the supply where the customer belongs. When a UK business buys such a service from an overseas supplier, the UK customer accounts for the VAT under the reverse charge. In plain terms, you record output tax and input tax in the same return. If you can reclaim the input tax in full, the net cost is nil. If you make exempt supplies and cannot, you bear the VAT.
Your accountant should confirm how it applies to you, including what to enter on the VAT return.
Is Cyber Essentials worth asking about?
It is a reasonable question. The NCSC describes Cyber Essentials as the government-recommended minimum standard, built around five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. Cyber Essentials Plus adds independent testing of those controls.
If a vendor does not hold it, ask what they do instead. The honest answer matters more than the badge, and some public sector buyers require it, so check your own tender terms.
What if you are an FCA-regulated firm?
Your regulator sets expectations for relying on third parties. The FCA's pages on third-party reliance and operational resilience say a firm is responsible and accountable for all the regulatory responsibilities that apply to outsourcing and third party arrangements, and cannot delegate any part of that responsibility to a third party. From 18 March 2027, in-scope firms must also tell the FCA when they enter into or significantly change a material third party arrangement, and submit an annual register of those arrangements, as described on the FCA's reporting page. For the AI side of this, see AI for UK fintech.
Ask each vendor for a one-page exit plan before you sign. A team that can describe how you leave cleanly is usually a team that expects to be kept on merit.
Who owns the code, and how does time overlap work?
Put a written assignment of intellectual property rights in the contract, effective on payment, and list any third-party or open source components with their licences. Do not rely on assumptions about default ownership.
On working hours, a team in India is 5.5 hours ahead of UK winter time and 4.5 ahead in summer, which leaves a long shared morning and early afternoon. See US and UK time zone overlap with India teams for the working-window table.
Frequently asked questions
Do I need a UK-based software development company?
Not legally. UK GDPR attaches to your data and your processing, not to where the vendor sits. If the vendor is outside the UK, you need a lawful transfer route and a clear contract.
Do I need a data processing agreement with my software vendor?
If the vendor processes personal data on your behalf, yes. Article 28 requires a written contract, and the ICO lists the minimum terms.
How do I check a software company is reliable?
Ask to see shipped work, meet the engineers who would build yours, and speak to a reference. Ask how they test, how they handle changes, and what you receive at the end.
Should I choose fixed price or time and materials?
Fixed scope suits a well-defined outcome, and time and materials suits discovery-heavy work. Our comparison for AI projects is in fixed-scope pilot versus time and materials, and much of it applies to any build.
Choose on evidence, contract for your data
A good UK software partner shows shipped work, signs the data terms UK GDPR requires, and hands over what it builds. The rest is detail you can check.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.