Cross-border review law: a Belfast response checklist

What to take away

Why Belfast review work crosses a legal border

Belfast sits closer to Dublin than to London, and its customer base reflects that. A restaurant on the Ormeau Road, a software firm in the Cathedral Quarter or a tourism operator on the Antrim coast can pick up reviews from Dublin, Dundalk and Cork without trying.

Each review arrives under whichever law applies where it is read, not where it was written.

Northern Ireland also has its own court structure and a separate legal profession, so a Belfast solicitor and a Dublin solicitor may give different advice on the same post. That is not a reason to panic. It is a reason to sort the review by the market it affects before drafting any response.

The practical split is threefold. UK consumer law governs the trader's conduct towards UK consumers. Ireland's consumer and defamation law governs conduct towards consumers in Ireland. Platform terms and data protection law sit over both. Treat them as separate tracks and the work becomes manageable.

For background on how the UK regimes fit together, see our status matrix for UK review work.

UK consumer law checks for Northern Ireland businesses

The Digital Markets, Competition and Consumers Act 2024 gives the UK a statutory footing for banned fake reviews, and it applies in Northern Ireland as it does in England, Scotland and Wales.

The Digital Markets, Competition and Consumers Act 2024 matters because it moves fake-review rules from guidance into law, with the Competition and Markets Authority (CMA) as the main enforcer.

The older Consumer Protection from Unfair Trading Regulations 2008 still matter for conduct that predates or falls outside the new regime, particularly misleading omissions and aggressive practices. The Consumer Protection from Unfair Trading Regulations 2008 remain the reference point for legacy unfair commercial practices in cross-border review advice.

Check these points against your own listings and review flow:

The CMA publishes its work on online reviews and its consumer protection guidance on GOV.UK, and that material sets out how the regulator reads review manipulation. Read it before you assume a small Belfast business is below the radar, and check your own review flow against the banned practices in the 2024 Act.

Ireland consumer law checks when reviews reach southern customers

Ireland is a separate jurisdiction with its own consumer statute, the Consumer Protection Act 2007, enforced by the Competition and Consumer Protection Commission. A Belfast trader selling into Ireland is dealing with Irish consumers, and Irish rules on misleading commercial practices apply to that conduct.

Irish defamation law is the sharper edge. The Defamation Act 2009 allows a person identified in a publication to seek redress, and a review that names a staff member or implies criminality can move quickly from a platform complaint to a solicitor's letter. Irish claims are heard in the Circuit Court or the High Court, and an early correction or apology can reduce exposure, so advice before you reply is worth more than a defence built afterwards.

That is the Irish track. Northern Ireland runs a different one. The Defamation Act 2013 does not extend to Northern Ireland, so claims there still rest on the common law as modified by the Defamation Act 1996, which applies across the UK and supplies the offer of amends procedure. A Belfast business can therefore face an Irish action over a review read in Dublin and a Northern Ireland action over the same words read in Belfast, under two different sets of defences.

Check the southern exposure separately:

The Competition and Consumer Protection Commission is the obvious first stop for a misleading review aimed at Irish consumers, and the platform's own Irish complaint route usually moves faster than either regulator. Keep the language factual and avoid repeating the allegation in your reply, because repetition can widen publication.

Platform jurisdiction and where a review is actually published

A review is published where it is read, and platform terms decide the takedown route. Google, Trustpilot, Facebook and TripAdvisor each run their own content policies and appeal processes, and each has an establishment in a specific jurisdiction. That establishment, not your Belfast address, usually determines which law governs the hosting question.

The rules you are appealing against are public and specific. Google Business Profile reviews are judged against Google's prohibited and restricted content policy, and a flagged review is appealed through the Business Profile help flow. Trustpilot reviews are judged against Trustpilot's review guidelines and reported from the review itself. Facebook content is judged against Meta's Community Standards, reported from the post and appealed through the support inbox. TripAdvisor reviews are judged against TripAdvisor's content policy and reported through the report-a-review link on the page. Name the clause you rely on in every appeal, and keep the appeal reference.

Ask four questions before you escalate. Which platform hosts the review? Where is that platform's contracting entity established? Which country's consumers see the review most? Has the reviewer used a verified account or an anonymous one? The answers set the route: platform appeal, CMA complaint, Irish legal letter or data protection request.

Escalation order matters. A platform appeal is cheap and fast, and it creates a record. A regulator complaint is slower but carries weight. A legal letter is expensive and should follow, not lead, unless the content is clearly defamatory or amounts to harassment.

If the dispute needs structure, our framework for one disputed review, from evidence freeze to recovery, sets out the sequence we use for Belfast clients.

What review and reputation software holds

Most Belfast firms meet a review dispute inside a tool rather than a courtroom. Google Business Profile and Facebook hold the review on the platform itself. Trustpilot, Feefo and Reviews.io run their own collection and dispute workflows, each with published guidelines and its own report route. Reputation suites such as Birdeye and Yext pull reviews from several sites into one inbox with alerting and reporting.

Which tool holds the record shapes the legal checks. The posting account, the timestamp, the invitation email, the reply thread and the deleted-review log all sit in the software, and that is the material a platform appeal, a regulator complaint or a data protection request will be judged on. Export it before you escalate, and check whether the vendor's own dispute route runs under UK or Irish terms.

Review invitation settings carry their own risk. A tool configured to invite only happy customers, or to offer a reward for a positive review, can create exposure under the banned practices in the Digital Markets, Competition and Consumers Act 2024 even where the reviews themselves are genuine.

Data protection across the border: UK, EU and Irish rules

Reviewer data is personal data, and UK GDPR applies to Belfast businesses processing it. The Data Protection Act 2018 supplements UK GDPR and sets out the ICO's powers and the exemptions available.

The Data Protection Act 2018 is the framework to read alongside UK GDPR when you handle reviewer identities, IP addresses or account details.

The Irish side has its own regime. The EU GDPR and Ireland's Data Protection Act 2018 apply to processing in Ireland, supervised by the Data Protection Commission in Dublin. Where a Belfast firm offers goods or services to people in Ireland, or monitors their behaviour, the EU GDPR's territorial rules can reach that processing too, so one review campaign aimed at Dublin customers can sit under two data protection regimes at once. A firm with no establishment in Ireland may also need to appoint a representative there.

Cross-border data protection questions arise in two directions. A Belfast firm may receive a subject access request from a reviewer in Ireland, and it may also want to identify an anonymous reviewer using platform data. Both need a lawful basis, and the second is rarely straightforward.

A Belfast hotel gets a one-star review alleging food poisoning from an account with no booking history. The hotel freezes the review, the booking records and the staff rota. It asks the platform to verify the account rather than demanding the reviewer's identity.

The platform removes the review for policy breach, and no data protection request is needed. Cost: staff time. Risk: low.

If you do pursue reviewer identity, document the lawful basis, the necessity test and the balancing exercise before you ask. The ICO expects proportionality, and a fishing expedition is a data protection problem in its own right. For the deletion route, see our guide to data protection, from frozen source to deletion evidence.

A cross-border review dispute checklist for Belfast teams

Use this checklist in order. It assumes one disputed review with a possible Irish dimension.

A short worked example of the classification step. A Belfast ecommerce firm sells to both GB and Ireland. A Trustpilot review claims non-delivery. The order record shows delivery to Dublin. The firm replies factually, offers the tracking reference, and reports the review to Trustpilot for containing a false claim.

No regulator or solicitor is involved. The Irish element is handled by treating the Dublin customer under Irish consumer expectations while the platform dispute runs under Trustpilot's own terms.

Keep the language neutral in every public reply. State facts, avoid repeating the allegation, and avoid naming staff. A calm reply often does more for a Belfast business than a legal threat, and it reads better to the next customer who checks the profile.

Common questions