XcellHost|UK Go-To-Market Strategy

Hosting and support access from India is a restricted transfer under UK GDPR. India is not covered by UK adequacy regulations, so a transfer agreement and a risk assessment are needed; the Data (Use and Access) Act frames this as a "not materially lower" test. UK buyers, especially public bodies and FCA-regulated firms, will expect UK hosting. So customer data stays in a UK partner DC, or in our Frankfurt and Düsseldorf partner DCs where an EU location suits, and Mumbai runs tooling, monitoring and second-line support. The EU's adequacy decisions for the UK run until 27 December 2031.

Probably, once it becomes law. The Bill passed the Commons on 16 June 2026 and was in the Lords at our last check, with no Royal Assent found. It brings managed service providers that run or connect to customers' IT systems into the NIS regime, including providers based outside the UK. They would register with the ICO, report incidents within 24 hours with a full report within 72 hours, and notify affected customers. Fines reach £17 million or 4% of worldwide turnover. Details come in secondary legislation.

For assessments started after 27 April 2026, multi-factor authentication is mandatory on every cloud service where it is available, and missing it is an automatic fail. Cloud services cannot be left out of scope, and partial scope must be justified. Only 5% of UK businesses held Cyber Essentials in the 2025/26 survey, so most SMEs, suppliers to government and supply chains still have work to do.

Not as at our last check. The UK uses a sector-specific approach, in which existing regulators apply AI principles in their own areas. The Data (Use and Access) Act widened the room for automated decision-making from 5 February 2026, with safeguards. UK firms selling AI systems into the EU still face the EU AI Act. Customers therefore need AI inventories, governance and staff skills, which suits advisory and training-led selling.

UK VAT is 20%. For business-to-business services supplied from abroad, the UK customer usually accounts for VAT under the reverse charge, but we have not re-verified this for each service type. Whether the UK withholds tax on payments to India, and how the India–UK tax treaty applies, also needs advice. A UK company pays corporation tax at 19% to 25% and registers for VAT above £90,000 of taxable turnover. Get advice for each contract structure.

Analysts define markets differently. For cloud, IMARC put 2025 at US$31.6 billion and Mordor at US$56.08 billion. For cyber security, Mordor measures UK demand at US$14.77 billion, while DSIT counts £14.7 billion of revenue earned by UK cyber firms, including exports. Data-centre capacity is 1,376 MW for London alone. We show both ends with sources and do not average them.

No. The 18-month goals and the revenue model use assumptions for target accounts, win rates and contract values, chosen to start a discussion. Change them in the revenue model. Only the market-size, legal and macro figures come from cited third parties.