Choosing a Software Development Partner in the UK

Scope of this guide

This is a supplier-evaluation guide for UK organizations commissioning custom software. It is based on what the National Cyber Security Centre and the ICO say, and it is written as questions you can ask. Every rule quoted below was checked against the regulator's own page on 2 October 2026; check the current version before you rely on it. This is general information, not legal advice.

What Cyber Essentials is

The NCSC describes Cyber Essentials as "the minimum standard of cyber security recommended by the Government for organisations of all sizes." It covers five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. There are two levels: Cyber Essentials, which combines self-assessment with an independent audit, and Cyber Essentials Plus, which adds independent technical testing. The NCSC notes that "a growing number of organisations require suppliers to be certified to bid for work."

Questions to ask a development partner

• Does the company hold Cyber Essentials or Cyber Essentials Plus, and can you see the certificate and its scope?
• Who owns the code, and what happens to it if the relationship ends?
• Where will your data be stored and processed during development and in production?
• Who has access to your systems and data, and how is that access controlled and removed?
• How are security updates handled after launch, and who is responsible?
• What does the contract say about personal data, sub-contractors and breach notification?

Where the supplier is based

If a supplier outside the UK will handle personal data, the ICO's rules on restricted transfers apply: the transfer must be covered by UK adequacy regulations, appropriate safeguards (with a transfer risk assessment), or an exception, and you must not make it if none applies.

Where Zunkiree Labs fits

Zunkiree Labs builds custom AI systems (including RAG pipelines, LLM integration and intelligent automation), data systems, custom software, and web and mobile applications, and is based in Nepal. The full list is on the services page. Because Zunkiree Labs is based in Nepal, a UK project involving personal data would raise the transfer question above. We do not claim any UK certification on this page: ask any supplier, including us, which certifications it holds and for the evidence.

Sources

• NCSC: Cyber Essentials overview
• ICO: International transfers, a guide (updated 15 January 2026)