Where Does Your IoT SIM Data Actually Go? A UK Guide to Roaming, Local Breakout and Data Sovereignty

The journey nobody draws on the network diagram

I have sat through a lot of IoT architecture reviews over the years, and they nearly all have the same diagram. A device on the left. A cloud on the right. Somewhere in the middle, a little lightning bolt labelled “4G” or “cellular”, and an arrow going straight across. Job done.

The cloud end gets a forensic level of attention. Which region, which availability zone, who has admin access, where the backups live, whether the database is encrypted with a key the customer holds. People will argue for an hour about Azure UK South versus UK West.

Then the device end gets a SIM, usually chosen on price and the number of networks it can see, and nobody asks the obvious question: when that SIM sends a packet, where does it actually go before it reaches the cloud?

For a lot of UK IoT deployments the honest answer is “via another country”. Your smart meter is on a wall somewhere in Britain, it is attached to a British mast, your application sits in London, and the data has still popped over to Frankfurt or Amsterdam for a cup of tea on the way. Nothing is broken. Nobody has done anything wrong. It is simply how most roaming SIMs are built, and almost nobody puts it on the diagram.

This guide is my attempt to put it on the diagram. I want to explain how cellular data is really routed, why “UK SIM” and “UK data” are not the same thing, what UK GDPR does and does not say about it, where it genuinely matters, and what to ask your provider. I will also be clear about where it does not matter, because I have no interest in adding another scare story to an industry that already has plenty.

Four questions people muddle together

When someone tells me their IoT data “stays in the UK”, I find it helps to split that into four separate questions, because they usually only checked one of them.

The third question is the one this article is about. It is also the one most buyers have never asked, partly because it is invisible. The phone shows “Vodafone UK” in the corner, the portal says the SIM is attached to a UK network, and everyone assumes the rest follows. It does not.

A small housekeeping note while we are here. A lot of UK SIM marketing still talks about “all four UK networks”. Since Vodafone and Three completed their merger at the end of May 2025, there are three UK network operator groups, even if the radio networks and brands are still being knitted together. Keep that in mind when you read a datasheet.

How roaming SIMs actually route your data

A SIM belongs to a home network. If you put that SIM in a device in another country, the local network (the “visited” network) lets it on to the radio, authenticates it with the home network, and carries its traffic. The interesting part is what happens to the user data after that. There are three broad ways to do it.

Home routing

The visited network provides the radio and the first part of the core, then tunnels your data back to the home operator. The packet gateway (the PGW in 4G, the UPF in 5G) sits in the home network, and that is where your data finally leaves the mobile world and heads for the internet or your private network. Home routing is the default model for traditional roaming because it keeps policy, charging, IP addressing and control with the home operator.

Local breakout

The data session is anchored in the visited country instead, so traffic exits close to where the device is. 3GPP has defined both models for years, in 4G and again in 5G, so this is not some exotic workaround. It is just less common in practice for classic operator roaming.

Regional or hub breakout

This is the middle ground that most modern IoT platforms use. The provider runs packet gateways in a handful of regions, often in public cloud, and breaks traffic out at the nearest one. For a UK device that might mean Ireland, Frankfurt or Amsterdam rather than the provider’s head office country, but it is still not necessarily the UK.

What this looks like with real IoT SIMs

I did not want this to be theoretical, so I went through the published documentation of some well-known global IoT SIM providers to see where they say traffic breaks out. To be clear, none of these providers is doing anything wrong. They publish this openly, and regional breakout is a sensible design for a global product. The point is that the details are in the developer docs, not on the sales page.

My favourite real-world example is not from a global provider at all. A UK business reseller selling unsteered multi-network SIMs answers this exact question in its own FAQ, explaining that for a SIM to roam freely across UK networks, traffic sometimes has to go through the underlying operator’s network outside the UK. Credit to them for saying it plainly. I suspect most of their customers never read that far.

The Twilio default is the one that makes me smile. Plenty of developers have prototyped on a UK desk with that SIM, pinged a server in London, and never noticed their packets were doing a transatlantic round trip.

Who is building the alternative

The industry knows all this, and quite a lot of it is moving away from pure home routing. The approaches vary, but they share an idea: keep the multi-network, single-SKU convenience of a roaming SIM, while moving the packet gateway closer to the device.

Two comments from the operator side are worth noting. Vodafone IoT’s view, as reported earlier this year, is that within the EU and the UK its global SIM can move around without triggering residency concerns, and that localisation is for the more protectionist markets. That is an honest and defensible position, and it is a useful reminder that a big operator does not see EU breakout for UK traffic as a problem in itself.

Wireless Logic’s Europe and UK boss made the other half of the argument around World IoT Day: eSIM and SGP.32 solve the identity side, but genuine data sovereignty also needs local breakout, in-country processing and control of the core. I agree with that completely, and it is the point most eSIM marketing skips.

So when you hear “UK local breakout”, treat it as a feature to verify rather than a rare unicorn. Several providers can do it. The question is whether your SIM, on your tariff, with your APN, actually does.

Sovereignty, residency and GDPR are not the same thing

This is where articles on this subject tend to go off the rails, so let me be careful.

A UK device whose data breaks out in Frankfurt, Amsterdam or Dublin is not automatically a UK GDPR problem. The UK has adequacy regulations covering all the EEA states, so personal data can flow from the UK to those countries without the extra transfer safeguards you would need for, say, a non-adequate country. The traffic also runs the other way: the European Commission renewed its adequacy decisions for the UK in December 2025, and they now run to the end of 2031.

So if someone tries to sell you a SIM on the basis that your current one is “illegal under GDPR” because it breaks out in Germany, show them the door politely.

What is true is that GDPR compliance is the floor, not the ceiling. Organisations are allowed to set stricter rules than the law requires, and many do. That is where these terms become useful:

An organisation can be perfectly compliant with UK GDPR and still have a procurement policy that says “operational data stays in the UK”. At that point adequacy is irrelevant. The supplier either meets the specification or it does not.

Where it genuinely matters

Healthcare

NHS England’s cloud guidance sets the direction that NHS data stored at rest should remain in the UK. It allows processing elsewhere in Europe, but says UK services should be the default where possible, and that any cloud workload sending data outside the UK for processing should go through a DPIA. Sovereignty has also become politically hot in health: sovereignty was a recurring theme in the Commons debate on the NHS Federated Data Platform in April this year.

Now picture a connected medical device or a remote monitoring hub on a home-routed roaming SIM. The data is not stored at that overseas gateway, but it is processed there in the plain network sense, and it crosses a border twice. Is that a problem? Possibly not. Is it in the DPIA? In my experience, almost certainly not, because nobody knew to put it there.

Government and the public sector

Government guidance is actually more relaxed than people assume. Official guidance states that there is no universal requirement for data classified as OFFICIAL to be physically located in the UK, provided the legal, data protection and security arrangements are satisfactory. It is a risk-based decision, not a blanket ban.

But look at how departments define offshoring. DWP’s contractor policy, for example, treats it as any arrangement where part of the service happens outside the UK, and that explicitly includes contractor staff overseas accessing systems hosted here. That is the right way to think about cellular too: it is not only where the gateway sits, it is who runs it and from where.

Critical infrastructure and OT

This is where I think the conversation is most overdue. Substations, pumping stations, water treatment telemetry, EV chargers, building management, rail-side kit, CCTV. Much of it runs over cellular, and much of it runs over SIMs bought on price.

The question for OT is rarely “are we legally forbidden to route via Amsterdam?” It is “why are we routing operational traffic via Amsterdam if there is no reason to?” Every extra country, network and operator in the path is another dependency, another party with visibility of your traffic metadata, and another thing to explain after an incident.

Latency: the irony of the UK-to-UK round trip

Sovereignty is only half the story. Distance costs time.

The best independent work on this is a European measurement study from 2018, which used SIMs from 16 operators across six countries. It found that operators overwhelmingly used home routing, and that this added latency penalties of 60 ms or more depending on distance. The authors also found that the largest delay penalty comes when a roaming device talks to a server in the country it is visiting, because every packet has to go to the home network and back.

Read that again in a UK context. A device in the UK, talking to an application in the UK, on a SIM that breaks out abroad, is the worst case for latency. You pay the round trip twice.

For a temperature sensor sending 40 bytes every hour, nobody will ever notice. For remote access, CCTV, VoIP, SD-WAN, VPN-heavy industrial gateways or anything interactive, it is real, measurable and avoidable.

Four radio networks, one core

Multi-network SIMs are sold on resilience, and at the radio layer that is fair. If one network has no coverage or falls over, the SIM can attach to another.

But radio resilience and end-to-end resilience are different things. If every one of those radio paths converges on the same overseas packet gateway, you have one common dependency sitting behind all of them. Lose that core, or the roaming link to it, and it does not matter how many masts you can see.

The flip side is also true. When Vodafone UK suffered a major data outage on 13 October 2025, blamed on a software issue at one of its vendors, 4G and 5G data went down while 2G voice and SMS carried on. Providers whose traffic exits through their own core rather than the carrier’s internet gateway, and whose SIMs could move to another network, had a better afternoon than single-network users. Pangea, for one, has written about its SIMs on Vodafone continuing to pass data through that window because they terminate on its own core.

If you want to see the trade-off for yourself, go back to the explainer above, pick UK local breakout and try the two failure buttons.

So the lesson is not “home routing bad, local breakout good”. It is: know where your single points of failure are, because a multi-network SIM can hide one very effectively.

“But it’s all encrypted”

Someone always says this, and they have a point. If your device uses properly configured TLS or a VPN end to end, an intermediate packet gateway cannot read the payload. That deals with a large part of the confidentiality risk.

It does not deal with everything. The gateway still sees metadata: IP addresses, timings, traffic volumes and patterns, and often DNS lookups. It still sits in a particular jurisdiction under a particular operator. It still adds latency and a dependency. And if your contract says data must not leave the UK, “it was encrypted when it left” is unlikely to satisfy whoever wrote that clause.

Encryption and sovereignty solve different problems. You usually want both.

UK breakout is not the same as UK sovereign

Here is the nuance I would most like readers to take away, because it is where the next round of marketing will get slippery.

A provider can truthfully say “UK local breakout” and still process other parts of your service elsewhere. The user plane (your actual data) might exit in London while some of these live in other countries:

• authentication and subscriber data (the HSS or UDM)
• the SIM management portal and its API
• usage records, billing data and logs
• DNS resolution
• SMS handling
• the support and network operations staff who can log in to all of the above
• backups and disaster recovery sites

None of that is unusual, and for most customers it is fine. But “UK breakout” is a routing claim. “UK sovereign” is a much bigger claim about the whole service, its operators and its staff. Buy the first on evidence, and only accept the second with documentation.

When it really does not matter

I promised I would say this, so here it is. Plenty of IoT deployments can and should ignore all of the above.

If your devices send small amounts of non-personal data, latency is irrelevant, nobody has written a residency requirement into a contract, your traffic is encrypted, and the roaming SIM gives you better coverage at a better price, then home routing via Frankfurt is a perfectly good engineering choice. A soil moisture probe does not need a sovereign cellular architecture.

The aim is not to make everyone buy UK breakout. It is to make the routing a decision rather than an accident.

How to find out where your data actually goes

You do not need specialist kit for a first look. From a device or router using the SIM:

1. Check the public IP address the SIM is given and look up its owner (the ASN) and registered location. A Frankfurt or Ashburn cloud range is a strong hint.
2. Run a traceroute to a server you know is in the UK and look at where the early hops sit.
3. Measure round-trip time to that UK server and compare it with a native UK SIM in the same spot. A consistent extra few tens of milliseconds tells its own story.
4. Check the APN. Some providers move breakout simply by changing it.

A word of caution: IP geolocation databases are often wrong, and an address registered in one country can be announced from another. Treat these tests as evidence to take to your provider, not as proof. If you use a private APN or VPN, the public IP test will not tell you much, and you will need to ask where the APN gateway and VPN concentrator are hosted.

The questions to ask your IoT SIM provider

This is the part I would copy straight into an RFP. Ask for written answers, not a call.

1. Which home network or IMSI does the SIM use when it operates in the UK?
2. Which UK radio networks can it attach to?
3. When the SIM is in the UK, in which country does user-plane traffic break out?
4. Is that home routing, regional breakout or local breakout?
5. Where is the packet gateway (PGW or UPF) hosted, and who operates it?
6. Does that answer change with the APN, tariff or IMSI the SIM is using?
7. Will you commit to UK breakout contractually, rather than “normally routed via”?
8. If the UK gateway fails, does traffic fail closed or reroute to another country?
9. Where are authentication and subscriber data held?
10. Where is the SIM management platform hosted, and where are usage records and logs stored?
11. Where are DNS requests resolved?
12. From which countries can your operations and support staff access our service and data?
13. Which subprocessors and roaming partners are involved in carrying our traffic?
14. For private APN and VPN services, where are the APN gateway and VPN termination hosted?
15. Can you provide a data flow diagram we can put in our DPIA or supplier assessment?

A good provider will answer these in a day. A provider that cannot answer them has told you something useful too.

Where this is heading

I see three generations of global IoT connectivity side by side in the market right now.

The first is the classic roaming SIM: one home network, permanent roaming everywhere, and home-routed traffic. Brilliant for getting devices online anywhere, less brilliant for routing.

The second is the distributed core: one provider, many radio partners, often multiple IMSIs on one SIM, and packet gateways in several regions. Most of the names in this article now sit here, and local breakout is becoming a standard option rather than a premium.

The third is eSIM localisation under GSMA SGP.32, where a device ships with one SKU and downloads a local operator profile once it lands in a country. That fixes identity and permanent roaming problems neatly. But as the Wireless Logic point above makes clear (I have gone through Wireless Logic’s SGP.32 approach in more detail on sgp32.co.uk), a local profile alone does not guarantee local breakout. You still have to ask where the gateway is.

My own view is that “where does my data break out?” will become a standard line in IoT procurement within a few years, the same way “which cloud region?” did a decade ago. The organisations that ask it now will simply have better documentation, fewer surprises and, in some cases, faster devices. And the SIM providers who can answer it clearly will win business they never had to discount for.

You chose very carefully where your servers live. It is worth spending ten minutes finding out where your SIMs send the data on its way there.