Do I Need a UK Representative? UK GDPR Article 27

The rule

UK GDPR Article 27(1) says that where Article 3(2) applies, the controller or the processor "shall designate in writing a representative in the United Kingdom". Article 3(2) is the part of the UK GDPR that reaches a company with no UK establishment, when it offers goods or services to people in the UK or monitors their behavior there.

The representative is mandated to be addressed by the Information Commission (ICO) and by people in the UK on all issues related to your processing, alongside you or in your place. You name it in your privacy notice under Articles 13 and 14, and it holds a copy of your record of processing so it can produce it to the ICO on request.

The UK GDPR is a separate law from the EU GDPR, with its own Article 27. An EU representative does nothing for the UK duty, and a UK representative does nothing for the EU one.

Who needs one

All of these have to be true at once:

You have no UK establishment involved in the processing. A UK office that signs UK customers is an establishment. A UK company registration with no activity behind it is not, and it will not carry the duty for you.
You offer goods or services to people in the UK, or monitor their behavior there. Pricing in pounds, a .uk domain, UK shipping options and advertising aimed at the UK all point at offering. Analytics, advertising pixels, fraud scoring and session recording on UK traffic all count as monitoring. Payment is not needed: a free product counts.
The exemption in Article 27(2) does not cover you.

Two groups are caught more often than they expect: EU companies selling into the UK, which were covered by their EU position before the transition period ended, and companies outside Europe that appointed an EU representative and assumed it covered the UK.

Who does not need one

A company with a UK establishment involved in the processing. The UK GDPR applies to it directly, so the representative duty drops away. A dormant UK entity with no part in the processing does not count.
A public authority or body. Article 27(2)(b) leaves them out.
A company whose processing is occasional and low risk. Article 27(2)(a) exempts processing that is occasional, does not include large-scale special category data or criminal offense data, and is unlikely to result in a risk to people's rights and freedoms. All of those have to hold. Processing that is part of how your product works is not occasional, whatever the volume.
A company that neither offers anything to people in the UK nor monitors them. The UK GDPR does not reach it at all.

There is no size threshold. A two-person company with UK customers is inside the test.

What happens if you do not appoint one

Failing to appoint is an infringement of UK GDPR Article 27, which sits in the standard maximum penalty tier under section 157 of the Data Protection Act 2018. In practice the ICO has tended to raise it during a wider inquiry.

What it costs

The UK representative appointment is €550 a year at the smallest band, for a company with 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold. At the three larger bands it is €790, €1,830 and €3,590 a year. That is the price when paid yearly, with no setup fee, and quarterly and monthly payment cost about 5% and 15% more. Whichever of headcount, revenue or the number of people whose data you hold puts you highest sets the band.

Every band, and what the appointment includes, is on our UK representative service page, where you can appoint online with no sales call. If you need an EU representative as well, both go on one order and the second appointment costs less than its full price.

Check what you need

Our free representative checker asks a few short questions about where your company is based, who you sell to and what you do with their data. It tells you whether you need a UK representative, an EU one, both or neither, and what the appointment would cost.

Sources and references

UK GDPR Article 27, full text
UK General Data Protection Regulation, Article 27, legislation.gov.uk

Check which representatives you need

Book a free intro call Start representative sign-up

FAQ

Frequently asked questions

Does our EU representative also cover the UK?

No. The UK GDPR and the EU GDPR are two separate laws, each with its own Article 27. A company outside both that targets people in both needs two appointments, one established in the UK and one in the EU.

We are based in the EU. Do we need a UK representative?

Usually yes, if you offer goods or services to people in the UK or monitor their behavior there and have no UK establishment, unless your processing is occasional and low risk under Article 27(2)(a). The UK is outside the EU, so your EU position does not cover it.

Does a UK subsidiary remove the need for a UK representative?

If the subsidiary is an establishment involved in the processing, yes, because the UK GDPR then applies to you directly. A dormant entity that plays no part in the processing does not remove the duty.

Is there a size threshold for the UK representative requirement?

No. UK GDPR Article 27 sets no size threshold. What matters is whether you have a UK establishment, whether you target or monitor people in the UK, and whether the narrow exemption covers you.

Who does the UK representative deal with?

The Information Commission (ICO) and people in the UK whose data you process. They can contact the representative about your processing, and it passes their messages to you.