Companies outside the United Kingdom that target or monitor people in the UK need a UK representative under UK GDPR Article 27. It is a separate appointment from the EU one, and having an EU representative does not cover it.
The short answer: if your company has no establishment in the UK, and you offer goods or services to people in the UK or monitor their behavior there, UK GDPR Article 27 requires you to appoint a representative established in the UK, mandated in writing and named in your privacy notice. The exemption is the same narrow one the EU regulation carries, and most companies reaching for it do not qualify.
Engage Compliance provides the UK representative role for companies outside the United Kingdom, with a written mandate, a published UK contact point, and the record of processing held and available to the Information Commission on request.
Key takeaways
- UK GDPR Article 27 is a separate obligation from EU GDPR Article 27. Meeting one does not meet the other.
- It applies to controllers and processors with no UK establishment that target or monitor people in the UK.
- The representative must be established in the UK, mandated in writing, and published in your privacy notice.
- The exemption requires occasional processing, no large-scale special category data, no criminal offense data, and low risk, all at once.
- The regulator is the Information Commission, and non-appointment sits in the standard maximum penalty tier.
- Engage Compliance takes the UK appointment and the EU one as separate mandates, because clearing Article 27 in one regime does nothing for the other. The UK appointment is €550 a year at the smallest band, and the two together are €1,103, because the second mandate on an order is charged at 75 percent of its own price.
What a UK representative is
Article 27 of the UK GDPR requires a controller or processor that is not established in the United Kingdom, but is caught by Article 3(2), to designate in writing a representative in the UK.
The representative is mandated to be addressed, in addition to or instead of the controller or processor, by supervisory authorities and data subjects on all issues relating to processing. In practice that means three things: the representative is named and contactable in your privacy notice, the representative holds a copy of your record of processing and makes it available to the ICO on request, and the representative receives correspondence from people in the UK exercising their rights and routes it to you.
The role does not transfer liability. Recital 80 of the retained regulation is clear that the representative acts on behalf of the controller or processor and can be subject to enforcement proceedings in the event of non-compliance, while the controller or processor remains responsible for the processing itself.
Who needs one
Three conditions, and all three have to hold.
No UK establishment. Establishment is functional rather than formal. A UK sales office that signs UK customers is an establishment involved in the processing. A UK company registration with no activity behind it is not, and it will not carry the obligation for you.
Targeting or monitoring people in the UK. Offering goods or services to people in the UK, whether or not payment is required, or monitoring their behavior where that behavior takes place in the UK. Pricing in pounds, a .uk domain, UK shipping options, UK-targeted advertising, or a UK country selector all point at targeting. Analytics, advertising pixels, fraud scoring, and session recording on UK traffic all count as monitoring.
No exemption. Article 27(2) exempts processing that is occasional, does not include large-scale special category data, does not include criminal offense data, and is unlikely to result in a risk to people’s rights and freedoms. Processing that is part of how your product works is not occasional, whatever the volume.
Two groups are caught more often than they expect. EU companies selling into the UK, which were covered by their EU position before the transition period ended and have not revisited it since. And US companies that appointed an EU representative in 2018, treated the UK as covered by it, and never made the second appointment after 2021.
What we do
- Appointment in writing, with a mandate that meets the Article 27 requirement rather than a letterhead.
- A published UK contact point, in a form you can paste into your privacy notice under Articles 13 and 14.
- Record of processing held and produced. We hold your Article 30 record and make it available to the ICO on request, which is the representative’s own obligation under Article 30(1).
- Handling of contacts from people in the UK, routed to your named internal owner with the statutory clock flagged.
- Handling of ICO correspondence, with the substance passed to you within one business day.
- Annual review, because the appointment stops being accurate the moment your processing footprint changes.
- Translation included, both ways, automated, with an independent second check.
Where a company needs a named DPO as well, the DPO for UK companies service covers the Article 37 role, and we offer both as separate products and scope them together.
How it works
None of this is complicated, and it is the sort of task that stalls for months because nobody owns it rather than because it is hard.
- Scope. A short review of where your users are, what you process, and whether you have a UK establishment. If you do, we tell you the appointment is unnecessary and stop there.
- Mandate. The written appointment is signed. This is the step Article 27 actually requires, and an informal arrangement does not satisfy it.
- Publication. You add the representative’s identity and contact details to your privacy notice. We supply the wording.
- Record. We take a copy of your record of processing, or build one where it does not exist yet.
- Live. Contacts and ICO correspondence route through the representative from that point.
Selling into the EU as well? An EU representative is a separate appointment. See if you need a UK representative, an EU one, or both.
Engage is your UK point of contact for the UK data protection regulator and data subjects. Engage holds a copy of the processing record you supply. Engage makes that copy available to the UK data protection regulator on request.
Each mandate is a separate appointment. Your appointment has its own appointment document and certificate. Engage supplies the representative wording you publish. Your representative contact page reflects the appointment’s current status.
Translation of representative correspondence is included. Translation uses automated tools. The original language version prevails. Images, photos and identity documents are forwarded without translation.
The representative appointment does not include DPO services. The representative appointment does not include compliance or legal advice.
What it costs
The appointment is €550 a year at the smallest band, for a company with 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold, when paid yearly, with no setup fee; quarterly and monthly payment cost about 5% and 15% more (€145 a quarter or €53 a month at that band). Whichever of headcount, revenue or the number of people whose data you hold puts you highest sets the band.
| Company size | UK Representative |
|---|---|
| 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold | €550 |
| 11 to 50 people, or €2m to €10m revenue, or 5,000 or more people in the EU and UK whose data you hold | €790 |
| 51 to 250 people, or €10m to €50m revenue | €1,830 |
| 251 or more people, or over €50m revenue | €3,590 |
The smallest band is for very small organizations only: 1 to 10 people, under €2m in global annual revenue, and under 5,000 people in the EU and UK whose personal data you hold. All three must be true. If any one of them is not, the next band up applies.
If your company grows into a bigger band during the year, nothing changes mid-term: you pay the new band’s price from your next renewal.
Commercial pricing bands based on familiar market-size and market-pricing thresholds. They are not a statutory size test.
Every appointment you hold is a separate mandate, and only the highest-priced one in the basket is charged in full. Every other appointment is charged at a share of its own price, and for this one that share is three quarters of its own price. So adding this to an appointment you already hold costs €413 at band 0, €593 at band 1, €1,373 at band 2, €2,693 at band 3, rather than a second full price.
One extra is optional, and it is priced once per order and paid on the order’s schedule rather than once per appointment. Higher-risk processing, which covers special category data and criminal offense data, is €250 at band 0, €500 at band 1, €750 at band 2, €1,000 at band 3.
Every band is published and buyable, so you can see your price and appoint online without talking to anyone first. The full table for every mandate is on representative services.
The appointment issues in seconds. After payment you answer a short form about your company and who we should send correspondence to, about three minutes of typing, and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment. Nobody at Engage has to approve anything, unless our sanctions screen flags a possible match.
Why Engage Compliance
Experience across 100+ startups and enterprises, including Amazon, Coinbase, Robinhood, Fanatics, Medtronic, AbbVie, IKEA, Nestle and Hopin. The same privacy expert stays on your account, so the person who scoped the appointment is the person who handles the first ICO letter.
Where you need both the representative and a DPO, we offer both as separate products and scope them together.
Every engagement carries professional indemnity and cyber insurance. For companies whose obligations run wider than the UK and the EU, global privacy compliance covers the whole footprint under one point of contact.
UK companies looking in the other direction can read EU representative for UK companies.
For a UK company that also needs a data protection officer, see outsourced DPO services for UK companies. Companies selling to Switzerland as well may need the Swiss representative under the FADP.
Our UK entity
The UK representative is Engage Compliance UK Ltd. ICO registration number: ZC271877.
Sources and references
- UK GDPR, Article 27, legislation.gov.uk
- Data Protection Act 2018, legislation.gov.uk