gdprrepresentative
Home · Brexit and the representative

What changed, and what did not

Brexit and the GDPR representative: one duty became two

A company outside Europe that appointed a representative in 2019 was covered everywhere, Britain included. The same company today is covered in twenty-seven countries and exposed in one. Nothing about its business changed; the map did.

UNTIL 2020 One designation Article 27 GDPR covered the UK as a member state BREXIT FROM 2021 EU GDPR 27 authorities Prague seat UK GDPR the ICO Suffolk seat Same obligation, written twice. Neither covers the other.
Nothing was repealed. The text was copied into UK law and given its own regulator.

What actually happened to the text

The GDPR was not repealed in Britain. It was copied into domestic law and renamed, keeping the same numbering, so Article 27 in the UK GDPR reads almost word for word like Article 27 in the EU GDPR. The difference is jurisdictional rather than substantive: the UK version asks for a representative established in the United Kingdom, answering to the Information Commissioner’s Office.

That is why the mistake is so easy to make. Companies read the familiar article, recognise their existing arrangement, and conclude they are done — when the arrangement points at Prague and the article is asking for Suffolk.

Who was caught out, in practice

Appointed before 2021

The designation predates the split and names an entity in a member state. It is still valid for the Union and has never covered the UK.

Sold only to Britain

Companies that targeted the UK alone often had no EU representative at all, and assumed the UK duty disappeared with EU membership. It did the opposite.

Told by a provider they were covered

Some contracts still say “EU/UK representative” while naming a single European entity. The words are in the contract; the establishment is not in Britain.

Reviewing whether a designation made before Brexit still covers the United Kingdom
A pre-2021 designation is not wrong. It is simply half the coverage it used to be.

How to check your own position in five minutes

  1. Open your privacy notice

    Find the paragraph naming your representative. If there is none, that is your answer for both territories.

  2. Read the address, not the label

    A heading that says “EU/UK representative” means nothing on its own. What matters is whether an address in the United Kingdom appears, and whether a second entity is named.

  3. Check the entity actually exists here

    A British company has a number at Companies House you can look up in seconds. Ours is 17385889.

  4. Ask your provider for proof it is live

    Not a PDF: something a third party can resolve. If the answer is “we will send you the certificate”, nobody else can verify it.

  5. Fix whichever half is missing

    Usually the UK one. It is a form, a mandate and a line in the notice, issued the same working day.

What it costs to close the gap

Adding the United Kingdom to an existing European designation costs €100 a year rather than a second full fee. Buying both together from the start is €390 instead of €580 bought separately. Both are issued the same working day and renew on the same date, so there is one renewal to remember rather than two.

Two designations issued together, one for the Union and one for the United Kingdom
Two mandates, two codes, one renewal date.

Close the British half

From €290 a year for the United Kingdom alone, or €390 for both territories under one order.

The UK designation Do I actually need one?