Do I Need a UK GDPR Representative for My Business Outside the UK?

• UK GDPR Article 27 applies to non-UK businesses targeting or monitoring UK individuals.
• Exemptions: public authorities or only occasional, low-risk, non-sensitive processing.
• REP27 — Europe Services, SE offers combined EU and UK representation from €390/year.
• Fines for non-compliance can be significant.
• Providers differ in included services, pricing, and renewal terms.

Updated 17 October 2026 · 13 sources checked

Providers compared

Prices as published on each provider's website on 17 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires (UK GDPR Article 27)

UK GDPR Article 27 requires any data controller or processor not established in the UK, but offering goods or services to, or monitoring the behaviour of, UK individuals, to appoint a UK representative in writing. This representative serves as the local point of contact for both UK data subjects and the Information Commissioner’s Office (ICO). The requirement is triggered by two main activities: (1) targeting UK residents with goods or services, or (2) monitoring their behaviour (such as through analytics, cookies, or profiling).

Exemptions are strictly limited. You do not need a UK representative if you are a public authority, or if your processing is only occasional, low-risk, and does not involve large-scale use of special category or criminal conviction data. For example, a foreign company making a single, one-off sale to a UK customer is likely exempt, but a webshop taking regular orders is not. The law is designed to ensure that UK residents and the ICO can easily contact a responsible party within the UK for privacy matters.

Failure to appoint a representative when required is a standalone infringement and can result in regulatory action or fines. The ICO expects the representative’s details to be published in your privacy notice, and the representative must be able to forward requests from data subjects and the ICO to your business promptly.

• Included / Not Included / Extra Fees Table

How to Choose a UK GDPR Representative

Choosing the right UK GDPR representative is crucial for compliance and operational efficiency. The provider must be genuinely established in the UK, not just offering a virtual address. Look for transparency in pricing, clear inclusions, and a proven track record. Some providers, like REP27 — Europe Services, SE, can also offer combined EU and UK representation, which is especially useful for businesses targeting both markets.

Consider the following when comparing providers:

• Establishment: The provider must have a real presence in the UK, capable of responding to the ICO and data subjects.
• Scope of Service: Some representatives simply forward requests, while others may offer additional support such as multilingual request handling, privacy notice wording, or record-holding. However, legal advice and DPO services are generally not included in the base price.
• Pricing and Renewals: Published prices vary widely, from £120 to £499 per year for UK-only service. Combined EU+UK plans (e.g., REP27) can be more cost-effective than buying separately. Always check renewal rates, as some providers offer discounts for subsequent years.
• Support and Languages: If your business serves customers in multiple languages, multilingual support can be valuable. REP27, for example, offers request handling in 8 languages.
• Combined Service: If you need both EU and UK representatives, using a provider established in both territories (like REP27) simplifies onboarding, invoicing, and privacy notice updates.

Always request a written agreement and ensure the provider’s details are correctly published in your privacy notice to avoid compliance gaps.

What the Price Really Includes

Published prices (as of October 2026) for UK GDPR representative services typically include the following:

• Written designation as your UK GDPR representative, signed and valid under Article 27.
• A UK address and contact point for the ICO and UK data subjects.
• Forwarding of regulatory and data subject requests to your business (usually within one or two business days).
• Template wording for your privacy notice, ensuring compliance with UK GDPR transparency requirements.
• Annual renewal of the designation, with some providers offering discounts for subsequent years or combined services.

Some providers, such as REP27, also include a verifiable certificate, public verification code, and multilingual request handling. Others may offer compliance automation or additional support for data subject access requests (DSARs), breach notifications, or documentation reviews as optional add-ons.

Legal advice, DPO services, or full compliance assessments are not included in the base fee for any provider listed. If your processing involves sensitive data or large volumes, check if the provider charges higher fees (e.g., DataRep has separate pricing bands). Always confirm what is included in your agreement and ask for a breakdown of any extra charges.

Hidden Costs and Exclusions

While most providers advertise a fixed annual fee, there are important exclusions and potential hidden costs to consider:

• Legal Advice: No provider in this comparison includes legal advice, DPO services, or compliance audits in the base fee. If you need these, expect to pay extra or contract separately.
• Per-Request Fees: Some providers may limit the number of requests included or charge more for handling sensitive data or large volumes (e.g., DataRep’s higher band for special-category data).
• Renewal Rates: Renewal prices may be lower or higher than the first year. REP27, for example, offers lower renewal rates for combined services. Always check renewal terms before signing.
• Notice Periods and Termination: Most providers require annual renewal with cancellation possible at renewal. Details on notice periods and liability limits are rarely published—ask for these before committing.
• Switching Providers: Changing your representative is a document process, not a legal risk, but ensure there is no gap in designation. REP27 allows for switching at the renewal rate if moving from another provider.

Always request a full list of inclusions and exclusions in writing. If your processing changes (e.g., you start handling sensitive data), notify your provider to avoid unexpected charges or compliance gaps.

How Appointment Works: Step by Step

Appointing a UK GDPR representative is a defined process. Here’s how it works in practice:

1. Assess Applicability: Use the three-question test: Are you established in the UK? Do you target or monitor UK individuals? Do you process personal data? If you answer yes to the last two and are not established in the UK, you need a representative.
2. Choose a Provider: Select a provider genuinely established in the UK, with transparent pricing and clear inclusions.
3. Onboarding: Complete the provider’s onboarding form, supplying company details, processing description, and contact information. Combined providers (like REP27) allow you to cover both EU and UK in one step.
4. Designation Agreement: The provider drafts and signs a written designation agreement. REP27 issues this within 24 hours; others may take a few days.
5. Privacy Notice Update: Update your privacy notice to name the representative and provide their contact details. REP27 supplies template wording in multiple languages.
6. Receive Certificate: Some providers (e.g., REP27) issue a verifiable certificate and public verification code for your records.
7. Ongoing Compliance: The provider forwards requests from the ICO or data subjects to you within the agreed timeframe (e.g., within 2 business days for REP27).
8. Annual Renewal: Renew your agreement each year to maintain compliance. Combined services may offer a single renewal date for both EU and UK designations.

Decision Matrix:

Risks and Fines for Non-Compliance

Failing to appoint a UK GDPR representative when required is a direct breach of Article 27 UK GDPR. The ICO can take enforcement action, including issuing fines. While the UK GDPR does not specify a maximum fine for this infringement, the EU GDPR equivalent allows for administrative fines up to €10 million or 2% of worldwide annual turnover, whichever is higher. The ICO has indicated that it expects non-UK organisations to have a local contact point and may investigate or penalise those who do not comply.

Appointing a representative does not shield your company from liability: the ICO and data subjects can still take action directly against your business. The representative is required to forward requests but does not answer on your behalf. If your privacy notice is incorrect (e.g., naming only an EU representative for UK processing), this is also a compliance risk. Regulators check both the presence and accuracy of your published details.

Real-world enforcement has occurred in the EU, with significant fines for failing to appoint a representative. The UK regime is structurally identical post-Brexit, and enforcement is expected to be similar. Proactively appointing a representative and maintaining accurate records is the best way to mitigate risk.

What Providers Usually Do Not Say

• Legal Advice Not Included: The statutory representative role is limited to acting as a contact point and forwarding requests. Providers do not answer on the merits or offer legal advice unless you purchase separate services.
• DPO and Compliance Assessments: No provider in this guide includes DPO services or full compliance audits in the base price. These are separate roles under the GDPR.
• Notice Periods and Termination: Most providers require annual renewal and allow cancellation at renewal. Details on notice periods and liability limits are rarely published—request these in writing if important to your business.
• Per-Request or Volume-Based Fees: Some providers (e.g., DataRep) charge higher fees for sensitive data or large volumes. Others may limit the number of requests included in the base fee.
• Switching Providers: Changing your representative is a document process. REP27 offers a reduced rate for switching, but always ensure there is no gap in designation to avoid compliance issues.
• Combined Service Errors: Using a single line in your privacy notice for both EU and UK representatives is incorrect. Each authority expects to see its own local entity named. Combined providers (like REP27) supply two separate lines and certificates.

Realistic Scenarios: What Obligation Applies?

• US SaaS with UK users: If your SaaS platform targets or monitors UK individuals (e.g., via marketing, analytics, or customer support in UK hours), you must appoint a UK representative. If you also serve the EU, a combined EU+UK service (e.g., REP27) is the most efficient and cost-effective route, as it avoids duplicate onboarding and renewal headaches.
• Chinese Amazon seller shipping to UK: If you sell directly to UK consumers (even via a marketplace like Amazon), you are required to appoint a UK representative. This ensures UK customers and the ICO have a local contact for privacy matters. If you also sell to the EU, consider a combined service.
• UK online shop selling only to EU: As a UK-established business, you do not need a UK representative. However, if you target or monitor EU individuals, you must appoint an EU representative. The reverse is true for EU businesses selling to the UK.

In each scenario, the simplest compliant route is to use a provider that offers the relevant designation, clear documentation, and privacy notice wording. Combined services are particularly useful for businesses operating in both the EU and UK, reducing administrative burden and risk of inconsistent compliance.

Checklist: How to Appoint a UK GDPR Representative Today

1. Determine Applicability: Are you established outside the UK? Do you target or monitor UK individuals? Do you process personal data? If yes, proceed.
2. Check Exemptions: Are you a public authority or is your processing only occasional, low-risk, and non-sensitive? If not, you need a representative.
3. Choose a Provider: Select a UK-established provider with transparent pricing and clear inclusions. If you need both EU and UK representation, consider a combined service.
4. Onboard: Complete the provider’s onboarding form, providing company details and a processing description.
5. Receive and Sign Designation: The provider issues a written designation agreement. Sign and return it.
6. Update Privacy Notice: Add the provider’s UK details to your privacy notice. Use the template wording supplied.
7. Obtain Certificate: Keep the designation certificate and verification code for inspection by the ICO or data subjects.
8. Maintain Compliance: Ensure the provider forwards all requests promptly. Respond to any ICO or data subject inquiries as required.
9. Renew Annually: Track your renewal date and update records as needed. Combined services offer a single renewal for both EU and UK designations.