Who Needs a UK GDPR Representative? Everything You Need to Know (2026)

• Requirement for non-UK companies offering goods/services or monitoring UK users
• Not required if established in the UK or processing is truly occasional
• Representative must be appointed in writing and published
• Fines up to £17.5 million or 4% of global turnover
• Prices and services vary among providers: detailed comparison below

Updated 21 October 2026 · 9 sources checked

Providers compared

Prices as published on each provider's website on 21 October 2026, excluding VAT unless stated. Each row links to its source.

Legal Requirements: Article 27 UK GDPR

Article 27 of the UK GDPR states that any controller or processor not established in the United Kingdom but offering goods or services to people in the UK or monitoring their behaviour must appoint a UK GDPR representative in writing. The representative must be established in the UK and act as a local contact point for data subjects and the Information Commissioner's Office (ICO). This obligation applies regardless of physical presence of servers or infrastructure in the UK: actual and ongoing activities count (a postal address or third-party warehouse alone is insufficient).

• Appointment obligation: The designation must be written and published in the privacy notice, with accessible contact details.
• Responsibilities: The representative acts as a contact point but does not relieve the controller/processor of responsibilities and obligations (Art. 27(4)).
• Exemptions: The obligation does not apply if processing is truly occasional, excludes sensitive or criminal data, and poses no risk to data subjects' rights (Art. 27(2)-(6)). All these conditions must be met.
• Penalties: Failure to appoint is a standalone violation and can lead to fines up to £17.5 million or 4% of global turnover (source).

The regulation applies to any non-UK company that:

• Sells products or services to customers in the UK (including B2B if personal data is involved)
• Monitors behaviour of people in the UK (e.g., via cookies, analytics, targeted advertising)

Sources: Article 27 UK GDPR, ICO

How to Choose a Provider: Criteria, Comparison and Included Services

Choosing a UK GDPR representative provider is crucial to avoid compliance errors and hidden costs. Practical criteria to evaluate include:

• Territorial coverage: Some providers offer UK only, others also EU representation (useful for companies selling in both regions).
• Price and renewal: Prices range from £120 to over £750/year; check if renewal is discounted or if extra fees apply.
• Included services: Beyond formal designation, some providers offer verification badges, privacy notice wording, DSAR management, processing records, audit trails, and multilingual desks.
• Designation timing: REP27 issues designation within 24 hours; other providers may not specify timing.
• Certifications and public verifications: REP27 provides certificate with QR code and public verification; others offer badges or Trust Centers.

Inclusions/exclusions table (October 2026):

The best choice depends on where you operate, your audit needs, and whether combined UK+EU coverage is necessary. If selling in both markets, a combined solution like REP27 reduces costs and administrative complexity.

What the Price Really Includes: Practical Details and Decision Matrix

Published prices may include very different services. Some offer only formal designation, others include audit tools, verification badges, privacy notice wording, DSAR management, processing records, and multilingual desks. It's essential to verify what is actually included and which services are optional or extra.

For example, REP27 offers two designations (UK+EU), two certificates, privacy notice wording in 8 languages, request desk, processing records, and verifiable badge. Gabsor and Euverify also provide Trust Center, badge, audit trail, and DSAR management. FSREG, GDPR Gateway, Janus, and DataRep UK focus on UK representation with basic services and request forwarding.

Practical decision table:

Note: "Occasional" processing is interpreted strictly. Even a small e-commerce regularly receiving orders is not considered occasional. If in doubt, always check with the provider before purchasing.

Hidden Costs and Limits: What Providers Don’t Say

Many providers do not clearly highlight certain conditions and limits:

• Limited liability: The representative does not assume legal responsibility of the controller/processor; acts only as contact point (Art. 27(4)).
• Exclusions: No provider acts as DPO or offers privacy consulting included in the representation price. Consulting is often "On request" and may incur additional fees.
• Extra costs: Some providers charge additional fees for complex requests, data changes, advanced audit services, or managing large volumes of requests. These fees are often "On request" and not always published.
• Notice period: The termination notice period is not always specified. It is important to verify contract terms.
• Renewal and switching: REP27 offers discounted renewal and easy switching from other providers, but others may not provide discounts or facilitation.

Summary table of exclusions and limits (October 2026):

Practical advice: always ask the provider for a written list of included services and any possible extra fees before signing.

How Appointment Works: Step by Step, Checklist and Timing

Appointing a UK GDPR representative is a process that can be completed quickly if the correct steps are followed. Here's a practical step-by-step guide:

1. Check if you fall under the obligation: Answer three key questions: (1) Are you established outside the UK? (2) Do you offer goods/services or monitor UK users? (3) Do you process personal data?
2. Choose the provider: Consider coverage (UK only or also EU), included services, price, and issuance timing.
3. Fill out the designation form: Provide company data, processing description, contacts, and required documents. With REP27 the process takes about 5 minutes.
4. Receive the designation: The provider issues the signed designation, certificate, and wording for the privacy notice (REP27 within 24 hours).
5. Update the privacy notice: Insert the wording provided by the provider, including UK representative details and contact methods.
6. Publish and communicate: Ensure the designation is easily accessible to users and authorities.
7. Renew annually: Track expiry and renew to avoid compliance gaps.

Quick checklist:

• Do you have UK customers or users?
• Do you offer services or monitor behaviour?
• Have you already appointed a representative?
• Have you updated the privacy notice?
• Have you checked coverage and included services?

Typical timing ranges from 24 hours (REP27) to a few working days, depending on provider and data completeness.

Risks, Penalties and Practical Cases: Real Scenarios

Failure to appoint a UK GDPR representative when required carries real risks: fines up to £17.5 million or 4% of global turnover (source), blocked business relationships, and reputational damage. The representative does not remove the controller's responsibility but ensures a local contact point for users and the ICO.

Three real scenarios:

• US SaaS offering services to UK and EU users: Must appoint both UK and EU representatives. Most efficient solution: provider offering combined designation (e.g., REP27) with single onboarding and separate documents.
• Chinese Amazon seller on Amazon UK: Even without physical presence, if selling to UK customers must appoint a UK GDPR representative. Can choose UK-only providers or combined solutions if also selling in the EU.
• UK online shop selling only in UK: If already established in the UK (office, branch, staff), no representative obligation. If a EU company selling to UK customers, must appoint a UK GDPR representative.

Practical decision matrix:

Advice: don’t wait for an ICO or customer request. Appointment is preventive and non-compliance can be detected via online checks.