A three-question test
Do you actually need a UK representative?
Plenty of companies buy one they never needed, and plenty go without one they did. The rule is short enough to check in a minute, and the confusion comes from a single word in it: established. Here is the test, the edge cases that trip people up, and the exemptions that are narrower than they look.
Question one: are you established in the United Kingdom?
Establishment is not where your servers sit and not where your customers are. It is where you carry on real activity through stable arrangements: a branch, a subsidiary, an office with staff. A single employee working from home in Manchester can be enough; a warehouse operated by a third party usually is not.
Three cases we are asked about constantly:
A UK distributor
A separate company that buys from you and resells does not make you established here. Their presence is theirs, not yours.
A .co.uk domain
Owning one is evidence you target Britain, which is question two. It has nothing to do with establishment.
A registered address service
An address with no activity behind it is not an establishment. If it were, the rule would mean nothing.
Question two: do you target or monitor people in Britain?
Selling to a British customer who happened to find you is not, on its own, targeting. Deliberate orientation is. The signals that decide it are the ones a regulator can see from the outside.
| Points toward targeting | Points away from it |
|---|---|
| Prices shown in pounds | One currency, no local option |
| Shipping options to UK addresses | Explicitly excluding the UK at checkout |
| A .co.uk domain or a UK landing page | A single global site with no local variants |
| Advertising bought against UK audiences | No paid reach into the country |
| Customer support in UK hours | Support in your own timezone only |
| Mentions of British customers as references | No local social proof |
Monitoring is the quieter half of the test. Analytics that profile behaviour, retargeting pixels, session recording, cookie-based advertising: if you build a picture of a person in Britain over time, you monitor them, whether or not you sell them anything.
Question three: is it personal data?
Almost always yes. An email address is personal data. So is an order history, an IP address, a cookie identifier tied to a device. The threshold is low by design, and companies that answer no here are usually thinking of "sensitive" data rather than personal data.
Where the answer is genuinely no: aggregate statistics that cannot be traced back to anyone, and business-to-business dealings with a company as such rather than with named individuals — though the moment you hold a contact name at that company, you are back in scope.
The exemptions, and why they rarely apply
The rule spares occasional processing that is low risk and involves no large-scale special category or criminal data. Read it slowly: all of those conditions must hold at once.
“Occasional” is strict
A webshop taking orders every week is not occasional, however small the volume. Occasional means sporadic and outside the ordinary course of what you do.
“Low risk” is judged by outcome
Not by how careful you feel. Profiling, tracking, or anything that could affect a person’s choices moves you out of it.
Public authorities are exempt too, but that is a small population and rarely the company asking.
If you answered yes three times
You must designate a representative established in the United Kingdom, in writing, and publish who they are where people can find it. The designation is a one-hour job, not a project: a form, a mandate, an acceptance and a line in your privacy notice.
Settle it in a minute
Send us your website and the countries you sell to. We will tell you plainly whether you need the United Kingdom, the Union, both or neither.
How the UK designation works See the plans