REP27 · EU and UK
Article 27 EU GDPR · Article 27 UK GDPR
Brexit split one obligation into two. A company outside both territories that sells into Britain and into the Union now needs two designations, signed by two entities established in two places, answering to two regulators. Most providers cover one side and refer you elsewhere for the other. We hold both establishments, so the pair is issued together on a single form.
| What you do | EU designation | UK designation |
|---|---|---|
| Ship to customers in Ireland, Germany, France… | Required | Not needed |
| Ship to customers in England, Scotland, Wales, NI | Not needed | Required |
| Sell into both markets | Required | Required |
| Run analytics or ad pixels for EU visitors | Required | Not needed |
| Run the same for UK visitors | Not needed | Required |
| Are established in the UK, selling to the EU | Required | Not needed — you are inside |
| Are established in the EU, selling to the UK | Not needed — you are inside | Required |
The last two rows catch people out. A British company does not need a UK representative, but very often needs an EU one — and an Irish or German company is in exactly the mirrored position.
Against €290 plus €290 bought separately. Renewals from year two: €320, €470 and €790.
No. Since 1 January 2021 the UK GDPR is a separate regime with its own regulator, the Information Commissioner's Office. A representative established in a Member State has no standing before the ICO, and the designation you signed for the Union names an entity the ICO cannot address.
No. Adequacy lets personal data move between the two territories without extra safeguards. It says nothing about who a data subject in Manchester or in Milan can write to. Contactability and transfers are separate problems solved by separate instruments.
Only if it is established in both, which almost no provider is. We hold two establishments: Europe Services SE in Prague for the Union and REP27 LTD in Mildenhall for the United Kingdom. The mandates are separate documents, signed by separate entities, issued under one order.
Two signed designations, two certificates, and two verification codes prefixed R27- and UK27-, each resolving on the same public register. Plus two lines of wording for your privacy notice, because a single line naming one entity would be wrong in front of the other authority.
Yes. Both territories together start at €390 a year against €290 plus €290 bought apart, and they renew on the same date so there is one form and one renewal to track instead of two.
Not if nothing you do reaches people in the Union. Check carefully though: shipping to Ireland, a euro price on your checkout, or advertising targeted at European audiences all bring you within Article 3(2) of the EU GDPR.
No. Ireland is a Member State, so an Irish representative covers the Union and nothing else. Geographic closeness to Britain has no legal effect here.
You can. The second designation is issued on its own at any time and simply gets its own certificate and code. Buying together is cheaper and keeps the renewal dates aligned, but nothing is lost by adding it afterwards.
Related: do you need one at all? · what it costs · does the Member State matter?
Two signed designations within 24 hours, each verifiable by anyone holding the code.
Appoint us for both Run the free check