REP27 · Article 27 · UK companies
Brexit · Article 3(2) · UK controllers
Until the end of 2020 a British company was inside the GDPR as a Member State company. Since 2021 it is a third country like any other: if it offers goods or services to people in the Union or monitors their behaviour, Article 27 applies and a representative established in the EU is required. Most UK companies discovered this through a customer questionnaire rather than a lawyer, which is why the gap is still so common five years later.
BrexitArticle 3(2)EU designationUK GDPRICOFrom €290
The fourth row is the one that catches people: a designation made before 2021, or a privacy notice inherited from that era, describes a world that no longer exists.
| Business | EU representative needed? | Why |
|---|---|---|
| Ecommerce shipping to EU consumers | Yes | Offering goods to people in the Union |
| SaaS with EU customers | Yes | Offering services, usually with analytics on top |
| Agency processing for EU clients | Yes | Processors designate on the same terms |
| UK-only retailer, no EU shipping | No | Article 3(2) is not engaged |
| Company with a real Dublin office | No, if that entity is the controller | Establishment in the Union |
| Charity fundraising in the EU | Yes | No exemption for the sector; only public authorities are exempt |
If you only sell into the Union, you need the EU designation alone. The paired price matters when EU-established companies are also selling to your British customers, which is the mirror case we handle from the other side.
Signed with an entity established in a Member State where your EU customers are. Ours is in Prague and covers all 27 plus the EEA.
Article 13(1)(a) requires the identity of the representative. Most UK notices still list only a UK address and an ICO registration.
Article 30 record held by the representative and available on request. Rarely prepared before it is asked for.
Separate question from representation, but usually broken at the same time in the same document.
Article 16 GPSR: an EU-established responsible person on the label. A UK address is refused by every marketplace.
It covers the UK regime. The Union has no equivalent registry and does not recognise that entry.
Those govern transfers of data. They say nothing about being reachable inside the Union.
Only a signed designation with an EU-established entity creates a representative. A supply relationship does not.
There is no threshold. A two-person company selling into Germany is in the same position as a large one.
Most British companies discover the gap when a European client sends a vendor assessment. These are the five lines that appear, and what closes each one.
| Question on the form | What closes it |
|---|---|
| "Are you established in the EEA?" | An honest no, followed by the designation |
| "Who is your Article 27 representative?" | Name, address and certificate with a verification code |
| "Where is this published?" | A link to the paragraph in your privacy notice |
| "Who holds your Article 30 records?" | The representative, produced on request |
| "Transfer mechanism for EU to UK data?" | The UK adequacy decision, a separate point from representation |
Signed by Europe Services, SE in Prague, covering all 27 Member States and the three EEA states.
With a code your European clients can check without contacting you.
Held in the Union and produced to authorities on request, which is the part vendor forms probe hardest.
Dates, languages, what was forwarded and when. A defensible file rather than a mailbox.
REP27 LTD for EU-established companies selling to your British customers, on the same invoice.
British companies ask about the mirror case constantly, usually because a European supplier has been asked for a UK representative and has come back confused. The rules are symmetrical.
| Company | Needs an EU representative | Needs a UK representative |
|---|---|---|
| UK company selling to EU consumers | Yes | No, it is established in the UK |
| German company selling to UK consumers | No, established in the Union | Yes |
| US company selling to both | Yes | Yes |
| UK company with a real Irish entity that contracts | Not for that entity | No |
| UK company selling only domestically | No | No |
Our two entities exist precisely because of this table: Europe Services, SE in Prague for the Union, REP27 LTD in Suffolk for the United Kingdom. They are separate designations with separate certificates, and any provider offering one document covering both is describing something that does not exist.
Article 16 GPSR requires an economic operator established in the Union, named on the product itself.
Amazon, eBay and Etsy block EU listings without it, and a British address is refused in the country field.
Compliance in Seller Central does nothing for a parcel opened at the border with nothing printed on it.
Technical file and risk assessment kept for ten years, held by the responsible person.
Both designations on the same invoice with the same expiry, which is the only reliable way to stop one lapsing quietly.
€890 a year for the plan covering the Article 27 representative and the Article 16 responsible person.
The document is the easy part. These four questions come up in the weeks that follow, and it is worth knowing the answers before they do.
Publish the paragraph and nothing more. There is no obligation to explain the arrangement, and adding detail invites questions.
It is answered in French. The desk operates in eight languages and forwards the substance to you in English.
Yes, separately. UK registration and the EU designation are two unrelated obligations under two regimes.
Yes, and it helps. European buyers ask for it in vendor assessments, and a verifiable certificate shortens the review.
Brexit did not change what you do, it changed which side of the border you do it from. If your customers are in the Union and your company is not, Article 27 applies exactly as it applies to an American or a Chinese company, with no transitional relief and no size threshold. The designation costs €290 a year, is signed within 24 hours and covers all 27 Member States plus Iceland, Norway and Liechtenstein.
The three things worth doing this week: check whether your privacy notice still describes a pre-2021 world, ask whether anyone in the Union can currently receive a request on your behalf, and if you ship physical goods, look at whether a UK address is still printed where an EU one now belongs.
With the EU GDPR, yes, where Article 3(2) reaches them. The UK GDPR applies separately to processing in the United Kingdom.
It covers the Union, and it never covered the UK. If it was made with a UK entity, it does not work for the Union at all now.
Not for Article 27. It is a UK fee and registry with no equivalent or recognition in the Union.
Yes. Ireland is a Member State, so Article 3(2) applies exactly as for Germany or France.
No. One designation covers all 27 Member States and the three EEA states.
For data protection it follows the UK GDPR. Goods there follow a distinct arrangement; ask before assuming either answer.
Yes, and we provide it: REP27 LTD, company number 17385889, in Suffolk.
If it is established in the Union and signs the designation, yes. Many groups do exactly this and never document it, which is the problem.
€290 a year for the EU designation, €390 for the EU and UK pair, €240 on renewal.
Signed within 24 hours of a completed form, with a certificate carrying a verification code.
No. The adequacy decision concerns transfers of personal data to the UK. It does not remove Article 27 for a UK controller reaching people in the Union.
You also need an Article 16 GPSR responsible person established in the Union. A UK address is refused in every marketplace compliance field.
The representative, at the address published in your privacy notice, in eight languages, forwarded to you the same working day.
No. Employee data processed in the UK is a UK GDPR matter, unrelated to Article 27.
No. The representative must be an entity that accepts the role in writing and answers. A mailbox is not a designation.
No. A document exercise: new designation signed, notice updated the same day, previous arrangement terminated afterwards, no gap.
Related: holding both designations · what Brexit changed
An Article 27 designation with Europe Services, SE in Prague, signed within 24 hours, covering all 27 Member States and the EEA, with the privacy notice wording ready to publish.
See the plans