The regulator’s side of it
What the ICO expects from a UK representative
A designation is bought in a minute and tested on the day a letter arrives. This is what that day looks like: who writes, what they ask for, how fast the answer is due, and what a representative is actually for when the deadline is running.
Who writes, and why
Two kinds of post reach a representative, and they behave differently.
A person exercising a right
Access, erasure, objection, portability. They write to the address in your privacy notice because that is the address you gave them. The answer is due within one month, extendable by two in complex cases, and the extension has to be justified in writing before the first month ends.
The Information Commissioner’s Office
Usually because a person complained first and got nowhere. The ICO may ask for your record of processing, for evidence of a lawful basis, or simply for confirmation of who you are and who represents you. Deadlines here are set by the letter, and they are shorter.
What the representative must be able to produce
Article 30 records are the document most often requested, and the one most often missing. A representative that does not hold them is a letterbox, and it shows within a day of the first request.
| Asked for | Held by us on your behalf |
|---|---|
| Record of processing activities | Yes, maintained from your form and updated when you tell us of changes |
| Identity of the controller and the representative | Yes, in the signed designation |
| Categories of data and of people | Yes, as declared in the designation |
| Transfers outside the UK | As declared; the safeguards themselves remain yours |
| Lawful basis and consent evidence | No — that lives in your systems, and we ask you for it |
| Breach documentation | No — we forward and assist, you produce it |
That last pair matters. A representative that promised to answer everything on your behalf would be promising something it cannot do, because the evidence is not in its hands.
The failure that actually gets penalised
Not appointing anyone is an infringement in its own right, separate from whatever prompted the complaint. But the case we see most is quieter and worse: a designation that exists on paper while the address behind it goes unread.
Unread post
A registered-office service that scans mail weekly turns a one-month deadline into three weeks, and nobody notices until it is late.
A lapsed mandate
Cover ended, the privacy notice still names the old provider, and the regulator writes to a company that no longer represents you.
No records
The representative forwards the request and adds nothing. You spend the month assembling what should already have existed.
How we handle it
Plainly, so you can compare it against anyone else’s promise.
What happens automatically
Post and email at the UK address are read every working day. Anything that arrives is logged, you are told the same day, and the record of processing is produced without asking you for it. We stay in the thread until the matter is closed.
What we need from you
The substance of the answer. We are not your data protection officer and not your lawyer: the accountability under the UK GDPR remains yours, and pretending otherwise would be the expensive kind of reassurance.
A designation that answers on the day it matters
From €290 a year for the United Kingdom. Issued the same working day, with a code the ICO or a customer can check without asking you.
The UK designation See the plans