REP27Under the UK GDPR, one month is the standard deadline for responding to an access, erasure, objection, or portability request. That period can be extended by two further months in complex cases, but the extension must be communicated to the individual in writing before the original month expires. Miss that window and the extension lapses; the request is already overdue.
The gap between the deadline and the moment something actually arrives is where the representative's operational setup matters. A representative whose address appears in the privacy notice but whose post is scanned weekly rather than daily can burn through a third of the available time before the controller even knows a request exists.
What two types of correspondence reach a UK representative
The first type comes from an individual. Someone could not get an answer from the company directly, or the privacy notice listed the representative's address and that is where they wrote. The deadline is one month from receipt, extendable as above.
The second type comes from the Information Commissioner's Office, normally because someone complained first and received no response. The ICO may request the Article 30 record of processing activities, evidence of a lawful basis, or confirmation of who the controller is and who holds the representative role. The ICO's letter sets its own deadline, and it is usually shorter than a month.
Most enforcement proceedings begin with an individual who could not obtain an answer — not with a proactive audit.
What a representative can and cannot produce
The Article 30 record of processing activities is the document most frequently requested by supervisory authorities and the one most often absent. A representative that does not hold that record is, in practice, a letterbox: it can receive correspondence but cannot respond to the most common regulatory enquiry without going back to the controller.
What a representative cannot produce is the evidence of lawful basis — that lives in the controller's own systems — or the substantive answer to a data subject request. That answer belongs to the controller. A representative that promises to answer requests on the controller's behalf is promising something outside its reach, because the underlying evidence is not in its possession.
Three operational failures cost more time than any procedural gap: post and email read on a weekly rather than daily cycle; a lapse in cover while the privacy notice still names the previous provider; a forwarded communication with no context added, leaving the controller to assemble the response from scratch.
What to verify before appointing a provider
- How often is correspondence at the UK address read — daily or weekly?
- Does the provider hold the Article 30 record on file, or does it request it each time?
- When a letter or email arrives, is it forwarded the same day with the deadline and context flagged?
- Is the representative's appointment verifiable by a code the ICO or a marketplace can resolve independently?
REP27 (UK entity: REP27 LTD, company number 17385889, England and Wales) reads post and email at the UK address every working day, logs and reports anything received to the controller the same day, and holds the Article 30 record without requiring the controller to supply it on request. Plans start at €290 per year for UK-only cover, issued the same working day, with a UK27 verification code.
Key points
- The UK GDPR deadline to answer a data subject request is one month from receipt; a two-month extension is available only if justified in writing before that month closes.
- Most ICO enforcement proceedings begin with an individual complaint, not a proactive audit, making the speed of correspondence handling a material operational variable.
- An Article 27 representative that does not hold the Article 30 record on file cannot respond to the most common regulatory request without going back to the controller.
- A lapse in representative cover while the privacy notice still names the previous provider creates a gap in which both individuals and the ICO receive no response.
- REP27 plans for UK GDPR representation start at €290 per year, issued the same working day, with a verifiable UK27 code.
Frequently asked questions
What is the deadline to respond to a UK GDPR data subject request?
One month from the date the request is received. The deadline can be extended by two further months for complex or numerous requests, but the controller must inform the individual of the extension — and the reasons — before the original one-month period expires.
What does a UK GDPR Article 27 representative actually have to produce?
The representative must be able to provide the Article 30 record of processing activities and confirm the identity of the controller and of the representative itself. It cannot supply evidence of lawful basis or the substantive answer to a data subject request, because that evidence sits in the controller's own systems.
What correspondence does a UK GDPR representative receive?
Two types: requests from individuals (access, erasure, objection, portability) sent to the address listed in the privacy notice, and letters from the Information Commissioner's Office, usually triggered by a complaint. ICO letters carry their own deadlines, which are typically shorter than one month.
What happens if the representative reads post only once a week?
A weekly reading cycle can consume five to seven calendar days before the controller is even notified. On a one-month deadline, that is roughly a quarter of the available response time lost before any work begins.
How much does a UK GDPR Article 27 representative from REP27 cost?
UK-only plans start at €290 per year (Base plan, up to 10 forwarded requests per year). The appointment is issued the same working day and comes with a verifiable UK27 code that the ICO or any third party can resolve independently.
