Article 27 UK GDPR · Brazil

UK representative for Brazilian companies

Brazil built the LGPD closely on the European model, which means Brazilian companies recognise this requirement immediately — from the other side. The LGPD asks foreign controllers to appoint a representative in Brazil. The UK GDPR asks the same of Brazilian controllers reaching people in Britain, and the symmetry is exact.

The LGPD is the mirror, not the answer

Article 5 of the LGPD requires a representative in Brazil for controllers established abroad. Article 27 of the UK GDPR requires one in Britain for controllers established abroad. Each rule protects its own territory, and complying with the Brazilian one tells the ICO nothing. A company caught by both needs two appointments, in two countries, naming two entities.

The ANPD and the ICO enforce separately

The Autoridade Nacional de Proteção de Dados supervises Brazilian processing. The Information Commissioner's Office supervises British matters and expects a representative with a British address. Neither authority acts for the other, and neither accepts a designation naming an entity in the other's territory.

Software and agribusiness, two different exposures

Brazilian software companies selling subscriptions to British users hold account data, usage records and payment identifiers, and their users exercise rights readily. Agribusiness and commodities exporters hold far less personal data but deal with British counterparties whose compliance teams ask about it in writing. The first group faces requests; the second faces questionnaires. Both need the same designation.

No adequacy, so the transfer question follows

The United Kingdom has not recognised Brazil as adequate. Data moving from Britain generally requires the IDTA or the addendum. It is a separate instrument from the designation and it arrives in the same conversation, usually within a week of the first.

O que publicar na política de privacidade

One paragraph naming an entity established in the United Kingdom, alongside whatever your LGPD text already says. We supply it in Portuguese and in English. If you also appointed a European representative, that is a third paragraph rather than a replacement: three territories, three named entities, each answering its own authority.

Two mirrored requirements

Assinaturas de software e o volume de pedidos

Brazilian software companies selling to British users meet this through volume rather than through a single incident. Subscription products generate account closures, refund disputes and deletion requests as a matter of routine, and each one is a request under the UK GDPR with a deadline attached. A representative turns that flow into something logged and forwarded rather than something discovered late.

Questions from Brazilian companies

Companies elsewhere, same obligation

What changes from one country to the next is not the rule but the route into it.