Article 27 UK GDPR · Canada

UK representative for Canadian companies

Canadian companies usually arrive with PIPEDA in hand and a reasonable belief that it settles the matter. It settles Canadian obligations. Selling to people in Britain brings the UK GDPR with it, and that regulation asks for something PIPEDA never mentions: a named representative established in the United Kingdom.

PIPEDA and the UK GDPR are not interchangeable

Canadian privacy law is principles-based and enforced by a Commissioner with a different toolkit. The UK GDPR is prescriptive, and Article 27 is one of its prescriptions: if you are outside Britain and you target or monitor people in it, you designate someone there in writing. No level of PIPEDA compliance discharges that, and no Canadian filing is visible to the ICO.

Adequacy covers commercial organisations, and only for transfers

The United Kingdom recognises Canada as adequate for personal data transferred to organisations subject to PIPEDA. That keeps your data flows lawful. It has no bearing on representation: adequacy tells you data may move, Article 27 tells you who must be reachable in Britain when someone asks a question about it.

Provincial regimes do not change the British answer

Whether your processing falls under PIPEDA, Quebec's Law 25 or an Alberta or BC statute matters a great deal at home and not at all in London. The UK GDPR looks at where the individuals are, and the answer is the same for a Montreal company and a Vancouver one.

If you also sell into the Union

Many Canadian companies need two designations rather than one, because the Union asks the same question through its own Article 27. We issue both from a single order: Europe Services SE for the member states, REP27 LTD for the United Kingdom, each with its own certificate, its own code and its own paragraph for your privacy policy.

What to publish, and where it goes

The paragraph belongs in your privacy policy, alongside the controller's identity. It names REP27 LTD, its company number and its Suffolk address. If you also hold a European designation, that is a second paragraph rather than a replacement, because a British reader and a European authority are asking about different entities.

Canadian compliance against the British requirement

The bilingual detail worth getting right

Canadian companies serving Quebec often publish a French version of the privacy policy. The representative paragraph has to appear in both, and both have to name the same British entity. A designation that exists only in the English text is the kind of gap that survives for years without anyone noticing, until a French-language complaint arrives and the French version turns out to name nobody.

Questions from Canadian companies

Companies elsewhere, same obligation

What changes from one country to the next is not the rule but the route into it.