Article 27 UK GDPR · France

UK representative for French companies

For a French company the United Kingdom stopped being a neighbouring market in a legal sense and became a third country with its own regulator. The CNIL has no role there, and the ICO has no role here. A company in Lyon selling to buyers in Britain needs someone established in Britain to be written to.

The CNIL and the ICO do not stand in for each other

French companies often route everything through their CNIL relationship, which is the right instinct in Europe and the wrong one across the Channel. A British data subject does not complain to the CNIL, and the ICO does not accept a French address as a point of contact. The two authorities correspond, but neither answers on the other's behalf, and neither will accept a designation naming an entity outside its own territory.

Proximity makes the exposure larger, not smaller

The trade that continued after 2021 — e-commerce, wine and food shipments, software sold in sterling, hotel and travel bookings — is exactly the trade that involves personal data about people in Britain. The nearer market is the one where a missing representative is discovered fastest, because the volume of ordinary requests is higher.

What lands on the representative's desk

Access and erasure requests from customers in the UK, ICO correspondence following a complaint, and questions from British business buyers running vendor checks. The last of these is the one French firms underestimate: a UK procurement questionnaire asks for the UK representative by name, and an empty field stalls the contract before any regulator is involved.

Both territories, issued together

If your group also has entities outside the EEA that need a European representative, we issue both mandates from one order: Europe Services SE for the Union, REP27 LTD for the United Kingdom, each with its own certificate and its own line for your politique de confidentialité.

Ce qu'il faut publier, et où

The wording goes in your politique de confidentialité, in the section that identifies the controller and its representatives. It has to name an entity established in the United Kingdom, with an address a British reader can write to. We supply the paragraph in French and in English. Your CNIL-facing text is unaffected, because a company established in France needs no European representative — only the British one is new.

Two authorities, side by side

Le contrôle fournisseur, plus rapide que le régulateur

French companies more often meet this through procurement than through enforcement. A British client sends a vendor questionnaire with a field for the UK representative, the field is validated against something real, and an EU address is refused. The contract stalls while somebody explains that the French entity is compliant in Europe, which is true and answers a different question. The designation closes the field the same day, with a code the buyer can check while still on the call.

Questions from French companies

Read next

Companies elsewhere, same obligation

What changes from one country to the next is not the rule but the route into it: the transfer basis, the regulator you already know, and how British customers reach you.