Article 27 UK GDPR · Germany
UK representative for German companies
German exporters are the group most surprised by this obligation, because they are established inside the Union and assume Article 27 cannot apply to them. It applies in the mirror: a company in Hamburg selling to buyers in Britain is a company outside the United Kingdom offering goods to people in it, and the UK GDPR asks for a representative established in Britain.
An EU establishment does not help you here
Under the EU GDPR you are established in the Union, so Article 27 never applied to you. Under the UK GDPR you are a third-country controller. The regulation is the same text with a different geography, and being in Düsseldorf carries no more weight before the ICO than being in Denver. Your data protection officer, your German counsel and your entry in the Handelsregister do not change the answer.
Transfers are settled, representation is not
Personal data can move from the UK to Germany without additional safeguards, because the United Kingdom recognises the EEA as adequate. That is often where the analysis stops, and it stops one step early. Adequacy governs where data may go. Article 27 governs who answers a British regulator, and adequacy says nothing about it.
What the Mittelstand model runs into
A manufacturer selling through a British distributor often assumes the distributor covers everything. It does not: the distributor is a separate company handling its own customers. If you also sell direct, run a webshop in pounds, or operate a warranty portal that UK owners register on, you are processing the data of people in Britain in your own name, and the representative must be yours.
Two designations, one order
German companies that also sell outside the EEA sometimes need both a UK representative and, for group entities registered elsewhere, a European one. We issue them together: two signed designations, two certificates, two verification codes, and two separate lines for your Datenschutzerklärung. Neither is a copy of the other, because neither regulator would accept a copy.
Was in die Datenschutzerklärung gehört
German privacy notices are usually thorough, which makes the gap easy to see once you look for it. Under the heading for the representative there is either an entity established in the United Kingdom or there is not. We supply the paragraph in German and in English, naming REP27 LTD, its company number and its Suffolk address, so that it can be pasted into the existing structure without a rewrite. Nothing about your European text changes, because you are not required to have a European representative at all.
What applies to a company established in Germany
| EU GDPR Article 27 | Does not apply — you are established in the Union | — |
| UK GDPR Article 27 | Applies if you target or monitor people in the UK | REP27 LTD, Suffolk |
| Transfers UK → Germany | Permitted under the UK adequacy decision for the EEA | No extra safeguard needed |
| Who supervises you | Your Land authority and the ICO, separately | Neither answers for the other |
| What a British buyer checks | The UK representative named in your notice | Verification code UK27 |
The case that surprises manufacturers
A German manufacturer sells through a British distributor and considers the market covered. Then it launches a registration portal for warranty claims, or a spare-parts shop, or a newsletter for installers in Britain. Each of those collects personal data from people in the United Kingdom under the manufacturer's own name, independently of the distributor relationship. The distributor's compliance does not extend upward, and the manufacturer discovers the obligation through the portal, not through the distribution contract.
Questions from German companies
We are established in Germany. Why would Article 27 apply?
Because the UK GDPR applies it to controllers outside the United Kingdom. Establishment in the EU is what exempts you from the EU version, not from the British one.
Does the UK adequacy decision remove the requirement?
No. Adequacy concerns the transfer of personal data. Representation concerns who receives requests and correspondence in Britain.
Our British distributor handles UK customers. Is that enough?
Only for the data the distributor processes as its own controller. Anything you collect directly from people in the UK remains yours.
In welcher Sprache wird die Benennung ausgestellt?
The designation letter and certificate are issued in English, because they are shown to the ICO. The wording for your privacy notice is supplied in German as well.
Appointed today, verifiable today
One annual fee, no charge per request. From €290 a year for the United Kingdom, €390 for the United Kingdom and the Union together.
How the UK service works PricingRead next
Do I need one at all?
The three-question test, and the exemptions that rarely apply.
What the ICO expects
Who writes, what they ask for, and how fast an answer is due.
Why one duty became two
What the end of the transition actually changed, and for whom.
Companies elsewhere, same obligation
What changes from one country to the next is not the rule but the route into it: the transfer basis, the regulator you already know, and how British customers reach you.
Selling into Britain from the Netherlands
The same rule, a different starting point.
Selling into Britain from France
The same rule, a different starting point.
The three-question test
The guide that matters most here.