Article 27 UK GDPR · Italy
UK representative for Italian companies
Italian exporters meet this obligation through a marketplace far more often than through a regulator. Amazon UK, Etsy and the fashion platforms began asking for a UK contact point, the field was left empty, and the listing went quiet. The underlying rule is Article 27 of the UK GDPR, and it applies to a company in Milan for the same reason it applies to one in Miami.
The Garante stops at the Channel
Your relationship with the Garante per la protezione dei dati personali covers the Union. It gives you nothing in the United Kingdom, where the Information Commissioner's Office is the authority and expects a representative established in Britain. An Italian address in a privacy policy is, from the ICO's point of view, an address abroad.
Where Italian companies actually get caught
Three patterns recur. A fashion or food brand selling direct to British consumers through its own site in pounds. A manufacturer running a warranty or spare-parts portal that UK owners log into. And a services firm with British clients whose staff details sit in a CRM. All three process personal data about people in the UK in their own name, and none of them is covered by a European designation.
Documents in English, wording in Italian
The designation letter and the certificate are issued in English, because they are what you hand to the ICO or to a British buyer. The text you publish in your informativa privacy is supplied in Italian as well, with the British entity, its company number and its Suffolk address written out, so that nothing has to be translated by you under pressure.
If you sell in both directions
Companies established in Italy do not need a European representative — you are inside the Union. What some groups need is the British one plus, for a non-EEA parent or a US subsidiary, a European one. Those are issued as a pair from a single order, and approving one approves the other.
Cosa pubblicare nell'informativa
The text goes in your informativa privacy, in the section identifying the controller. It must name an entity established in the United Kingdom. We supply it in Italian and in English, with REP27 LTD, company number 17385889 and the Suffolk address written out. Your European text stays exactly as it is: a company established in Italy is not required to appoint a European representative, so only the British paragraph is added.
Which field you are actually filling
| UK representative (data protection) | Article 27 UK GDPR | REP27 LTD — what we issue |
| EU representative (data protection) | Article 27 GDPR | Not needed if you are established in Italy |
| Responsible person (product safety) | Article 16 GPSR | A different role, for physical goods |
| UK responsible person (product safety) | UK product safety rules | Not the same as Article 27 |
| VAT registration | Tax | Creates no establishment for data protection |
Quando il marketplace spegne l'annuncio
The pattern is consistent enough to describe precisely. A compliance field appears in the seller account with a deadline. It is left empty, because the Italian company reads it as something a European seller does not need. On the deadline the listings stop appearing in British search results, then stop being buyable. Restoring them takes a designation with a verifiable code, which is why most of our Italian clients arrive with a screenshot of the field and a date already past.
Questions from Italian companies
Siamo in Italia, quindi dentro l'Unione. Perché serve un rappresentante?
Because the requirement here comes from British law, which treats you as a company outside the United Kingdom. Being inside the EU is what exempts you from the European version.
A marketplace asked for a UK representative. Is that the same thing?
Usually yes, when the field refers to data protection. Some marketplaces ask instead for the responsible person under product safety rules, which is a different role — check which field you are filling.
Does our UK VAT registration cover this?
No. A VAT registration is a tax matter and creates no establishment for data protection purposes.
Quanto tempo serve?
The designation is signed and issued the same working day once your form is complete.
Appointed today, verifiable today
One annual fee, no charge per request. From €290 a year for the United Kingdom, €390 for the United Kingdom and the Union together.
How the UK service works PricingRead next
Do I need one at all?
The three-question test, and the exemptions that rarely apply.
What the ICO expects
Who writes, what they ask for, and how fast an answer is due.
Why one duty became two
What the end of the transition actually changed, and for whom.
Companies elsewhere, same obligation
What changes from one country to the next is not the rule but the route into it: the transfer basis, the regulator you already know, and how British customers reach you.
Selling into Britain from Spain
The same rule, a different starting point.
Selling into Britain from United States
The same rule, a different starting point.
Article 27 or Article 16
The guide that matters most here.