Article 27 UK GDPR · Japan

UK representative for Japanese companies

Japan and the United Kingdom recognise each other as adequate, which is unusual and genuinely valuable. It is also the single most common reason Japanese companies conclude, wrongly, that Article 27 does not apply to them. Adequacy governs the movement of data. Representation governs who answers when someone in Britain asks a question about it.

Mutual adequacy is about transfers only

Personal data can move between Japan and the United Kingdom without additional safeguards, in both directions. Nothing in that arrangement mentions a representative, and the ICO has never treated adequacy as satisfying Article 27. The two instruments answer different questions and are assessed separately.

The APPI covers your processing, not your presence in Britain

The Act on the Protection of Personal Information imposes obligations enforced by the Personal Information Protection Commission. A Japanese company that targets people in the United Kingdom is additionally subject to the UK GDPR, and Article 27 is part of that. Compliance at home is not visible to a British regulator and does not create a contact point there.

When a UK subsidiary does remove the requirement

If your group has a genuine establishment in the United Kingdom — staff, premises, activity that is stable rather than nominal — Article 27 does not apply, because you are not a company outside Britain in the relevant sense. A representative office with no activity, or a registered address used only for filings, generally is not enough. This is worth checking before buying anything.

Where Japanese companies are usually caught

Consumer electronics and automotive brands running British warranty portals; games and software publishers with UK accounts; and manufacturers whose European entity was the only one ever considered. In the last case the European designation, if it exists, covers the member states and nothing more.

Testing whether your UK entity is a real establishment

The question is not whether a company exists on paper but whether there is stable activity through it: people, premises, decisions taken there. A dormant subsidiary or a registered address used for filings usually fails that test, which means Article 27 still applies. It is worth answering honestly before relying on the exemption, because the ICO will apply the same test if it ever asks.

What each instrument covers

The European designation that was never extended

Japanese manufacturers who appointed a European representative in 2018 often assume the arrangement still covers everything it did then. It does not: at the end of the transition the United Kingdom left the scope of that appointment, and nothing about the document changed to say so. The gap has existed quietly since, and it becomes visible the first time a British customer exercises a right.

Questions from Japanese companies

Companies elsewhere, same obligation

What changes from one country to the next is not the rule but the route into it.