Article 27 UK GDPR · Poland

UK representative for Polish companies

Poland has a particular version of this problem: a large Polish-speaking population living in Britain, served by Polish companies that never thought of themselves as exporting. A shop, a service or an app in Polish, sold to people in London or Birmingham, is offering services to people in the United Kingdom — and the language it is written in does not change that.

Selling in Polish to people in Britain is still selling into Britain

The test in Article 27 of the UK GDPR asks where the people are, not what language you use to reach them. A Warsaw company running a Polish-language service used by customers in Britain is processing the personal data of people located in the United Kingdom, and the obligation attaches to that. Language is evidence of who you are targeting; location is what decides.

Checking whether a Polish-language service is used by people located in Britain — The language shows who you are addressing. Location decides the obligation.

A regulator building, where a complaint about an unanswered request eventually arrives — The UODO supervises Poland. Britain has its own authority.

The UODO covers Poland, not Britain

The Urząd Ochrony Danych Osobowych supervises your European obligations. British complaints go to the ICO, which will not accept a Polish address as a point of contact. Nothing about your Polish compliance is wasted; it simply answers a different regulator.

Where Polish companies are usually caught

Money transfer and remittance services, food and grocery delivery aimed at Polish households in Britain, recruitment agencies placing workers, and insurance or legal services sold in Polish. All four hold identifiable personal data about people in the United Kingdom, and several hold financial detail, which raises what a complaint costs when nobody is named to receive it.

Documents in English, wording in Polish

The designation and certificate are issued in English, because they are what a British regulator or business buyer reads. The paragraph you publish in your polityka prywatności is supplied in Polish too, naming REP27 LTD, its company number and its Suffolk address.

Co umieścić w polityce prywatności

A single paragraph in the section identifying the controller, naming an entity established in the United Kingdom. We supply it in Polish and in English, with REP27 LTD, company number 17385889 and the Suffolk address written out. Nothing in your Polish text changes: established in Poland, you need no European representative.

What decides whether you are caught

Customers are Polish citizens	Not decisive	Nationality is irrelevant
Customers are located in Britain	Decisive	Representative required
Site is in Polish	Not decisive on its own	Evidence of targeting, not of location
Prices in pounds, UK delivery	Strong evidence of targeting	Representative required
Analytics profiling UK visitors	Monitoring behaviour	Representative required

Usługi finansowe i rekrutacja

Two sectors carry more weight than the rest. Remittance and money services hold financial identifiers about people in Britain, and a complaint about them is not routine. Recruitment agencies hold work histories and sometimes identity documents for workers placed in the United Kingdom. In both, the representative is the difference between a question answered in a week and a regulator wondering why nobody replied at all.

Questions from Polish companies

Nasza strona jest po polsku. Czy to nas wyłącza?

No. What matters is that the people you serve are located in the United Kingdom, not the language of your site.

Do we need this if we only serve Polish citizens in the UK?

Yes. The UK GDPR protects people located in the United Kingdom regardless of their nationality.

We are established in Poland, inside the EU. Why does Article 27 apply?

Because this requirement comes from British law, which treats you as a company outside the United Kingdom.

Can we appoint our own UK branch?

If you have one, yes. Most Polish companies serving this market do not, which is why an independent designation is the usual route.

Appointed today, verifiable today

One annual fee, no charge per request. From €290 a year for the United Kingdom, €390 for the United Kingdom and the Union together.

How the UK service works Pricing

Signing the designation that a Polish company publishes in its privacy notice — Written acceptance is what makes a designation real, not a mention.

The paperwork behind a mandate accepted in writing on both sides — A remittance or recruitment file holds more than a name and an email.

Companies elsewhere, same obligation

What changes from one country to the next is not the rule but the route into it.