Article 27 UK GDPR · Spain
UK representative for Spanish companies
Spain has an unusual version of this problem: a large resident British population, and companies that serve them without ever thinking of themselves as selling into the United Kingdom. The test is not where the customer stands when they buy — it is whether you offer goods or services to people in the UK or monitor their behaviour there.
The AEPD covers Spain, not Britain
The Agencia Española de Protección de Datos supervises your European obligations. It has no authority in the United Kingdom and no standing to receive correspondence on your behalf there. If your privacy notice names only a Spanish address, a British complainant and the ICO both find no point of contact.
Where the line actually falls for Spanish businesses
Selling to a British resident who lives in Alicante is a domestic sale. Running an English-language site that takes bookings in pounds from people in Britain, advertising in UK media, or emailing a list of British customers about next season is offering services to people in the United Kingdom. The second group needs a UK representative; the first does not.
Property, travel and health services
Three Spanish sectors write to us more than the rest: estate agencies marketing to buyers in Britain, travel and hospitality taking direct bookings in sterling, and clinics running English-language sites aimed at British patients. The last carries the extra weight of health data, which raises what a complaint costs and makes an unanswered ICO letter considerably more expensive.
Two mandates when a group needs both
Established in Spain you are covered inside the Union. If your group also has a Latin American or US entity that needs a European representative, both are issued from one order — one naming Europe Services SE in Prague, one naming REP27 LTD in Suffolk, each verifiable separately.
Qué se publica y dónde
The paragraph goes in your política de privacidad, under the controller's details, and must name an entity established in the United Kingdom. We supply it in Spanish and in English. Nothing changes in your AEPD-facing text: established in Spain, you are inside the Union and need no European representative. What is new is the British line, and it has to carry a British address.
Where the boundary falls for a Spanish company
| British resident buying in your shop in Spain | Domestic sale | No UK representative needed |
| English-language site taking bookings in pounds | Offering services to people in the UK | Representative required |
| Advertising in British media | Targeting people in the UK | Representative required |
| Emailing a list of past British customers | Processing data of people in the UK | Representative required |
| Analytics profiling UK visitors | Monitoring behaviour in the UK | Representative required |
Sectores donde el riesgo pesa más
Three sectors write to us more than the rest, and they are not equally exposed. Estate agencies marketing property to buyers in Britain hold contact and financial details. Travel and hospitality hold booking histories, which are ordinary but voluminous. Clinics running English-language sites for British patients hold health data, and a complaint about health data is not an ordinary complaint: it raises what an unanswered ICO letter costs, and it makes the absence of a named contact point considerably harder to explain afterwards.
Questions from Spanish companies
¿Vendemos a británicos residentes en España. Cuenta como Reino Unido?
No by itself. What matters is whether you offer services to people located in the United Kingdom or monitor their behaviour there.
Our site is in English. Is that enough to be caught?
Language alone is not decisive. Prices in pounds, UK shipping, UK advertising and UK support hours together are.
Does the UK adequacy decision cover us?
It covers transfers of personal data from the UK to the EEA. It does not remove the need for a representative in Britain.
What happens if we cancel later?
The designation runs to its expiry date and then shows as expired on the public register, with no silent lapse.
Appointed today, verifiable today
One annual fee, no charge per request. From €290 a year for the United Kingdom, €390 for the United Kingdom and the Union together.
How the UK service works PricingRead next
Do I need one at all?
The three-question test, and the exemptions that rarely apply.
What the ICO expects
Who writes, what they ask for, and how fast an answer is due.
Why one duty became two
What the end of the transition actually changed, and for whom.
Companies elsewhere, same obligation
What changes from one country to the next is not the rule but the route into it: the transfer basis, the regulator you already know, and how British customers reach you.
Selling into Britain from France
The same rule, a different starting point.
Selling into Britain from Italy
The same rule, a different starting point.
The three-question test
The guide that matters most here.