Article 27 UK GDPR · the United Arab Emirates

UK representative for UAE companies

The UAE has several data protection regimes running at once — the federal law, and separate frameworks in the DIFC and ADGM free zones — which makes companies here more familiar than most with the idea of overlapping rules. The United Kingdom adds one more, and it asks for something none of the local regimes provides: a representative established in Britain.

Federal law, DIFC, ADGM — and then the UK GDPR

Whether you sit under the federal Personal Data Protection Law or inside a free zone regime changes a great deal locally and nothing about the British requirement. Article 27 of the UK GDPR looks at where the individuals are. A company in Dubai targeting people in the United Kingdom is a company outside Britain doing so, on the same terms as one in Delaware.

The British client base that makes it visible

Three patterns recur here. Property developers and brokers marketing to buyers in Britain, holding contact and financial detail. Schools and universities recruiting British students, holding identity and academic records. And wealth and advisory firms with British clients, holding data that is sensitive in practice even when it is not a special category. In each case the data belongs to people in the UK.

No adequacy, so transfers need paperwork as well

The United Kingdom has not made an adequacy finding for the UAE. Data flowing from Britain generally moves under the IDTA or the addendum. The DIFC and ADGM regimes have their own recognition arrangements, which help within their own systems and do not answer the British question.

What the designation adds to a British transaction

A UK counterparty running due diligence looks for a named representative with a British address and a way to check it. Ours names REP27 LTD, company number 17385889, in Suffolk, with a code that resolves publicly. In transactions where the counterparty is a regulated British firm, that check is not optional for them.

Which regime you sit under, and why it does not matter here

Federal law, DIFC or ADGM: the answer changes your domestic obligations entirely and the British one not at all. Article 27 asks where the individuals are. It is worth stating this plainly because free zone regimes are sophisticated enough that companies reasonably expect them to cover more ground than they do.

Three local regimes, one British requirement

Property, education, advisory

These three sectors reach British individuals directly and hold data that matters. A developer marketing to buyers in Britain holds financial capacity information. A university recruiting British students holds identity documents and academic history. An advisory firm holds client detail that is confidential by definition. In each case the volume is modest and the sensitivity is not, which is the combination the ICO treats least forgivingly when nobody is named to answer.

Questions from UAE companies

Companies elsewhere, same obligation

What changes from one country to the next is not the rule but the route into it.