Article 27 UK GDPR · the United States

UK representative for US companies

American companies were the first to be caught twice. Most appointed an EU representative years ago and stopped there. The United Kingdom left the Union with Article 27 intact in its own law, so a Delaware company selling to Manchester now needs a second designation naming an entity in Britain — and the one in Prague or Dublin does not count.

What changed for you at the end of 2020

Nothing about your obligation to Europe changed. What changed is that Britain became a third country with its own copy of the regulation. A US company that targets UK consumers is caught by Article 27 of the UK GDPR exactly as it is caught by Article 27 of the EU GDPR, and the two are satisfied separately. If your privacy notice names a European representative and nothing else, the ICO looks at it and sees no representative at all.

The Data Bridge is about transfers, not about representation

Since 2023 the UK extension to the EU–US Data Privacy Framework lets certified US organisations receive UK personal data without additional safeguards. It solves the transfer question. It does not touch Article 27: certification under the Data Bridge is not a designation, and the ICO will still ask who represents you in the United Kingdom. Companies conflate the two constantly, usually in the same sentence.

Who writes to you, and about what

Individuals in the UK exercise the same rights they do in Europe, and they write to the address in your notice. The ICO writes when a complaint lands, when a breach is reported, or when it opens a broader look at a sector. Both go to the representative first. A US company with no UK contact point tends to discover this through a complaint that has already escalated, because there was no one to answer at the ordinary stage.

The practical difference from your EU appointment

Same mechanics, different entity and different regulator. Your designation names REP27 LTD, company number 17385889, at Mildenhall in Suffolk. The verification code carries the UK27 prefix. The wording you publish is separate from the European one, because a single line naming a Czech company would be wrong in front of the ICO and a single line naming a British one would be wrong in front of a European authority.

What a US company actually has to publish

Two lines, not one. The European designation names Europe Services SE in Prague and answers to supervisory authorities in the member states. The British one names REP27 LTD in Suffolk and answers to the Information Commissioner's Office. Publishing only the first tells a British reader that you have no representative in their country, and publishing only the second tells a European reader the same thing in reverse. We supply both paragraphs written out, with company numbers and addresses, so nothing has to be drafted by your counsel at the moment a request arrives.

What changes between your two designations

The first week, in practice

Most US clients hear nothing in the first week, which is the point. What happens is administrative: the designation is signed and issued, the code goes live on the register, the two paragraphs go into the privacy notice, and the UK representative field in whatever vendor questionnaire triggered the search finally has an answer. The first real correspondence, when it comes, is usually an access request from a British customer who has read the notice and used the address in it.

Questions from American companies

Read next

Companies elsewhere, same obligation

What changes from one country to the next is not the rule but the route into it: the transfer basis, the regulator you already know, and how British customers reach you.