Article 27 of the UK GDPR
UK representative for companies outside the United Kingdom
Brexit did not remove the obligation, it duplicated it. A company outside the UK that offers goods or services to people here, or monitors their behaviour, must appoint a representative established in the United Kingdom. An EU representative does not cover it, and the Information Commissioner’s Office does not accept a Prague address.
Who has to appoint a UK representative
The test is the same shape as the European one, applied to a different territory. You are caught if all three are true.
01
No establishment in the UK
No branch, no subsidiary, no office. A UK reseller or distributor that is a separate company does not make you established here.
02
You target people in the UK
Prices in pounds, shipping to Britain, a .co.uk domain, English-language marketing aimed here, or simply taking orders from British customers.
03
You process their personal data
Names, addresses, emails, order history, cookies that profile them. Almost anything a webshop or an app does.
The exemptions are narrow: occasional processing that is low risk and involves no special category data on a large scale, and public authorities. Most companies that ask us the question are caught.
What a UK representative actually does
The role mirrors Article 27 of the EU GDPR, with the Information Commissioner’s Office in place of the European authorities.
| Duty | In practice |
|---|---|
| Point of contact | Named in your privacy notice so that people in the UK and the ICO can write to someone here |
| Addressed in your place | May be approached in addition to, or instead of, your company on all issues related to processing |
| Record of processing | Maintained on your behalf and produced to the ICO on request |
| Cooperation | Passes on requests, keeps the file, stays in the thread until the matter closes |
| Established in the UK | REP27 LTD, company number 17385889, Mildenhall, Suffolk — verifiable at Companies House |
What it is not: a data protection officer, a law firm, or a shield from your own obligations. The accountability under the UK GDPR stays with you.
UK and EU together, or separately
Most companies that ask about one need both, because they sell into both markets. Two mandates are issued, priced as a package, and renewed on the same date.
What you pay
The United Kingdom alone costs the same as the Union alone: from €290 a year. Both territories together are from €390 — the second market costs €100, not another €290.
What you receive
For both: two signed designations, two certificates, two verification codes and two lines for your privacy notice. One payment, one form, one renewal date.
What goes in your privacy notice
The wording must name the entity and give an address people can write to. If you cover both territories, that is two lines, not one — a single line naming a Czech company is wrong in front of the ICO, and the reverse is wrong in front of a European authority.
EU representative under Article 27 GDPR: Europe Services, SE, Na Cecelicce 425/4, Smichov,
150 00 Praha 5, Czech Republic. Data subjects may contact the representative at
info@gdprrepresentative.com regarding the processing of their personal data.
UK representative under Article 27 of the UK GDPR: REP27 LTD (company number 17385889),
Unit 82a James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom. Data subjects in the
United Kingdom may contact the representative at info@gdprrepresentative.com.
We send you both lines in the language of your notice as soon as the designations are issued.
Questions companies ask before appointing
Does an EU representative cover the United Kingdom?
No. Since the end of the transition period the UK GDPR is a separate regime with its own regulator. A representative established in a member state has no standing before the ICO, and vice versa.
We are a US company selling to both the EU and the UK. What do we need?
Both. One designation naming an entity in the Union and one naming an entity in the United Kingdom. We issue them together for €390 a year rather than €580 bought separately.
Is a UK representative mandatory, or recommended?
Mandatory under Article 27 of the UK GDPR when you are outside the UK and target or monitor people here, unless one of the narrow exemptions applies. It is not a best practice, it is a duty.
What can the ICO do if we have not appointed one?
Failure to designate is an infringement in its own right and can attract a fine, separately from any underlying breach. In practice it surfaces during a complaint, when the ICO finds nobody in the UK to write to.
Can our UK distributor act as our representative?
Only if it accepts the mandate in writing and its details are published in your notice. Most distributors decline, because the representative may be addressed instead of the controller.
How fast is the appointment, and how is it proved?
Issued the same working day the form and payment are complete. Proof is a code with the UK27 prefix that resolves on our public register: green while the mandate is live, red the moment it lapses.
Do we also need a UK data protection officer?
Rarely. The DPO test depends on your activity, not on where you are, and most companies that need a representative have no DPO obligation at all.
What happens when we cancel?
The designation runs to its expiry date and then shows as expired on the register. You update your privacy notice; we do not keep your name on file afterwards.
Appoint a UK representative today
From €290 a year for the United Kingdom, or €390 for the United Kingdom and the Union together. Issued the same working day, with a code anyone can check.
See the plans Which obligation applies to me?By where your company is established
The obligation reads the same everywhere, but what trips companies up differs by origin: the transfer basis, the regulator you already deal with, and the way British customers reach you.