Representation in the UK and EU

If you are a UK-based organisation offering services or goods in the EU, but with no EU base, and are processing personal data of individuals in the EU, or monitoring their behaviour, you may require an EU representative to comply with Article 27 of the EU General Data Protection Regulation (GDPR).

Similarly, if your organisation is based outside the UK, offering services or goods to individuals in the UK, but with no UK base and processing personal data of, or monitoring the behaviour of individuals in the UK, you may require a UK representative to meet your obligations under Article 27 of the UK GDPR.

Public authorities are not required to appoint a representative and the requirement may not apply to your organisation if you only engage in occasional, low-risk personal data processing activities.

We can advise you as to whether the requirement applies to your organisation and help you find a representative if it does. 

The role of a representative is distinct from the Data Protection Officer (DPO). The main active duties of a representative are to act as a link between a non-UK or non-EU organisation and data protection authorities (such as the ICO) and a point of contact for data subjects.

The representative is also responsible for maintaining the organisation’s record of personal data processing activities. The nature of duties carried out by a representative may vary depending on the type and volume of data processing activities undertaken by the organisation.

Representatives must be formally authorised to act on your organisation’s behalf. The appointment should be made in writing.

Organisations must provide data subjects with contact details for the representative, which can be incorporated into your organisation’s privacy notice. We can advise you on the necessary customer communication and make sure you have the right documentation in place.