UK GDPR representative: why the EU one is not enough
9 min read
UK GDPR representative: when a company outside the UK needs one under Article 27, why an EU representative cannot cover UK customers and what to do.
You make outdoor gear in the U.S., sell it through your own web shop to customers in Germany, France and the United Kingdom, and already have an EU representative under the General Data Protection Regulation (GDPR). For your UK customers, that appointment does not count: the UK's own version, the UK GDPR, requires a representative established in the United Kingdom (Articles 4(17) and 27(1) UK GDPR). Here is when you need a UK GDPR representative, how it differs from the EU role and what the new Information Commission changes.
What a UK GDPR representative is
After Brexit, the UK kept the GDPR as its own law. This version, the UK GDPR, applies in England and Wales, Scotland and Northern Ireland alongside the Data Protection Act 2018 (section 3(10) DPA 2018 (opens in a new tab)).
A controller (who decides why and how data is used) or processor (who handles it for others) outside the UK that falls under it must designate in writing a representative in the United Kingdom (Article 27(1) UK GDPR (opens in a new tab)): a person or company established in the UK that represents you regarding your UK GDPR obligations (Article 4(17)).
When the UK GDPR applies to a company outside the UK
Article 3(2) UK GDPR mirrors the EU test, with the United Kingdom in place of the Union. It covers controllers and processors not established in the UK that process personal data of people in the UK in connection with:
- offering them goods or services, paid or free (Article 3(2)(a)), or
- monitoring their behavior in the UK, such as online tracking for targeted advertising (Article 3(2)(b)).
Prices in pounds, delivery to UK addresses or ads for a UK audience point to an offer aimed at the UK (for the EU criteria, see our EU GDPR representative guide). With a branch, office or other establishment in the UK, you need no representative (guidance of the UK regulator, the ICO (opens in a new tab)).
Northern Ireland belongs to this market. For product safety it follows EU rules (GPSR in Northern Ireland, not in Great Britain); for data protection, the UK GDPR covers customers in Belfast as in London.
EU and UK GDPR representative compared
| Topic | EU GDPR | UK GDPR |
|---|---|---|
| Where it is established | In a member state where the people you target are (Art. 27(3)) | In the United Kingdom (Art. 4(17), 27(1)); paragraph 3 is omitted |
| Exemptions | Occasional, low-risk processing without large-scale sensitive data; public bodies (Art. 27(2)) | Same wording (Art. 27(2)) |
| Addressed by | Supervisory authorities and data subjects (Art. 27(4)) | The Information Commission and data subjects (Art. 27(4)) |
| Orders for information | Can go to the representative (Art. 58(1)(a)) | Same (Art. 58(1)(a)), by information notice (ss. 115(5), 142(9) DPA 2018) |
| Maximum fine for not designating | 10 million euros or 2% of worldwide turnover (Art. 83(4)(a)) | £8.7 million or 2% of worldwide turnover (Art. 83(4)(a)) |
| Customers in Northern Ireland | Not covered | Covered (s. 3(10) DPA 2018) |
Why your EU representative cannot cover the UK
The EU text lets you choose a representative in any member state where your customers are (Article 27(3) of Regulation (EU) 2016/679 (opens in a new tab)). The UK deleted that paragraph and requires a representative in the United Kingdom (Articles 4(17) and 27(1) UK GDPR). A company established only in the EU cannot be your UK representative.
The ICO's own example: a sales firm in Ireland with regular UK clients but no UK office must appoint a UK representative. Conversely, a company established only in the UK cannot be your EU representative.
What changed on 30 September 2026: the Information Commission
On 30 September 2026, the office of the Information Commissioner was abolished and its functions passed to the Information Commission (sections 118 and 119 of the Data (Use and Access) Act 2025 (opens in a new tab), in force under the commencement regulations SI 2026/1015 (opens in a new tab)). It is still called the ICO, now the Information Commission's Office (ICO, 15 September 2026 (opens in a new tab)).
Article 27(4) UK GDPR now names "the Commission" (SI 2026/386 (opens in a new tab), Schedule 3, paragraph 41). Otherwise Article 27 is unchanged.
An existing mandate needs no new signature: documents naming the Information Commissioner are treated as naming the Commission (section 119(2) of the 2025 Act). Update the name at your next revision.
What your UK representative does, and what stays with you
Your representative is the contact point, in addition to or instead of you, for the Information Commission and people in the UK on all issues related to processing (Article 27(4)). This includes:
- Record of processing activities: it also keeps the record and shows it to the Commission on request (Article 30(1), (4)).
- Cooperation with the Commission on request (Article 31).
- Information: the Commission can order information from the representative (Article 58(1)(a)), in the UK by an information notice (section 115(5) and section 142(9) DPA 2018 (opens in a new tab)).
- Transparency: your privacy notice names it (Articles 13(1)(a) and 14(1)(a)), and the ICO expects its details to be easy to find, for example on your website.
Responsibility stays with you (Article 27(5)), as the ICO confirms. Not designating a representative can be fined up to £8.7 million or, for an undertaking, 2% of total worldwide annual turnover, whichever is higher (Article 83(4)(a) UK GDPR, section 157 DPA 2018).
How to set up your UK GDPR representative in six steps
- Map your UK-facing processing: orders, accounts, newsletter, tracking, warranty registrations, support (Article 3(2) UK GDPR).
- Test the exemption: occasional, no large-scale sensitive data, unlikely to result in a risk. All three must apply (Article 27(2)(a)).
- Choose a representative established in the UK, not merely reachable there (Article 4(17)).
- Sign a written mandate for all issues related to processing (Article 27(1), (4)).
- Hand over your record of processing activities and keep it current (Article 30(1)).
- Name the representative in your privacy notice and at each point of collection (Articles 13(1)(a) and 14(1)(a)).
Practical example: a U.S. outdoor brand selling to the EU and the UK
A U.S. maker of backpacks and tents sells through its own shop in euros and pounds, ships to Germany, France, England and Northern Ireland, runs retargeting cookies and has no office in Europe.
| Question | EU | UK |
|---|---|---|
| Does the law apply? | Yes: offer in euros, delivery to two member states (Art. 3(2) GDPR) | Yes: offer in pounds, delivery to England and Northern Ireland (Art. 3(2) UK GDPR) |
| Where is the representative? | Germany or France (Art. 27(3) GDPR) | United Kingdom (Art. 27(1) UK GDPR) |
| Who covers customers in Belfast? | Not the EU representative | The UK representative |
One privacy notice can name both representatives. Product law adds roles of its own, as our EU and UK market entry checklist shows.
Common mistakes with the UK GDPR representative
- “Our EU representative covers the UK.” It does not; the UK version requires a representative in the United Kingdom (Article 27(1) UK GDPR).
- Forgetting Northern Ireland. EU rules apply there for product safety, the UK GDPR for data protection.
- “We are too small.” Article 27 has no size or turnover threshold; only the exemption in Article 27(2) counts.
- One mandate for every role. Your UK GDPR representative is not a product law role (UK Responsible Person: when you need one), and connected devices sold in the EU may need a legal representative under the EU Data Act.
Conclusion: two markets, two representatives
Selling to or tracking people in both the EU and the UK usually means two data protection representatives: one in a member state where your EU customers are, one in the United Kingdom. Your duties as controller stay with you.
At Representa, data protection representation is part of Representation. Whoever takes the UK role must be established in the United Kingdom, so check this in every offer.
Frequently asked questions
Do I need a UK GDPR representative if I already have an EU representative?
Yes, if the UK GDPR applies to you under Article 3(2) and no exemption fits. The UK version requires a representative established in the United Kingdom (Articles 4(17) and 27(1) UK GDPR), so your EU appointment does not cover your UK customers.
Can a company in the EU act as my UK representative?
Only if it is itself established in the United Kingdom. A company established only in the EU does not meet Article 4(17) UK GDPR, just as a company established only in the UK cannot be your EU representative under Article 27(3) GDPR.
Does the UK representative cover customers in Northern Ireland?
Yes. The UK GDPR forms part of the law of Northern Ireland as well as of Great Britain (section 3(10) Data Protection Act 2018). Unlike product safety, where EU rules apply in Northern Ireland, data protection follows the UK rules there.
What is the fine for not appointing a UK representative?
Up to £8.7 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a) UK GDPR, section 157 Data Protection Act 2018).
Did the Data (Use and Access) Act 2025 change the representative rules?
Not in substance. Since 30 September 2026, Article 27(4) names the Information Commission instead of the Information Commissioner (SI 2026/386). The duty to designate a representative in the UK and its exemptions are unchanged.
