You need a UK GDPR representative if your business is not established in the UK but the UK GDPR still applies to you. That happens when you offer goods or services to people in the UK, or monitor their behaviour there. There are only two narrow ways out: your processing is occasional and low-risk, or you are a public authority or body.
The EU GDPR has the same rule, applied separately. So a business in Dubai that sells into both the UK and the EU can need two representatives: one in the UK and one in the EU. This guide explains, in plain English, who needs one, what the representative does, and how to set one up properly.
What a UK GDPR representative is
A representative is a person or company in the UK that you appoint, in writing, to act as your local point of contact. The UK regulator and members of the public can contact the representative about how you handle personal data, instead of (or as well as) contacting you abroad.
Think of it as a UK “mailbox with a brain”. It receives letters, requests and complaints, passes them to you quickly, and helps you respond. It does not replace your own compliance work.
When Article 27 UK GDPR applies
The duty comes from Article 27(1) of the UK GDPR. It applies when Article 3(2) applies. Article 3(2) is often called the “targeting” test. It catches organisations with no UK establishment whose processing relates to:
- offering goods or services to people in the UK, whether paid or free; or
- monitoring the behaviour of people in the UK, for example through tracking, profiling or behavioural advertising.
Whether you “target” the UK is a question of fact. Typical signs include prices in pounds sterling, delivery to UK addresses, UK-focused adverts, or tracking UK visitors on your website or app. We explain this test, with examples for Dubai businesses, in Does GDPR Apply to UAE Companies?. If you are unsure, a UK GDPR applicability assessment can give you a clear answer.
Two points are often missed:
- Processors are covered too. Article 27 applies to controllers (who decide why and how data is used) and to processors (who handle data for someone else). A UAE service provider handling UK customers’ data for a client can be in scope itself.
- Being based in the EU does not help. An EU company with no UK establishment that targets people in the UK falls within Article 3(2) like any other non-UK business.
The exemptions in Article 27(2)
Article 27(2) switches the duty off in only two cases.
Occasional, low-risk processing
The first exemption covers processing that is all of the following:
- occasional;
- does not involve special category data (such as health data) or criminal offence data on a large scale; and
- is unlikely to result in a risk to people’s rights and freedoms.
If your business model depends on selling to or tracking people in the UK, your processing is unlikely to be “occasional”. This exemption is better suited to one-off or rare dealings with UK individuals.
Public authorities and bodies
The second exemption covers public authorities and bodies. It will rarely help a private company, although it may matter to some government-linked entities.
If you rely on an exemption, write down your reasons. A short note made at the time is far easier to defend than an assumption.
What a UK GDPR representative actually does
Under Article 27(4), you mandate the representative to be contacted by the regulator and by individuals on all issues about your processing. In practice it:
- receives letters and questions from the UK regulator;
- receives requests from individuals, such as subject access requests;
- forwards everything to you quickly and helps you keep track of deadlines; and
- is named in your privacy notice, as Article 13(1)(a) requires.
Article 27(5) makes clear that appointing a representative does not stop legal action against you, the controller or processor. In other words, the representative does not take over your responsibility for compliance.
UK representative vs EU representative
The EU GDPR has its own Article 27. The European Data Protection Board (EDPB) explains it in Guidelines 3/2018. The structure is similar to the UK rule, but the two appointments are not interchangeable.
| Point | UK GDPR representative | EU GDPR representative |
|---|---|---|
| Legal basis | Article 27 UK GDPR | Article 27 EU GDPR |
| Trigger | Targeting people in the UK (Art 3(2)) | Targeting people in the EU (Art 3(2)) |
| Location | In the UK | In a Member State where the relevant individuals are |
| Exemptions | Occasional low-risk processing; public bodies | The same two exemptions |
| Regulator | Information Commission (formerly the ICO) | EU supervisory authorities |
| Same firm as your external DPO? | Check independence and conflicts carefully | EDPB says the roles are not compatible |
Three practical points follow for non-European businesses:
- Location matters in the EU. The EDPB recommends placing the representative in the Member State where a significant share of the relevant individuals are.
- No “one-stop shop”. EDPB Guidelines 9/2022 say that simply having a representative in a Member State does not trigger the one-stop-shop system. After a data breach, a non-EU controller may have to notify the authority in each Member State where affected people live.
- Records matter. The EDPB says the representative must keep a record of processing activities and cooperate with supervisory authorities. You therefore need an up-to-date record of processing activities (ROPA).
What has changed in the UK in 2026
Article 27 UK GDPR remains in force. On 30 September 2026 the Information Commission took over from the ICO as the UK data protection regulator, and the wording of Article 27(4) was updated accordingly. The government says the change does not alter the regulator’s role, responsibilities or powers.
Two changes under the Data (Use and Access) Act 2025 affect your representative’s workload:
- Complaints. Since 19 June 2026, organisations must give people a way to make data protection complaints and must acknowledge each complaint within 30 days of receiving it.
- Access requests. Revised rules on time limits for responding to individuals’ requests took effect on 5 February 2026.
Brief your representative on both, so that nothing sent to it in the UK is missed.
Practical examples
Example 1: a Dubai online shop selling to customers in London. The shop has no UK office. Its website shows prices in pounds, ships to UK addresses and runs adverts aimed at UK shoppers. It processes UK customers’ names, addresses and order histories every day. This is not occasional, so the exemption does not apply. The shop needs a UK GDPR representative, must name it in its privacy notice, and should agree how quickly the representative will forward requests and complaints.
Example 2: a UAE software company with UK and German clients. The company sells a subscription app to businesses and individuals in the UK and Germany and tracks how users behave in the app. It needs a UK representative for the UK and a separate EU representative, ideally in the Member State where most of its EU users are. One provider may be able to cover both, but there must be two separate appointments.
Example 3: a one-off sale. A Dubai consultancy once sells a single training session to a UK individual and does not market to the UK. This looks occasional and low-risk. It may fall within the exemption, but it should record why, and review that decision if UK work grows.
Checklist: appointing a representative well
- A written mandate that meets Article 27(1) and (4)
- A clear process and timescale for forwarding regulator letters, requests and complaints to you
- Access to your records of processing and current contact details
- Arrangements for subject access requests, complaints and breach-related questions
- Your privacy notice updated to name the representative
Speed matters, because deadlines run from when a request arrives, even if it arrives at your representative. Our guide on how to respond to a DSAR explains the steps.
What to do next
- Check whether Article 3(2) applies. Assess your UK and EU activity separately.
- Test the exemptions honestly. Write down why your processing is, or is not, occasional and low-risk.
- Appoint in writing. Use a provider that can act as your UK GDPR representative and, if needed, arrange an EU representative in the right Member State.
- Update your privacy notice. Name the representative and give its contact details.
- Agree handover procedures. Set timescales for forwarding requests, complaints and regulator letters.
- Keep your records current. Make sure your ROPA is ready to share.
To discuss your position, contact us.
This article is general information, not legal advice for a specific case.
Frequently asked questions
Who needs a UK GDPR representative?
An organisation that has no establishment in the UK but is still caught by the UK GDPR under Article 3(2), because it offers goods or services to people in the UK or monitors their behaviour there. Both controllers and processors can need one, unless an exemption in Article 27(2) applies.
What are the exemptions from appointing a representative?
There are only two. The first covers processing that is occasional, does not involve large-scale special category or criminal offence data, and is unlikely to create a risk to people. All three conditions must be met. The second covers public authorities and bodies.
Does a UK representative cover the EU as well?
No. The EU GDPR has its own Article 27. An EU representative must be in an EU Member State where the relevant individuals are, so a business that targets both markets may need two appointments.
Is the representative liable for my compliance?
Not in your place. Article 27(5) says appointing a representative does not prevent legal action against the controller or processor itself. The representative is mainly a point of contact, and your organisation stays responsible for compliance.
Do I have to tell people who my representative is?
Yes. Article 13(1)(a) requires your privacy information to give the identity and contact details of your representative, where you have one. Make them easy to find, for example on your website.
Sources
- UK GDPR, Article 27 – legislation.gov.uk
- UK GDPR, Article 3 – legislation.gov.uk
- UK GDPR, Article 13 – legislation.gov.uk
- EDPB Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
- EDPB Guidelines 9/2022 on personal data breach notification, version 2.0
- Regulation (EU) 2016/679 (GDPR) – EUR-Lex
- GOV.UK – Information Commission succeeds the ICO as UK’s data protection regulator
- Data (Use and Access) Act 2025, section 103 (complaints) – legislation.gov.uk
- The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026
Insights & answers
Latest from PAD