What is a UK representative, and who needs one?

What it is

The UK GDPR reaches organisations outside the UK that target or monitor people in the UK. Those organisations must designate in writing a representative established in the UK, who can be contacted by the regulator and by individuals, and who keeps a copy of the record of processing.

When you need one

• You have no establishment in the UK, and you offer goods or services to people in the UK, whether paid or free. UK GDPR Art 3(2)(a); Art 27
• You have no establishment in the UK, and you monitor the behaviour of people in the UK, for example by online tracking. Art 3(2)(b); Art 27

When you do not

• Processing that is occasional, does not include large-scale special category or criminal offence data, and is unlikely to result in a risk to individuals. Art 27(2)(a)
• Public authorities and bodies. Art 27(2)(b)

Who is responsible

The overseas controller or processor, which must appoint the representative in writing and give their details to people in its privacy information. Appointing a representative does not shift legal responsibility from the controller.

What it involves

1. Check whether Art 3(2) brings you in scope.
2. Check the Art 27(2) exceptions.
3. Appoint a UK representative by written mandate.
4. Name them in your privacy notice and records.

If it goes wrong

Regulatory

Failing to appoint a required representative breaches Art 27. A breach of this duty sits in the standard tier of penalties: up to £8.7 million or 2% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice.

Criminal

No offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.