Two structural questions catch organisations that grew across borders or through acquisitions: do we need a UK representative, and does being one group make us one controllerControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties.? The answers are often yes and no.
Territorial reach
The UK GDPR applies to controllers and processorsProcessorProcesses personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties. established in the UK. It also applies to those outside the UK that process personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. of people in the UK where the processing relates to offering goods or services to them or monitoring their behaviour in the UK.
The UK representative
A controller or processor caught only by that extraterritorial reach must appoint a representative in the UK, in writing, unless the processing is occasional, does not involve large-scale special category or criminal offence data, and is unlikely to result in a risk. Public authorities are also exempt.
The representative is a point of contact for people and the regulator, and must hold the record of processing. It does not take on the controller’s liability, but enforcement can be initiated against it. Name it in the privacy notice.
Groups: every company is its own controller
A corporate group is not a single controller. Each company that decides why and how data is processed is a controller in its own right. Sharing between group companies is a disclosure from one controller to another and needs a lawful basis, transparency and, if it leaves the UK, a transfer route.
Legitimate interestsLegitimate interestsA lawful basis needing a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests and rights. often supports intra-group transmission for internal administrative purposes, but it is still an assessment, not an assumption.
Joint controllers inside a group
Where group companies decide purposes and means together, such as a shared HR platform run to a common policy, they are joint controllers. They must have an arrangement setting out their respective responsibilities, especially for transparency and rights, and the essence of it must be available to data subjects. People can exercise their rights against any of them.
Group transfers
For groups with entities outside the UK, binding corporate rulesBinding corporate rulesRegulator-approved internal rules letting a multinational group transfer personal data within the group. approved by the regulator provide a transfer route within the group. Otherwise each intra-group transfer needs the IDTAIDTAThe International Data Transfer Agreement: the UK's own contract for restricted transfers where no adequacy regulations apply., the UK AddendumUK AddendumAn addendum that adapts the EU standard contractual clauses for UK transfers, so a group can use one set of clauses for both. or another Article 46 safeguard, with the data protection testData protection testThe DUAA test for international transfers: whether protection in the destination is not materially lower than in the UK. A different wording from the EU's essentially equivalent standard. assessed.
A practical structure
- One record of processing per controller, with shared templates.
- A group data sharing agreement that names the controllers and the bases.
- A joint controller arrangement wherever a shared system is run to a common policy.
- One rights request process that any group company can route into.