Do You Need a UK GDPR Representative? The Article 27 Test, Answered (2026)

You need a UK GDPR representative if your company has no establishment in the UK and your processing relates to offering goods or services to people in the UK, or to monitoring their behaviour there. That is the test in Article 3(2) of the UK GDPR. Where it applies, Article 27(1) requires you to "designate in writing a representative in the United Kingdom", unless the exemption in Article 27(2) applies.

This page works through the test in two questions, then covers the exemption, some examples, the consequences of not appointing a representative and how to appoint one. The legal text is quoted from legislation.gov.uk as revised to 30 September 2026.

Question one: are you established in the UK?

Article 3(1) applies the UK GDPR to processing "in the context of the activities of an establishment of a controller or a processor in the United Kingdom". If you have a UK company, a UK branch, a UK office with staff or another stable arrangement through which you carry on real activity in the UK, you are established there. Article 3(1) then applies to you directly and the representative obligation does not arise. Other obligations apply instead, including the data protection fee.

Some connections with the UK do not, on their own, amount to an establishment. Examples are UK customers, a UK domain name, a UK payment provider, a server in a UK data centre and a UK accountant. The question is whether you yourself have a stable presence and real activity in the UK. If the position is unclear, for example because you have staff or an agent in the UK, take advice before relying on either answer.

If you are established in the UK, you do not need a UK representative. If you are not, go on to the second question.

Question two: does Article 3(2) describe your processing?

Article 3(2) applies the UK GDPR to processing of the personal data of people in the UK by a controller or processor not established in the UK, "where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the United Kingdom; or (b) the monitoring of their behaviour as far as their behaviour takes place within the United Kingdom". Either limb is sufficient.

Offering goods or services. Payment is not required, so a free app can be within the provision. The question is whether you direct your offer at people in the UK. Relevant indications include pricing in pounds, delivery to UK addresses, a UK phone number, marketing aimed at the UK and a UK App Store listing. A website that people in the UK can reach, but which does nothing to target them, is unlikely to be within this limb on that fact alone.

Monitoring behaviour. This covers tracking what people in the UK do. Examples include analytics linked to identifiable users, behavioural advertising, profiling, location tracking and fraud scoring of UK transactions. An online retailer outside the UK that uses retargeting on visitors in the UK may be monitoring their behaviour even if it never delivers goods to them.

If neither limb describes your processing, Article 3(2) does not apply and you do not need a representative. If either does, Article 27(1) applies unless you are within the exemption.

The exemption

Article 27(2) disapplies the obligation for "processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing". It also disapplies it for "a public authority or body".

The three conditions in the first exemption are cumulative, so all of them must be met. The ICO summarises the test in the same way: you do not need a representative if "your processing is only occasional, of low risk to the data protection rights of individuals, and does not involve the large-scale use of special category or criminal offence data".

Occasional. Processing is occasional where it is not a regular part of how the business operates. A customer database, an app with UK users, a subscriber list or a CRM containing UK leads is unlikely to be occasional, even if the numbers are small. An enquiry that arrives from the UK from time to time, at a business that does not otherwise serve the UK, is closer to what the exemption has in mind.

No large-scale special category or criminal offence data. Special category data covers health, biometric and genetic data, and data about racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life and sexual orientation. A health service with a substantial number of UK users is unlikely to meet this condition.

Unlikely to result in a risk. The assessment takes account of the nature, context, scope and purposes of the processing. Financial data, children's data, location data and data used to make decisions about people all make it harder to conclude that a risk is unlikely.

A business that has decided to sell to people in the UK will rarely meet all three conditions, because selling to a market on a continuing basis is difficult to describe as occasional. If you rely on the exemption, record your reasoning on each condition at the time.

Six examples

The examples below show how the test applies. Each depends on its facts.

1. A US software company with paying UK customers and no UK office. The company offers a service to people in the UK, and the processing is not occasional. A representative is required.
2. A Nigerian remittance app whose senders live in London. The senders are in the UK and are offered a service there, and the processing involves financial data. A representative is required. The page for Nigerian companies covers payments, property and platform businesses.
3. A German retailer that closed its UK subsidiary and still delivers to UK customers. The retailer was established in the UK and no longer is, so Article 3(2)(a) now applies to it. An EU representative, if it has one, does not cover the UK. A representative is required.
4. A Canadian consultancy whose only UK contact is a former client who emails occasionally. The consultancy does not direct an offer at the UK or monitor anyone there, and the processing is occasional and low risk. No representative is required, and the consultancy should record why.
5. A Singapore telehealth platform with UK patients. The platform offers a service to people in the UK and processes health data. Depending on the scale, the exemption is unlikely to be available, so a representative is likely to be required.
6. A UK-registered company processing UK data. The company is established in the UK, so Article 3(1) applies and not Article 3(2). No UK representative is required.

If you also serve people in the EU, the comparison of the UK and EU requirements explains when you need a representative in each.

If you do not appoint one

Article 27 is among the provisions listed in Article 83(4)(a) of the UK GDPR. The maximum fine under that paragraph is "£8,700,000, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher".

That figure is a maximum, and it says little about how a missing representative is usually identified. The ICO described the purpose of the role in a letter quoted by the High Court in Sansó Rondón v LexisNexis Risk Solutions UK Limited [2021] EWHC 1427 (QB): "the existence of a representative makes it easier to take action against a controller by acting as a conduit, but any enforcement action is directed against the controller itself". The court held in that case that the claim could not be brought against the representative in place of the controller.

A missing representative is therefore most likely to be noticed when something else brings your processing to attention. That might be a complaint from someone in the UK, a breach notification, a customer's supplier questionnaire or an investor's legal review. In each case the absence of a representative is an additional infringement alongside the matter that prompted the enquiry.

What goes in your privacy notice

Articles 13(1)(a) and 14(1)(a) of the UK GDPR require you to give individuals "the identity and the contact details of the controller and, where applicable, of the controller's representative". Add the details where your notice gives your own:

Our representative in the United Kingdom for the purposes of the UK GDPR is [name of representative], [postal address], [email address]. You may contact them about any matter relating to our processing of your personal data.

How to name your GDPR representative in your privacy notice gives wording for UK and EU appointments, where to place it, and the errors to avoid.

Article 30 also requires the record of processing to include the representative's name and contact details, and places the duty to maintain the record on "each controller and, where applicable, the controller's representative". Your representative should hold a current copy and be able to provide it to the regulator on request.

How to appoint one

Article 27(1) requires the designation to be in writing, so the appointment should be a signed document. The representative must be established in the UK (Article 4(17)). The document should set out the mandate in Article 27(4), under which the representative is to be addressed "in addition to or instead of the controller or the processor" by the regulator and by individuals "on all issues related to processing". It should also explain what the representative will do with the correspondence it receives. Under Article 27(5), appointing a representative does not affect any legal action that could be taken against you directly.

The UK GDPR now refers to the regulator as the Information Commission, which replaced the Information Commissioner on 30 September 2026. The regulator continues to use the name ICO on its website, and this page uses that name for its guidance.

Janus Compliance Limited provides the appointment for £349 a year from a registered London office, with correspondence forwarded within one working day. The cost comparison sets out what other providers charge, with the date each price was checked.

Sources

• UK GDPR, Articles 3, 4(17), 13, 14, 27, 30 and 83. legislation.gov.uk, revised text as at 30 September 2026, read 7 October 2026.
• ICO, "Receiving personal information from the EEA", section "Do we need a UK representative?", ico.org.uk, last updated 15 January 2026, read 7 October 2026.
• Sansó Rondón v LexisNexis Risk Solutions UK Limited [2021] EWHC 1427 (QB), paragraphs 37 and 103, read on the National Archives' Find Case Law service on 7 October 2026.

Last verified 7 October 2026. This page is general information, not legal advice. Whether you are established in the UK, and whether the exemption applies, depend on your own facts.