How to Name Your GDPR Representative in Your Privacy Notice: UK and EU Wording (2026)

If you are a controller and have appointed a representative under Article 27 of the UK GDPR or the EU GDPR, the information you give to individuals must say who the representative is and how to contact them. In practice that information is your privacy notice. The requirement comes from Articles 13(1)(a) and 14(1)(a), which list "the identity and the contact details of the controller and, where applicable, of the controller's representative" among the information you must give to individuals.

This page explains what the notice needs to contain, gives wording you can adapt, and identifies the errors to avoid. It assumes you already know that you need a representative. If you are still deciding, the guide to the Article 27 test covers that question.

What the law requires

Article 13 applies when you collect personal data from the individual, and Article 14 applies when you obtain it from another source. Both require the same thing about the representative: its identity and its contact details. The wording is identical in the UK GDPR and the EU GDPR.

Neither law specifies which contact details to give. The ICO's guidance on privacy information describes the requirement as "Say who your representative is and how to contact them." In practice notices give the representative's name, a postal address and an email address, so that individuals can reach the representative easily. If you give an email address, use one the representative monitors.

Article 12(1) also applies. It requires the information to be given "in a concise, transparent, intelligible and easily accessible form, using clear and plain language". For the representative, one or two plain sentences are enough.

Example wording

Adapt the wording below to your notice. Replace the bracketed text with your representative's details.

Each example opens by saying where you are established. "Established" has a legal meaning, and a branch, an office or staff in a territory can amount to an establishment there. Keep that sentence only if you have confirmed that you have no establishment in the territory. Otherwise begin with the sentence that names the representative. If your EU representative is in Norway, Iceland or Liechtenstein, refer to the European Economic Area in place of the European Union.

UK representative only

We are established outside the United Kingdom. Our representative in the United Kingdom for the purposes of the UK GDPR is [name of representative], [postal address], [email address]. You may contact them about any matter relating to our processing of your personal data.

EU representative only

We are established outside the European Union. Our representative in the European Union for the purposes of the EU GDPR is [name of representative], [postal address], [email address]. You may contact them about any matter relating to our processing of your personal data.

Both

We are established outside the United Kingdom and the European Union, and we have appointed a representative in each.

United Kingdom (UK GDPR): [name of representative], [postal address], [email address].

European Union (EU GDPR): [name of representative], [postal address], [email address].

You may contact either representative about any matter relating to our processing of your personal data.

The final sentence in each version reflects Article 27(4). The representative is mandated to be addressed "in addition to or instead of the controller" by the regulator and by individuals, "on all issues related to processing". You remain free to invite individuals to contact you directly as well.

Where to put it

Place the representative's details with your own identity and contact details. A reader who wants to know whom to contact should find both in the same place, usually in the opening section of the notice or under a heading such as "Who we are" or "How to contact us".

The ICO says that you should give the representative's details to people in the UK whose information you process, and that you could do this in your privacy notice or in the upfront information you give people when you collect their data. It adds that you "must also make the details of your representative easily accessible to us, as the supervisory authority", and gives publishing the representative's contact information on your website as an example. A privacy notice published on your website therefore serves both purposes.

The European Data Protection Board takes a similar position for the EU GDPR. Its guidelines on territorial scope state that the information "should furthermore be easily accessible to supervisory authorities in order to facilitate the establishment of a contact for cooperation needs". If your notice is available only behind a login or inside an app, consider publishing the representative's details on a public page as well.

If you maintain more than one notice, update each one that covers people in the relevant territory. That commonly includes the website notice, the notice shown in an app or at account creation, and translated versions.

If you have a UK and an EU representative

The UK and the EU have separate representative requirements, and an appointment under one does not satisfy the other. Your notice should therefore identify each representative against the law it relates to, as in the third example above. The EU GDPR also requires the EU representative to be established in a Member State where the individuals concerned are located, so the address in your notice will show whether that condition is met.

Avoid describing a representative simply as "our GDPR representative" where you have only one. A reader in the UK cannot tell from that phrase whether the appointment covers them, and a customer reviewing your notice during due diligence will ask the same question. State the territory and the law. The comparison of the UK and EU requirements explains when each applies.

What the wording should not suggest

Two of the points below rest on the European Data Protection Board's guidelines, which interpret the EU GDPR. The ICO's guidance on UK representatives does not address them, and the ICO states that the Board's guidelines "are not binding under the UK regime" but "may still provide helpful guidance on certain issues". The same caution is sensible for a UK notice.

That the representative is your data protection officer. The contact details of a data protection officer are a separate item, required by Article 13(1)(b) where you have one. The European Data Protection Board "does not consider the function of representative in the Union as compatible with the role of an external data protection officer", because a representative acts on your instructions and a data protection officer must act independently. If you have both, list them separately.

That the representative is your office or branch. A representative is a separate person or organisation that you have appointed. The Board's guidelines confirm that the presence of a representative "does not constitute an 'establishment'" of the controller. Describing the representative's address as your UK or EU office is inaccurate, and it may confuse the question of which rules apply to you.

That responsibility has passed to the representative. Under Article 27(5), the designation is "without prejudice to legal actions which could be initiated against the controller or the processor themselves". The notice should present the representative as a point of contact. It should not say that the representative is responsible for your processing.

That an appointment exists before it does. Article 27(1) requires the designation to be in writing. Add the representative to your notice once the written designation is in place, and not while it is still being arranged.

If you act as a processor

Articles 13 and 14 place the duty to inform individuals on the controller. If you act only as a processor for your customers' data, those Articles do not require you to publish a notice to their users naming your representative.

The representative still needs to be recorded. Article 30(2)(a) requires a processor's record of processing to contain the name and contact details of "the controller's or the processor's representative" where one applies, subject to the limited exemption in Article 30(5) for organisations with fewer than 250 employees. A processor should also make its representative's details easy for the regulator to find, for example on its website. Your customers may also ask for the details in a supplier questionnaire, and the guide to answering that question sets out the possible responses. Most companies are a controller for some data, such as their own account holders and website visitors, so check whether you need the wording in your own notice for that processing.

Two related updates

Your record of processing. Article 30(1)(a) requires a controller's record to include the name and contact details of the controller's representative, subject to the same exemption in Article 30(5). Update the record when you update the notice, so that the two match.

UK notices more generally. If you are editing a notice that covers people in the UK, check the complaints wording at the same time. Since 19 June 2026, Articles 13(2)(ca) and 14(2)(da) of the UK GDPR have required a notice to tell individuals about their right to complain to the controller. Article 13(2)(d) now refers to the right to complain to the Information Commission, which replaced the Information Commissioner on 30 September 2026. The regulator continues to use the name ICO on its website.

If the representative is left out

The European Data Protection Board states that a controller that is subject to Article 3(2) and fails to tell individuals who its representative is "would be in breach of its transparency obligations". Articles 13 and 14 fall within the higher tier of fines. Under the UK GDPR the maximum is £17,500,000 or, for an undertaking, 4% of total worldwide annual turnover in the preceding financial year, whichever is higher. The EU GDPR sets the equivalent at €20,000,000 or 4%.

Those figures are maximums, and in practice an omission is more likely to be noticed by a customer reviewing your notice, or by a regulator already dealing with a complaint, than through a separate investigation.

Appointing a representative

Janus Compliance Limited acts as a UK representative under Article 27 for £349 a year, and provides the EU appointment through Ireland for €449 a year.

Sources

• UK GDPR, Articles 12, 13, 14, 27, 30 and 83. legislation.gov.uk, revised text as at 30 September 2026, read 7 October 2026; Articles 13 and 27 re-read 16 October 2026.
• EU GDPR (Regulation (EU) 2016/679), Articles 12, 13, 14, 27, 30 and 83.
• ICO, "What privacy information should we provide?", ico.org.uk, read 7 and 16 October 2026.
• ICO, "Receiving personal information from the EEA", section "Do we need a UK representative?", ico.org.uk, last updated 15 January 2026, read 7 and 16 October 2026.
• S.I. 2026/82 and S.I. 2026/1015, commencement regulations made under the Data (Use and Access) Act 2025, for the dates of 19 June and 30 September 2026. legislation.gov.uk, read 7 October 2026.
• European Data Protection Board, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.1, 12 November 2019, section 4.

Last verified 16 October 2026. This page is general information, not legal advice. Whether you need a representative, and how your notice should describe your own processing, depends on your circumstances.