UK GDPR representative
UK GDPR representative for app developers
If your business has no UK establishment and processes personal data in offering an app to people in the UK, through the App Store or Google Play, or in monitoring their behaviour there, UK GDPR applies under Article 3(2), and you must appoint a UK representative unless the exemption in Article 27(2) covers you. Janus Compliance Limited provides that appointment for £349 a year, with no VAT to add, from a registered London office, with correspondence from the ICO and from users forwarded within one working day.
£349 a year. No VAT. Cancel at renewal. Last verified 12 November 2026.
When UK GDPR applies to your app
Article 3(2) UK GDPR reaches a developer with no UK establishment where its processing relates to “the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the United Kingdom” or “the monitoring of their behaviour as far as their behaviour takes place within the United Kingdom”. Where Article 3(2) applies and no exemption is available, Article 27(1) requires the business to “designate in writing a representative in the United Kingdom”.
Deliberately choosing UK distribution, setting prices in pounds and marketing to UK users can show an intention to offer the app in the UK. They are assessed together, and being downloadable from the UK is not enough on its own. These are the situations where it comes up most.
A paid or subscription app sold in the UK storefront
You choose the United Kingdom as a country in App Store Connect or the Google Play Console, set prices in pounds and market to UK users. Article 3(2)(a) covers offering services "irrespective of whether a payment of the data subject is required", so a free app is in the same position.
An app with accounts, support or analytics
Account details and support emails will normally contain personal data. Crash reports and usage analytics may also contain personal data where they relate to identifiable users. Analytics used to track and analyse individual behaviour in the UK can be monitoring under Article 3(2)(b).
A health, finance or education app
Health, financial and children’s data can raise particular risks. The nature, context, scope and purposes of the processing all count when considering the exemption in Article 27(2)(a).
An app that keeps almost everything on the device
Keeping data on the device does not settle the question. What counts is the personal data your business is responsible for, such as support, account, transaction or website processing connected with UK users. Processing that happens regularly in the ordinary course of business is not occasional.
Article 27(2)(a) exempts processing only where it is occasional, does not involve large-scale processing of special category or criminal offence data, and is unlikely to result in a risk to people’s rights and freedoms. The decision guide works through the test question by question.
What you get, and what it costs
- Janus Compliance Limited named as your UK representative under Article 27, with a written designation you can show a store reviewer, a partner or an investor
- A registered London address for the ICO and for UK users, with everything forwarded to you within one working day of reaching us
- A copy of your current record of processing, made available to the ICO on request (Article 30)
- Wording identifying your representative for your privacy notice (Articles 13 and 14)
UK representative
£349
a year. No VAT.
Twelve months, renewed annually, cancel at renewal. The fee covers up to 50 items of correspondence a year, and correspondence from the ICO is never counted. Beyond 50, each further item is £8.
Questions app developers ask
Do Apple or Google act as our representative in the UK?
No. Distributing your app through Apple or Google does not appoint either company as your Article 27 representative, which requires a written designation. Your business is a controller where it decides the purposes and means of the processing; a developer building an app for another organisation may instead be its processor.
Where does the representative appear?
In your privacy notice. Both stores require a link to a privacy policy, and Articles 13(1)(a) and 14(1)(a) UK GDPR require the identity and contact details of your representative, where you have one. We give you the wording when the appointment starts.
Our app keeps data on the device and has no accounts. Do we still need one?
Keeping data on the device does not settle it. Look at the personal data your business does process, such as support, account, transaction or website data connected with UK users. If Article 3(2) applies, the exemption needs all three conditions: the processing is occasional, involves no large-scale special category or criminal offence data, and is unlikely to result in a risk to people. Regular processing in the ordinary course of business is not occasional. If you rely on the exemption, keep a written record of your assessment.
Does appointing a UK representative create a UK branch or a company filing?
Appointing Janus solely as your Article 27 representative does not, by itself, create a UK branch or a Companies House registration requirement. Tax presence depends on your wider activities and arrangements, and the appointment does not decide that question.
We also sell in the EU. Does the UK appointment cover it?
A UK appointment does not meet the EU requirement. If Article 3(2) of the EU GDPR also applies and no exemption applies, you also need an EU appointment. One provider can hold both appointments if it meets both establishment requirements. Our Ireland appointment, at €449 a year, is available where people whose personal data you process are in Ireland.
When does the appointment take effect?
The agreement, a short intake form and the invoice come back within one working day of your enquiry. The appointment starts once the signed agreement and the payment are both in, and we confirm the same day.
Appoint Janus as your UK representative
The agreement, the intake form and the invoice come back within one working day.
Sources, read on 12 November 2026
- UK GDPR, Articles 3, 13, 14, 27 and 30, legislation.gov.uk, revised text.
- EDPB Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), EU guidance used to inform interpretation of the same wording: the factors that show goods or services are offered to people in a country, and the meaning of “occasional” in Article 27(2).
- Apple App Store Review Guidelines, section 5.1.1(i), and Google Play User Data policy, for the privacy policy link each store requires.