UK GDPR representative
UK GDPR representative for US companies
If your company has no UK establishment and processes personal data in offering goods or services to people in the UK, or in monitoring their behaviour there, UK GDPR applies under Article 3(2), and you must appoint a UK representative unless the exemption in Article 27(2) covers you. Janus Compliance Limited provides that appointment for £349 a year, with no VAT to add, from a registered London office, with correspondence from the ICO and from individuals forwarded within one working day.
£349 a year. No VAT. Cancel at renewal. Last verified 13 November 2026.
When UK GDPR applies to a US company
Article 3(2) UK GDPR reaches a company with no UK establishment where its processing relates to “the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the United Kingdom” or “the monitoring of their behaviour as far as their behaviour takes place within the United Kingdom”. Where Article 3(2) applies and no exemption is available, Article 27(1) requires the business to “designate in writing a representative in the United Kingdom”.
A UK subsidiary, branch or office can constitute an establishment of your US company where it carries on real and effective activity through stable arrangements. Article 3(1) applies to personal data processing in the context of that establishment’s activities, and no Article 27 representative is required for that processing. The assessment depends on the actual arrangements and the processing concerned. Where there is no establishment, the question is whether you are offering goods or services to people in the UK or monitoring their behaviour there. These are the situations where it comes up most.
An online store that ships to the UK
You accept orders from UK addresses, show prices in pounds or offer UK delivery, and hold customers’ names, addresses and order histories. Article 3(2)(a) covers offering goods or services "irrespective of whether a payment of the data subject is required".
A software service with users in the UK
Where you offer the service to people in the UK and determine why and how their account, billing or usage data is processed, you are a controller of that data and Article 3(2)(a) can apply. Where you process personal data only on behalf of business customers, you may be their processor, and Article 27(1) also applies to a processor whose processing falls within Article 3(2).
An app or an AI product available to people in the UK
Deliberately choosing UK distribution, pricing in pounds and marketing to UK users can show an intention to offer the product in the UK. Analytics used to track and analyse individual behaviour in the UK can be monitoring under Article 3(2)(b).
A website that people in the UK can simply reach
Being accessible from the UK is not enough on its own. The factors are assessed together when deciding whether goods or services are offered to people in the UK under Article 3(2)(a). A site aimed only at US customers may fall outside that provision, but processing related to monitoring people’s behaviour in the UK can still fall within Article 3(2)(b).
Article 27(2)(a) exempts processing only where it is occasional, does not involve large-scale processing of special category or criminal offence data, and is unlikely to result in a risk to people’s rights and freedoms. The decision guide works through the test question by question.
What you get, and what it costs
- Janus Compliance Limited named as your UK representative under Article 27, with a written designation you can show a customer, a partner or an investor
- A registered London address for the ICO and for people in the UK, with everything forwarded to you within one working day of reaching us
- A copy of your current record of processing, made available to the ICO on request (Article 30)
- Wording identifying your representative for your privacy notice (Articles 13 and 14)
UK representative
£349
a year. No VAT.
Twelve months, renewed annually, cancel at renewal. The fee covers up to 50 items of correspondence a year, and correspondence from the ICO is never counted. Beyond 50, each further item is £8.
Questions US companies ask
We are certified under the Data Privacy Framework with the UK Extension. Do we still need a UK representative?
Yes, if Article 3(2) applies and no exemption is available. Under regulation 3 of the Data Protection (Adequacy) (United States of America) Regulations 2023, adequacy covers transfers to a US organisation listed as participating in the UK Extension where the transferred data will be subject to the Data Privacy Framework Principles on receipt. Article 27 is a separate requirement, and the regulations do not mention it. Its exemptions are the ones in Article 27(2).
We already have an EU representative. Does that cover the UK?
An EU appointment does not meet the UK requirement, because Article 27(1) UK GDPR requires a representative in the United Kingdom. One provider can hold both appointments if it meets both establishment requirements. Our Ireland appointment, at €449 a year, is available where people whose personal data you process are in Ireland.
Can our US privacy counsel or registered agent be the representative?
Only if they are established in the UK. Article 27(1) requires a representative in the United Kingdom, designated in writing, and Article 27(4) requires the representative to be mandated to be addressed by the ICO and by individuals on all issues related to the processing.
Does appointing a UK representative create a UK branch or a company filing?
Appointing Janus solely as your Article 27 representative does not, by itself, create a UK branch or a Companies House registration requirement. Tax presence depends on your wider activities and arrangements, and the appointment does not decide that question.
Does the representative take on our liability?
Article 27(5) UK GDPR says the designation of a representative is without prejudice to legal actions which could be initiated against the controller or the processor themselves. The representative answers for its own duties, and your company remains responsible for its own compliance.
When does the appointment take effect?
The agreement, a short intake form and the invoice come back within one working day of your enquiry. The appointment starts once the signed agreement and the payment are both in, and we confirm the same day.
Appoint Janus as your UK representative
The agreement, the intake form and the invoice come back within one working day.
Sources, read on 13 November 2026
- UK GDPR, Articles 3, 4(17), 13, 14, 27 and 30, legislation.gov.uk, revised text.
- EDPB Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), EU guidance used to inform interpretation of the same wording: the factors that show goods or services are offered to people in a country, and the meaning of “occasional” in Article 27(2).
- The Data Protection (Adequacy) (United States of America) Regulations 2023, regulation 3, legislation.gov.uk: the transfers covered by the UK Extension to the EU-US Data Privacy Framework.