Insights / UK Article 27 decision guide
Do I need a UK GDPR Representative?
You are likely to need a UK Representative when your organisation is outside the UK, has no relevant UK establishment and UK GDPR applies because you offer goods or services to people in the UK or monitor their behaviour there — unless an exemption applies.
The ICO’s guidance should be checked at each legal review because UK guidance and legislation can change independently of the EU regime.
Start with four questions
Is the controller or processor based outside the UK?
If it is UK-established, the Representative mechanism is generally not the relevant route for that processing.
Is there a relevant UK establishment?
Identify any UK branch, office, staff, stable arrangement or other presence connected with the processing. A sales agent, group company or service provider is not automatically the relevant establishment for the overseas entity — the relationship between the presence and the processing matters.
Are you offering goods or services, or monitoring behaviour in the UK?
Look for deliberate UK market activity: UK customers, local campaigns, sterling pricing, UK delivery or service availability, UK-specific terms, support or sales arrangements — or tracking, profiling and other observation of behaviour taking place in the UK. Accessibility of a website from the UK is not enough on its own.
Does an exemption apply?
The UK guidance recognises exceptions including public authorities and qualifying occasional low-risk processing. Do not rely on an exemption merely because the organisation is small or has a limited UK customer base — record frequency, sensitive/criminal data, scale, risk and reviewer.
Illustrative outcomes
| Situation | Likely next step |
|---|---|
| EU SaaS provider actively selling to UK customers and profiling UK users, with no UK office | UK GDPR and the Representative requirement are likely to require detailed assessment. |
| US marketplace using UK-targeted advertising and behavioural tracking | Offering and monitoring indicators are present; assess the exemption and appointment. |
| Small overseas supplier with a one-off, low-risk UK transaction | An exemption may be relevant, but it should be documented against the full test. |
| Non-UK company with a UK branch involved in the relevant processing | Assess whether the processing is connected with the UK establishment before using Article 27. |
| Website globally accessible but not directed at the UK and with no UK monitoring | Accessibility alone is not enough; record the facts and monitor for change. |
Outcomes are illustrative assessment steps, not legal determinations for your organisation.
If appointment is required
- Appoint a UK-established Representative in writing.
- Define the entities, services and processing covered.
- Publish the Representative identity and contact details where required.
- Update the rights-request and complaints route.
- Prepare the relevant processing records and internal escalation contacts.
- Test the route and review the position when the business changes.
Document the conclusion
Whether the result is yes, no or uncertain, maintain a decision record with the facts considered, official guidance, reviewer, date and reassessment triggers. The result should be revisited before entering the UK market, adding behavioural monitoring or changing the group structure.
Serving the EU too? See the EU guide — the tests are separate, and one appointment cannot cover both territories. The combined service coordinates the two.
Get a documented answer
The assessment applies these questions to your facts and produces a provisional, documented result before any contact details are requested. For the legal background, see Article 27 Explained.