UK GDPR Representative
for Organisations Outside the UK

A controller or processor without a relevant UK establishment generally needs a UK representative where its relevant processing falls within Article 3(2): offering goods or services to people in the UK, whether or not payment is required, or monitoring their behaviour where it takes place in the UK. Article 27 requires a written appointment unless an Article 27(2) exemption applies.

No. Being outside the UK is not enough. The organisation's processing must fall within the relevant territorial scope of Article 3(2), and the Article 27 exemption must be considered. This applies to organisations in the EU, the United States and elsewhere on the same statutory basis.

Yes, potentially. Article 27 expressly covers both controllers and processors. A processor, including a SaaS or other service provider, needs an assessment of its own relevant processing and territorial position. Its customer's location alone does not settle that assessment.

No. UK customers may be relevant evidence, but the assessment concerns intentional offering or monitoring and the organisation's actual processing under Article 3(2). The establishment position and any Article 27 exemption must also be considered.

Not by itself. Mere accessibility does not establish intentional UK targeting. UK-facing marketing, a UK-specific offering and other evidence of intended goods or services provision may be relevant. Monitoring activity requires its own assessment.

All three processing conditions must be satisfied: the processing is occasional; it does not include large-scale processing of special-category or criminal-conviction and offence data; and it is unlikely to result in a risk to individuals' rights and freedoms, taking account of its nature, context, scope and purposes. Public authorities or bodies have a separate exemption under Article 27(2)(b). There is no general company-size exemption.

The representative is appointed in writing and can be addressed by the Information Commissioner and data subjects in addition to or instead of the controller or processor on processing-related compliance issues. Its role includes the UK contact interface, escalation, Article 30 representative records where applicable and Article 31 cooperation. Substantive privacy implementation is separately scoped.

No. Article 27(5) preserves legal action against the controller or processor itself. The represented organisation remains responsible for its underlying processing and compliance decisions. The representative does not replace the controller or processor.

No. A representative provides the statutory UK interface under Articles 3 and 27. A DPO performs a governance, advice and monitoring role where required under Article 37 or voluntarily appointed, with specific independence requirements. Neither appointment automatically satisfies the other role.

Potentially, where both territorial regimes apply and the organisation lacks the relevant establishments. A UK appointment does not satisfy EU Article 27, and an EU appointment does not satisfy UK Article 27. UK GDPR Representative services are provided by PRIVACY MINDERS (UK) LIMITED; EU GDPR Representative services are provided by OSTRAI Limited. The mandates remain separate.