EU representative for UK companies.
All 27 states.

Who in the UK is in scope of GDPR Article 27

Since the end of the Brexit transition period on 31 December 2020, a company established only in the United Kingdom is, for the EU, a company outside the Union. The EU GDPR still reaches it through Article 3(2) when its processing relates to one of two activities:

• Offering goods or services to people in the EU, whether or not they pay. Recital 23 asks whether you envisage offering goods or services to people in one or more member states. It names two signals: using a language or currency of a member state with the possibility of ordering in that language, and mentioning customers or users in the EU. A website or email address that people in Europe can reach is not enough on its own. The EDPB’s Guidelines 3/2018 on territorial scope add further factors, such as offering delivery of goods to EU member states and marketing campaigns aimed at an EU audience.
• Monitoring the behaviour of people in the EU, as far as that behaviour takes place in the Union. Recital 24 refers to tracking people on the internet, including profiling to analyse or predict their preferences. The EDPB’s guidelines give behavioural advertising, geo-localisation for marketing purposes and online tracking through cookies or similar techniques as examples; whether analytics counts as monitoring depends on its purpose, in particular any later profiling.

A UK company caught by either test must designate a representative established in the EU under Article 27(1). This is true even if it has no staff, office or bank account in the EU. A UK group with an EU subsidiary needs to check how the processing relates to the EU entity. Processing in the context of the activities of an EU establishment falls under Article 3(1), and that can include processing by the UK parent if it is inextricably linked to the EU establishment’s activities. UK processing that is not so linked, and that targets or monitors people in the EU, can still fall under Article 3(2).

The exemption is narrow. For a private company, the exemption in Article 27(2)(a) covers only processing that is occasional, does not include large-scale processing of special-category or criminal-offence data, and is unlikely to result in a risk to people’s rights and freedoms. Article 27(2)(b) separately exempts public authorities and bodies. A business that sells to EU customers as a regular part of its model is rarely “occasional”.

Typical UK companies that need an EU representative

The pattern is the same across sectors: an ordinary part of the business is aimed at people in the EU.

• An online shop in Manchester that ships to Ireland, France and Germany and shows prices in euros.
• A London SaaS company that sells self-serve subscriptions to freelancers and consumers in the EU, priced in euros, and handles their account and billing data itself.
• A mobile app offered to users in EU countries in their own languages that uses advertising identifiers to profile them for targeted advertising.
• A marketing agency that, for clients outside the EU, runs campaigns aimed at EU audiences and builds behavioural audience profiles for them.

A UK business-to-business supplier that only deals with EU companies still processes the personal data of the people it deals with there: contacts, users and account holders. Selling only to businesses does not by itself take a company outside the GDPR. Neither the GDPR nor the EDPB expressly settles whether a B2B offer counts as offering services to people in the EU under Article 3(2)(a), so the cautious approach is to treat it as in scope; monitoring of EU users under Article 3(2)(b) applies regardless.

Where the company is the controller, its privacy notice must show the representative’s identity and contact details under Articles 13(1)(a) and 14(1)(a).

UK GDPR and EU GDPR: two separate representative duties

The United Kingdom kept the GDPR in its own law as the UK GDPR, alongside the Data Protection Act 2018. The UK GDPR has its own territorial rule and its own Article 27. A company with no establishment in the UK that offers goods or services to people in the UK, or monitors their behaviour in the UK, must designate in writing a representative in the UK. The exceptions are those in Article 27(2) of the UK GDPR: occasional, low-risk processing, and public authorities. The Information Commissioner’s Office explains both directions in its guidance on receiving personal information from the EEA.

The two duties run in opposite directions:

• A UK company serving EU customers needs an EU representative under the EU GDPR.
• An EU or US company serving UK customers may need a UK representative under the UK GDPR.

A company serving both markets from outside them can need both. An EU representative does not satisfy the UK requirement, and a UK representative does not satisfy Article 27 of the EU GDPR, because each must be established in the territory it covers. rep4eu acts as the EU representative; a UK representative is a separate appointment.

The EU’s adequacy decision for the United Kingdom does not change any of this. The decision was first adopted on 28 June 2021, and the European Commission renewed it on 19 December 2025 to apply until 27 December 2031. Adequacy lets personal data flow from the EU to the UK without extra transfer safeguards. It is a finding about transfers, not one of the exemptions in Article 27(2), so UK companies within Article 3(2) still need a representative.