What Is a UK Representative and Why Do You Need One?

Natacha has held a number senior positions at the Foreign Office, including as Deputy Ambassador for China and Director for Economic Diplomacy and Emerging Powers. She also has worked on global trade policy and international issues.

Businesses located outside the UK are obliged to comply with UK privacy legislation. They must appoint a Representative in the UK to act as their point of contact for data subjects, as well as the ICO.

What is a UK Representative?

The UK Representative is an individual, company or organisation that is formally mandated by a processor or controller of data to act on their behalf in all matters around GDPR compliance. They will be the primary contact for any queries from individuals exercising their rights, or for requests from supervisory authorities. They could also be subject to national requirements that have been enacted in the context of GDPR's extraterritorial scope (see the UK case Rondon v LexisNexis Risk Solutions).

The appointment of Representatives is required by Article 27 of the EU GDPR, and the UK equivalent, Section 3(2) of the Data Protection Act 2018. The requirement applies to any organization that does not have its own establishment within the United Kingdom and that offers products or services to or monitors the behaviour of individuals residing in the United Kingdom, or that manages personal data of those individuals. The Representative must be able prove their identity, and also prove that they can represent the controller or processor of data in relation to UK GDPR requirements.

The Representative should also be able communicate with authorities in the event of a breach. This is because the Representative needs to submit a notification to the supervisory authority who appointed them regardless of whether the breach affects data subjects across multiple jurisdictions.

It is essential that the representative you choose has experience working with both European and UK data protection authorities. It is also desirable that they have a local language proficiency since they will receive contacts from both individuals and data protection authorities in the countries where they operate.

While the EDPB states that the Representative should be held accountable in the event of non-compliance, the UK court case of Rondon v LexisNexis UK Ltd (2019) EWHC 1427 has confirmed that a Representative can't be sued by an individual for the apparent failure to adhere to the UK GDPR. This is due to the fact that, according to the court the Representative does not have a direct connection to the data processing activities carried out by the entity that is represented.

Who is responsible for appointing the UK Representative?

The EU GDPR mandates that businesses outside of the EU, without an office, branch or establishment in the EU that market their products or services to European citizens must appoint a Representative. This is in addition to the requirements of the national data protection laws. The role of a Representative is to be an individual point of contact for individuals and supervisory authorities regarding GDPR compliance issues.

The UK has its own version to the EU requirement, set out in Article 27 of the UK-GDPR. Like the EU requirement the threshold is not high and any business that offers goods or services to or monitors the behavior of data subjects within the UK must choose a UK Representative.

Under the UK-GDPR, a Representative must be appointed in writing "to be additionally or alternatively, addressed on behalf of the controller or processor by data subjects and the British Information Commissioner's Office[British Information Commissioner's Office]". They cannot be held personally accountable for GDPR compliance. They must however cooperate with supervisory authorities in official proceedings, and receive messages from those who exercise their rights. ).

sale representatives must be situated within the EU member state in which the individuals whose data are processed are. In most cases this is not a straightforward decision to make. A careful analysis of the legal and business context is required to assess the location(s) most suitable for an organisation. We provide a service that assists businesses to evaluate their needs and select the most suitable representative choice.

It is also advisable that representatives have experience dealing with supervisory authorities and wol.co.kr dealing with data subject requests. Local language skills can also be crucial, since the role may involve dealing with inquiries by data subjects or supervisory authorities in a variety of countries across Europe.

The identity of the representative must be made known to the individuals who are the data subjects via privacy policies and information provided before collecting data (see article 13 in the UK-GDPR). The UK Representative's contact information should also be made available on your website, giving an easy way for supervisory authorities to contact them.

When do you need to appoint a UK Representative?

If your company is located outside the UK provides goods or services to individuals within the UK, or monitors their behaviour it is possible to appoint a UK Representative. The UK's Applied GDPR system applies to non-UK established entities who are carrying out activities in the UK and has the same scope of extraterritorial application as EU GDPR (with limited exceptions). Take our free self-assessment and see if you are subject to this obligation.

A representative is appointed by the party appointing under a contract of service to act for that party with respect to certain obligations under UK GDPR and EU GDPR, as applicable. In the UK this would typically involve facilitating communications between the entity that appointed the representative and the Information Commissioner's Office or any individuals affected by the UK. A Representative could be an individual or a company with a UK base. The body that appointed them must inform the subjects of data that the Representative will be processing their personal data and that the identity of the individual or business is readily available to supervisory authorities.

In accordance with Articles 13 and 14 of the UK GDPR the entity that is appointed as the representative is also required to provide the contact information of its representative to the ICO as well as the data subjects in the UK. It is essential to make clear that the job of a Representative is distinct from and not compatible with the duties of a Data Protection Officer ("DPO") which requires a certain degree of independence and autonomy that cannot be provided by a representative.

If you have to appoint a UK representative and you are required to do so, you must do it as soon as you can. This is because the obligation is either immediately following Brexit (if it's a "hard" or "no deal" Brexit) or following an implementation period (if it's a "soft" or a "with deal". There is no grace period.

What are the requirements for the designation of a UK Representative?

According to UK data protection laws the definition of a representative is a person, or a business who is "designated" in writing by an entity that does not have a physical presence in the UK but is subject to the law. The UK representative should be able to represent an entity with respect to its obligations under law. The contact information of the representative should be readily available to UK residents whose personal information are being processed by a non-UK business.

The UK Representative must be an overseas senior employee of a business or media company, and have been hired and employed as an employee of the business or media organization outside the UK. The visa applicant must genuinely intend to be employed full-time as the UK Representative for the business or media company, and are not allowed to engage in any other business ventures in the UK.

Additionally the visa applicant must demonstrate that they possess the required skills and experience to fulfill their duties as UK Representative, which will include acting as local contact for inquiries from data subjects as well as the UK authorities for data protection. The UK Representative must possess sufficient knowledge and expertise of UK laws regarding data protection to be competent to respond to queries or requests from data protection authorities and individuals exercising their rights.

As the Brexit process progresses it is likely that the UK data protection laws are going to change as time passes. However, at present it is expected for non-UK companies that do business in the UK and handle personal data of individuals in the UK, to appoint UK representatives.

It is because article 27 of the UK's GDPR, which was retained as an UK national law, requires companies without any presence in the UK to nominate an UK representative for data protection. If you are unsure of whether you should appoint the position of a UK representative for data protection, it is recommended that you speak to an experienced legal adviser.