What Is a UK Representative and Why Do You Need One?

Natacha has served in several senior positions within the Foreign Office, including as the Deputy Ambassador for China and Director responsible for Economic Diplomacy and Emerging Powers. She has also been involved in global trade policy and international issues.

Companies that are located outside of the UK are obliged to comply with UK privacy legislation. They must appoint a representative in the UK to serve as their point of contact for data subjects as well as the ICO.

What is an UK representative?

The UK Representative is an individual, a company or organisation mandated in writing by a processor or controller of data to act on behalf of the controller or processor Uk Representative regarding all matters around GDPR compliance. They will be the primary contact point for inquiries from individuals exercising their rights, or for requests from supervisory authorities. They may also be subject to national regulations that were enacted in light of the GDPR's extraterritorial scope (see the UK case Rondon v LexisNexis Risk Solutions).

The appointment of a Representative is required under Article 27 of the EU GDPR, as well as the UK equivalent section 3(2) of the Data Protection Act 2018. The requirement applies to any organization that does not have a separate establishment within the United Kingdom and that offers products or services to or monitors the behaviour of individuals residing in the United Kingdom, or that processes personal data of such individuals. The representative must be able to provide proof of their identity as well as that they are capable of representing the data controller or processor in relation to the UK GDPR's requirements.

The Representative must be able to communicate with authorities if there's an incident. The Representative must notify the supervisory authority who appointed them, regardless of whether or not the breach affects data subjects in multiple jurisdictions.

It is essential that the representative you select has worked with both European and UK authorities for data protection. It is also recommended to are fluent in the local language since they will receive calls from both individuals and data protection authorities in the countries where they operate.

While the EDPB states that the Representative should be held liable in the event of non-compliance the UK court case of Rondon v LexisNexis UK Ltd (2019) EWHC 1427 has confirmed that a Representative cannot be sued by a person for the data controller's apparent failure to adhere to the UK GDPR. The court concluded that the Representative was not in direct connection with the processing of data by the represented entity.

Who needs to appoint the UK Representative?

In order to comply with the EU GDPR, companies outside of the EU that are targeting goods or services for European citizens, but do not have a branch, office or establishment in the EU must appoint an EU Representative. This is in addition to the requirements from national data protection laws. The role of a representative is to be a local point-of-contact for individuals and supervisory bodies regarding GDPR concerns.

The UK has its own equivalent to the EU requirement, which is set out in Article 27 of the UK-GDPR. Similar to the EU requirement the threshold is lower: any organisation that offers goods or services to or monitors the behavior of data subjects in the UK must appoint a UK Representative.

Under the UK-GDPR, a Representative must be appointed in writing "to be addressed, in addition or alternatively, addressed on behalf of the controller or processor, by data subjects and the British Information Commissioner's Office]". They are not able to be personally accountable for the GDPR's compliance. They must, however, cooperate with supervisory authorities in formal proceedings, and receive notifications from individuals who exercise their rights. ).

Representatives should be located in the state of the European Union in which the individuals whose personal data is processed are residents. This is not an easy decision and requires a thorough business and legal analysis to determine the best location for an organisation. We provide a service that helps organisations assess their needs and choose the most appropriate representative location.

It is also recommended that representatives have experience working with both supervisory authority and dealing with inquiries from data subjects. Language skills in the local avon representative area are often of importance as the job is likely to be involving dealing with requests from data subjects or supervisory authorities in multiple countries across Europe.

The identity of the representative must be disclosed to individuals who are the data subjects via privacy policies and information provided before collecting data (see article 13 UK-GDPR). The UK Representative's contact details should also be made available on your website, giving the authorities in charge of supervision easy access to contact them.

When do you have to nominate a UK Representative?

If your business is based outside the UK, offers products or services to people who reside in the UK, or monitors their behaviour and conducts surveillance, you may have to designate an UK representative. The UK's Applied GDPR system applies to established companies outside the UK that are conducting business in the UK and has the same extraterritorial scope as the EU GDPR (with certain exceptions). You can take our no-cost self-assessment to see whether you are subject to this obligation.

A representative is authorised by the appointing entity under a service contract to act on behalf of the entity in relation to certain of its obligations under UK and EU GDPR as applicable. In the UK the primary purpose of this would be to facilitate communication between the appointing entity and the Information Commissioner's Office (ICO) or any data subjects affected in the UK. A Representative can be either an individual or a company that is established in the UK. The body that appoints them must inform the subjects of data that the representative will be processing their personal information and ensure that the identity of the person or company is readily accessible to supervisory authorities.

The entity that appointed the representative must provide the contact information of its representative to ICO and data subjects affected in the UK in conformity with Article 13 and 14 of UK GDPR. It is essential to clarify that a representative's role is distinct from the one of the role of a Data Protection Officer (DPO) that requires a certain degree of autonomy and independence that is not possible for a representative.

If you are required to designate a UK representative it is recommended to do so as quickly as possible. This is because the requirement arises immediately after Brexit (if there is an 'hard' or 'no deal' Brexit) or after an implementation period (if there is a'soft' or "with deal" Brexit). There is no grace period.

What are the requirements to be a UK representative?

According to UK data protection laws the definition of a representative is a person or a company who is "designated" in writing by an entity which has no physical presence in the UK however is subject to the law. The UK representative has to be able to represent the entity in compliance with its obligations under the law, and their contact details must be readily available to individuals within the UK who have personal data being processed by the non-UK business.

The UK Representative must be an overseas senior member of become a representative media or business organization and have been hired and employed as an employee by the media or business organization outside the UK. The visa applicant must plan to serve as the UK representative of the business or media organization full-time and not engage in other business activities in the UK.

The applicant for visas also has to demonstrate that they have the skills and experience necessary to fulfill their role as UK representative, which includes serving as the local contact point for data subjects and UK authorities for data protection. The UK Representative must possess sufficient knowledge and understanding of UK data protection laws to be able to respond to any inquiries and requests from data protection authorities and individuals exercising their rights.

As the Brexit process continues it is likely that the UK laws on data protection will change as time passes. However, at the moment it is expected that non-UK businesses that do business in the UK and handle personal data of people in the UK will need to appoint an official from the UK representative.

This is because the UK GDPR requires that entities that do not have a UK presence must appoint a representative in accordance with article 27 of the UK GDPR, which has been retained as a national law in the UK. If you're not sure whether you should designate an UK data protection representative, it is recommended consult an experienced lawyer.