Do UK companies still need an EU representative?

The question comes up in an enterprise customer's security questionnaire, in an app store review, or in a data processing agreement sent for signature: who is your Article 27 representative in the Union? For a company in London the instinct is that Brexit ended all of this. It did the opposite.

Why leaving the Union created the obligation

The GDPR reaches beyond the Union through Article 3(2). It applies to a controller or processor with no establishment in the Union where the processing relates to offering goods or services to people in the Union, or to monitoring their behaviour within it. While the United Kingdom was a Member State, a UK company was established in the Union and Article 27 did not apply to it. From the end of the transition period the United Kingdom is a third country, so a UK company with no EU establishment is in exactly the position of a company in New York or Tel Aviv.

Article 27 then requires the controller or processor to designate a representative in the Union, in writing.

Nothing about the company changed. The border moved, and the obligation followed.

The exemption is narrower than it looks

Article 27(2) is where most self-assessments go wrong, because it reads like a small-business exemption and is not one. It applies only where the processing is occasional, does not include on a large scale special category data under Article 9 or criminal conviction data under Article 10, and is unlikely to result in a risk to the rights and freedoms of individuals. The three limbs are cumulative.

A shop that ships to customers in the Union all year, a SaaS product with European users logging in daily, an app whose analytics profile European visitors: none of these is occasional processing. Occasional means what it says.

What the representative is, and what it is not

The representative is the company's point of contact in the Union. It is named in the privacy notice, supervisory authorities and data subjects may address it on all issues related to the processing, and it holds the record of processing activities under Article 30 so that the record can be produced to an authority on request.

It is not a Data Protection Officer. The DPO under Article 37 is an oversight role with independence requirements, and a company can need both. It is also not a liability shield: the obligations remain the controller's.

Article 27(3) requires the representative to be established in one of the Member States where the people whose data is processed are. Where a company serves the whole Union, any Member State qualifies, which makes the choice a practical one about language, responsiveness and who is actually behind the address.

The mirror obligation

The traffic runs both ways. The UK GDPR requires a company established in the Union with no UK establishment, which offers goods or services to people in the United Kingdom or monitors them, to appoint a UK representative. An EU company selling into Britain has the same problem in reverse, and one appointment does not satisfy the other.

What this means in practice

• If the company has no office, branch or subsidiary in the Union and it sells to
• people there, assume Article 27 applies and test the exemption properly rather than
• assuming it fits.
• The appointment must be in writing, and the representative has to be named where
• people can find it: the privacy notice is the usual place, and it is the first
• thing a supervisory authority looks at.
• Keep the Article 30 record with the representative, not only on a drive at head
• office, because the point of the appointment is that something can be produced from
• inside the Union.
• Check whether the mirror UK appointment is also needed. Companies frequently
• discover the second obligation only when a customer asks.

We act as EU representative from Nicosia, at a published fixed annual fee, and the scope and the limits are set out on EU GDPR representative. Where the same company also needs an agent for service of process and an address in the Union, the three are taken together in the Cyprus presence pack.

Sources

• Regulation (EU) 2016/679, the GDPR
• EDPB Guidelines 3/2018 on the territorial scope of the GDPR

This article is provided for general information purposes only and does not constitute legal advice.

Klitos Platis

Advocate, Partner

Kleanthous & Platis LLC, Nicosia · Published 18 August 2026