UK GDPR Article 27 in plain English

The rule

Where Article 3(2) UK GDPR applies to a controller or processor with no UK establishment, Article 27 requires a written designation of a representative in the UK, unless an exemption applies.

When Article 3(2) may apply

• The organisation offers goods or services to individuals in the UK, whether or not payment is required. Deliberate UK targeting matters. Website accessibility alone is not enough.
• Or it monitors the behaviour of individuals while they are in the UK, for example through tracking or profiling.

Exemptions

• Public authorities and public bodies.
• Processing that is occasional, does not include large-scale special-category or criminal-offence data, and is unlikely to result in a risk to rights and freedoms. All three parts must be met.

What a representative does

It is a UK point of contact for the ICO and individuals, with access to your processing records. It does not take over your compliance duties.

Assess activity by activity

Exemptions should be considered for each processing activity or coherent group of activities. One occasional or low-risk activity does not exempt the organisation as a whole.