Frequently asked questions

A representative is a person or organisation established in the UK that an overseas controller or processor designates in writing, so that the ICO and individuals in the UK have a point of contact for matters relating to the processing. It is a communication and record-access role. It does not replace the organisation's own responsibilities.

Generally, an organisation that has no UK establishment but is subject to UK GDPR because it offers goods or services to individuals in the UK or monitors their behaviour in the UK, unless an exemption applies. The assessment depends on the facts, so use the eligibility check and, for anything borderline, take legal advice.

Often, yes, if UK GDPR applies to it through Article 3(2) and no exemption applies. An EU representative does not satisfy the UK requirement, and a UK representative does not satisfy the EU one. Each depends on the organisation's own facts.

The test is the same for every overseas organisation: whether UK GDPR applies to the relevant processing under Article 3(2) and whether an exemption applies. Being a US company does not by itself decide the answer either way.

Possibly. An online retailer that deliberately targets UK customers, for example with UK delivery, pricing in pounds or UK-directed marketing, may be offering goods to individuals in the UK. Whether a representative is needed depends on the facts and on whether an exemption applies.

No. A website being accessible from the UK is not enough on its own. The question is whether the organisation intentionally offers goods or services to individuals in the UK, or monitors their behaviour in the UK.

Article 27(2) removes the duty for public authorities and bodies, and for processing that is occasional, does not include large-scale processing of special-category or criminal-offence data, and is unlikely to result in a risk to individuals' rights and freedoms. All parts of the processing exemption must be met, and the risk conclusion should be supported by an assessment.

Potentially, yes, subject to screening, our onboarding and risk review, and a written appointment signed by both parties. No appointment is effective until those conditions are met.

No. LeadAI Limited is an AI governance and compliance consultancy. The representative service is not legal advice or a general legal retainer. Where legal advice is needed, it is provided separately by a suitably qualified professional.

No. A representative is a point of contact for the ICO and individuals for an overseas organisation's UK-facing processing. A data protection officer is an internal or outsourced role with advisory and monitoring duties. The two are separate and a representative appointment does not make LeadAI your DPO.

No. The appointment does not transfer your responsibility for lawful processing, privacy notices, individual rights, security or transfers. It also does not guarantee regulatory approval, certification or protection from enforcement.

Correspondence is logged, assessed for urgency and forwarded to your nominated contacts through the agreed secure channel. ICO correspondence is never ignored or dismissed, and receipt by the representative does not extend any statutory deadline. Detailed response drafting is separate unless agreed in writing.

We give you the representative's name and contact details and instructions for where to include them, typically in your UK privacy notice and wherever else the law requires. You are responsible for publishing and keeping them correct.

You supply the applicable Article 30 records, or we provide structured templates and administrative help (some on higher plans or as additional services). You remain responsible for their accuracy and completeness, and we may ask for missing information.

It depends on how quickly screening, information and signatures are completed. We do not promise a fixed timescale. The appointment only becomes effective once the written agreement is signed, we have accepted you after review, the required information has been supplied and any agreed payment condition is satisfied.

The draft agreement provides for an orderly end: we confirm the termination date, you remove or replace our details in your notices, you arrange replacement representation without undue delay, and we cooperate on a reasonable transfer of records. The final terms are subject to legal review.

No. This service covers UK GDPR only. It does not appoint LeadAI as an EU or EEA representative under the EU GDPR.

See the pricing page for the full lists. In short: Essential covers designation, contact details, onboarding, records and correspondence forwarding. Professional adds guided records and a dashboard. Assurance adds quarterly reviews, a risk register and an inventory. Prices are proposed and subject to confirmation.

Each item is logged, assessed and forwarded within the service levels in the agreement, with a record that it was sent. Plans include an allowance of routine non-ICO items. ICO correspondence is never refused because an allowance has been reached.

Documents will be held with access limited to authorised people, encrypted storage and an audit trail. These controls are part of the service build and will be described in the final terms and privacy notice before the service opens. Nothing is uploaded through this website today.