What Is a UK Representative and Why Do You Need One?

Natacha has held a number of senior roles in the Foreign Office including Deputy Ambassador to China and Director of Economic diplomacy and Emerging Powers. She also has worked on global trade policy and international issues.

Companies that are not based in the UK must adhere to UK privacy laws. They must appoint an official in the UK who will act as their point-of-contact for people who are data subjects and ICO.

What is an UK Representative?

The UK Representative is become a avon representative person, business or other entity that has been authorised by a controller or processor of data to act in their behalf on all matters related to GDPR compliance. They will be the main contact point for any queries from individuals who exercise their rights or requests from supervisory authority. They may also be subject to national requirements that have been implemented due to the GDPR’s extraterritorial scope (see the UK case Rondon against LexisNexis Risk Solutions).

The EU GDPR Article 27 and its UK equivalent Section 3.2.2 of the Data Protection Act 2018, require the appointment of an official representative. This requirement is applicable to all entities that do not have a permanent presence in the United Kingdom but offer goods or services, or observe the actions of those who reside there, or who process personal data. The representative must provide proof of their identity, and also prove that they can be the controller or processor of data in connection with UK GDPR obligations.

The representative must be able to communicate with authorities in the event of a breach. The representative must inform the supervisory authority that appointed them, regardless of whether or not the breach affects individuals in multiple jurisdictions.

It is essential that the representative you choose has experience working with both European and UK authorities for data protection. It is also recommended for them to have local language abilities because they will receive contacts from individuals and data protection agencies in the countries they work in.

The EDPB states that the Representative is accountable for any non-compliance. However the UK case of Rondon v LexisNexis UK Ltd. (2019) EWHC1427 confirmed that a representative can't be sued by a person who believes that the controller of the data has failed to meet the GDPR requirements in the UK. The court ruled that the Representative did not have a direct connection to the data processing activities of the represented entity.

Who is required to appoint the UK Representative?

The EU GDPR mandates that businesses outside of the EU, without an office or branch in the EU that market their goods or services for European citizens must appoint a Representative. This is in addition to requirements from national data protection laws. The role of a Representative is to serve as the local point of contact for individuals and supervisory authorities in relation to GDPR compliance issues.

The UK has its own version to the EU requirement, set out in Article 27 of the UK-GDPR. As with the EU requirement the threshold is not high and any business that offers goods or services to or monitors the behavior of data subjects in the UK must appoint an UK Representative.

In accordance with the UK-GDPR, a representative must be approved in writing by the data subjects or the [British Information Commissioner's office[British Information Commissioner's Office] "to be addressed, additionally or alternatively, on behalf of the controller or processor". They cannot be held personally liable for compliance with the GDPR. They must, however, cooperate with supervisory authorities during official proceedings, and receive messages from those who exercise their rights. ).

Representatives should be based in the EU member state where the individuals whose personal data is being processed reside. This isn't a straightforward decision that requires an in-depth legal and business analysis to determine the most suitable location for a company. We offer a dedicated service that assists businesses to evaluate their needs and select the most suitable representative choice.

It is also recommended that representatives have experience working with supervisory authorities and dealing with requests from data subjects. The ability to communicate in a local language could be crucial, since the role may involve dealing with requests from data subjects or supervisory authorities in multiple countries throughout Europe.

The identity of the representative should be made known to the data subjects through the privacy policies and the information provided before collecting data (see article 13 UK-GDPR). Contact information for the UK Representative should be posted on your website so that supervisory authorities can easily reach them.

When is the best time to appoint the UK Representative?

If your company is located outside the UK offers products or services to people within the UK, or monitors their behaviour, you may need to designate the position of a UK representative. The UK's applied EU GDPR regime applies for non-UK established entities that are performing activities in the UK. It has the same extraterritorial scope as EU GDPR, with limited exceptions. Take our self-assessment for free and determine if you are legally bound by this obligation.

A Representative is mandated by the appointing entity in the terms of a service contract to represent that entity with regard to specific obligations under the UK and EU GDPR as applicable. In the UK the primary purpose of this is to facilitate communication between the party that appointed and the Information Commissioner's Office (ICO) or any data subjects affected in the UK. A Representative could be an individual or a business which is based in the UK. The body that appointed them must inform data subjects that the Representative is processing their personal information and ensure that the identity of the individual or company is readily accessible to supervisory authorities.

The entity that appointed the representative must provide the contact details of its Representative to the ICO and data subjects affected in the UK in accordance with Article 13 as well as 14 of UK GDPR. It is essential to make clear that the job of a Representative is distinct from and incompatible with the role of the role of a Data Protection Officer ("DPO"), which requires a level of independence and autonomy that cannot be provided by a Representative.

If you have to designate a UK representative it is recommended to do it as soon as possible. This is due to the fact that this requirement arises either immediately after Brexit (if it's a "hard" or "no deal" Brexit) or following an implementation period (if it is a "soft" or "with deal". There is no grace period.

What are the requirements for a UK Representative?

According to UK laws on data protection, a representative is a person, or a business who is "designated" in writing by a company that doesn't have a physical presence in the UK, but is still subject to the law. The UK representative is required to be able represent an entity with respect to its legal obligations. Contact details for representatives should also be accessible to UK residents whose personal data are being processed by a non-UK business.

The UK Representative must be an overseas senior member of become a avon representative business or media company, and have been hired and employed as an employee of the media or business entity outside the UK. The visa applicant must intend to serve as the UK representative for the business or media organization full-time and UK Representative must not engage in any other business activities within the UK.

In addition the visa applicant must demonstrate that they possess the required skills and experience to perform their role as UK Representative that includes acting as local point of contact for queries from data subjects and UK authorities for data protection. The UK Representative must possess sufficient knowledge and expertise of UK data protection laws to be competent to respond to requests and enquiries from data protection authorities as well as individuals exercising their rights.

As the Brexit process moves forward and the process continues, it is likely that UK laws on data protection will change in the future. At the moment, it is expected that businesses from outside the UK that conduct business in the UK and handle personal data of individuals within the UK will be required to appoint a UK representative.

This is because article 27 of the GDPR in the United Kingdom that was adopted as a UK national law, requires companies without any presence in the UK to nominate an UK data protection representative. If you are unsure of whether you need to nominate a UK data protection representative It is suggested consult an experienced legal advisor.