Brexit and the Double Rep: Do You Need a Representative in Both the UK and EU?

Do You Need a UK and EU Representative? The Short Answer

If your company is established outside the UK but processes personal data of individuals in the UK, you must appoint a UK representative under the UK GDPR. Similarly, if you're outside the EU but process data of individuals in the EU, you need an EU representative under the EU GDPR. So yes, many businesses need both.

The Brexit Data Protection Mess

Brexit didn't just create border queues; it created a data protection headache. Before Brexit, the UK was part of the EU, so one representative could cover both. Now, the UK and EU have separate GDPR regimes. Think of it like having two landlords: you need to pay rent to both, not just one.

Who Needs a UK Representative?

You need a UK representative if you're a data controller or processor not established in the UK, but you process personal data of individuals in the UK. This applies even if you only offer goods or services to UK residents or monitor their behavior. The representative must be a person or organization in the UK, and their role is to be the point of contact for UK data subjects and the ICO.

Who Needs an EU Representative?

Similarly, under Article 27 of the EU GDPR, if you're not established in the EU but process data of individuals in the EU, you need an EU representative. This representative must be in an EU member state where the data subjects are located. If you process data across multiple EU countries, you can choose one representative, but they must be able to handle inquiries from any EU data protection authority.

Can One Representative Cover Both?

No. The UK and EU are separate jurisdictions. You need a separate representative in each. However, some companies offer services to act as both, but they must have a physical presence in both the UK and an EU member state. It's like having a lawyer in two different countries—they can't be in two places at once.

What Does the Representative Do?

The representative is your local point of contact for data subjects and regulators. They must maintain records of processing activities and cooperate with supervisory authorities. They can be held liable for non-compliance, so choose wisely. It's not a ceremonial role; it's a legal obligation.

Penalties for Not Appointing a Representative

Failing to appoint a representative can result in fines up to €10 million or 2% of annual global turnover, whichever is higher under the EU GDPR. Under UK GDPR, fines are up to £17.5 million or 4% of annual global turnover. Plus, you risk enforcement actions and reputational damage. So, it's not worth the gamble.

How to Choose a Representative

Look for a reputable service provider with expertise in data protection. They should be based in the UK (for UK rep) and in an EU member state (for EU rep). Some law firms and consultancies offer these services. Ensure they have a physical address and are available during business hours. You can also appoint an internal employee if you have an office in the relevant jurisdiction.

Featured Snippet Bait: Do I need a UK GDPR representative if I have an EU representative?

No, a UK GDPR representative is separate from an EU representative. If you process data of individuals in both the UK and EU, you must appoint a representative in each jurisdiction. One cannot serve both due to different legal regimes.

Practical Steps

• Assess whether you process personal data of individuals in the UK or EU.
• If yes, and you're not established there, appoint a representative in each jurisdiction.
• Update your privacy notice to include the representative's contact details.
• Ensure your representative has access to your data processing records.

FAQ