UK GDPR representative for overseas sellers (Article 27)

To sell to people in the UK from outside it, you need a representative in the UK if the UK GDPR reaches you. It does when you have no establishment in the UK and you offer goods or services to people in the UK, or monitor their behaviour there. A representative in the EU does not fill the role. The designation is registered nowhere: you make it in writing and put the representative’s details in the information you give your customers. This page is only what the UK adds to the GDPR representative rule; the other UK rules are on the United Kingdom page.

The UK needs its own representative, established in the UK

Article 27(1) of the UK GDPR says: where Article 3(2) applies, the controller or processor designates in writing a representative in the United Kingdom (Article 27). Article 3(2) has the same two triggers as the EU one, with people in the UK in place of people in the EU: offering goods or services to them, whether or not they pay, and monitoring their behaviour there. It applies to the “relevant processing” of a controller or processor not established in the UK (Article 3(2) and (2A)). The ICO puts it the same way: the UK GDPR also applies to organisations outside the UK that offer goods or services to people in the UK (ICO).

The representative is “a natural or legal person established in the United Kingdom” (Article 4(17)). An EU representative is established in an EU country, so a seller in both markets has two. The ICO’s own example is a firm in Ireland with no UK office and a regular client base in the UK: it must appoint a UK representative (ICO).

The 30 September 2026 amendment changed a name, not the duty

Article 27 was amended on 30 September 2026, and the amendment is one word. In paragraph 4, “the Commissioner” became “the Commission”. That is the Information Commission, which replaced the Information Commissioner on that day (SI 2026/386, Schedule 3, paragraph 41; SI 2026/1015, regulation 2). Paragraphs 1, 2 and 4 are otherwise as they were, and so is the test for who needs a representative.

Anything done by or against the Commissioner before that date is treated as done by or against the Commission (SI 2026/1015, regulation 3). The ICO’s web pages, including the guidance used here, still use the ICO name.

The exemption is narrow and has no size threshold

Article 27(2) lifts the duty in two cases (Article 27(2)):

• A public authority or body.
• Processing that is occasional. It must also include no large-scale processing of special-category data or of criminal-offence data, and be unlikely to risk people’s rights and freedoms, taking into account its nature, context, scope and purposes. All of it must hold at once.

The UK text sets no turnover, staff or order-count limit. A small business is in the same position as a large one. The ICO’s page gives no definition of “occasional”; it repeats the Article and gives the example of a firm with a regular client base in the UK, which must appoint (ICO). The EU guide sets out how the European Data Protection Board reads “occasional”; that is EU guidance, not UK.

Appoint it in writing and put its details in your notices

The ICO’s steps for a UK representative (ICO):

1. Choose a person, company or organisation established in the UK, such as a law firm, consultancy or private company, able to represent you for your UK GDPR obligations.
2. Authorise it in writing to act on your behalf on your UK GDPR compliance and to deal with the ICO and the people whose information you process. A simple service contract will do.
3. Give its details to people in the UK whose data you process, for example in your privacy notice or when you collect their data. The UK GDPR requires the identity and contact details of the controller’s representative, where there is one, in the information given to people (Article 13(1)(a), Article 14(1)(a)).
4. Make the details easy for the ICO to find, for example on your website. You do not register or notify the designation.

The representative also keeps the record of processing activities with you (Article 30(1)). Appointing one does not move your own responsibility: Article 27(5) leaves action against you open, and the ICO says the same.

The law sets no fee for a representative and no deadline for the designation. The price is whatever you agree with the provider.

The ICO data protection fee is a separate payment

The data protection fee is paid every year by data controllers under the Data Protection (Charges and Information) Regulations 2018, unless all their processing is exempt. The amounts are £52, £78 or £3,763 depending on turnover and number of staff, and £5 less by direct debit (regulation 3; the ICO sets it out on its fee page). Since 30 September 2026 it is paid to the Information Commission; the Regulations on legislation.gov.uk still read “Information Commissioner” until the change in SI 2026/386, Schedule 3, paragraph 23 is applied to the text.

On the words of the Act, a business outside the UK that falls under Article 3(2) is a controller who pays it, unless an exemption applies. The chain is short:

1. The Regulations define a “data controller” as a controller for Parts 5 to 7 of the Data Protection Act 2018 (regulation 1(2)).
2. The Act reads a controller in those Parts as a controller in relation to processing to which the UK GDPR applies (section 3(14)(d)).
3. The Act covers the processing the UK GDPR reaches by virtue of Article 3, and Article 3(2) is one of those routes (section 207(1A)).

The ICO says: “If you are a controller and the exemptions don’t apply to you, you will have to pay the fee” (ICO fee FAQs). Not paying can bring a fine of up to £4,350, which is 150% of the top-tier fee (same FAQs). No ICO page states how it treats controllers with no UK establishment. The Regulations only say which address to give: a registered company gives its registered office and any other business its principal place of business in the UK (regulation 2(5)).

The fee is not part of Article 27. Having a representative does not pay it or exempt you from it.

What happens if you do nothing

Without a representative, a business that falls under Article 3(2) and is not exempt breaches Article 27. The Commission can give an enforcement notice for a failure to comply with Articles 25 to 39, which includes Article 27 (Data Protection Act 2018, section 149(2)(c)), and a penalty notice (section 155). The fine is up to £8,700,000 or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a), section 157(1)(a)). In setting a penalty the Commission has regard to the nature, gravity and duration of the failure, whether it was intentional or negligent, and the steps taken to put it right (Article 83(2)).

What does not apply here

• An EU representative as your UK one. The role must be held by a person established in the UK (Article 4(17)).
• A registration or notification of the representative. The ICO names no register for representatives.
• The product-safety responsible person. That is separate law, covered in EU authorised representative for the EU. For the UK, see the United Kingdom page.