UK representative

Why do you need to appoint a UK representative?

Firstly, many businesses outside the UK are surprised to learn that the General Data Protection Regulation (UK GDPR) may also apply to them, not just UK companies.

Article 3 (2) of UK GDPR sets out that GDPR applies to data controllers or processors not established in the United Kingdom when they are processing personal data of data subjects who are in the UK, and the processing activities relate to:

• a) the offering of goods or services, irrespective of whether a payment of the data subject is required; or
• b) the monitoring of their behaviour as far as their behaviour takes place within the UK.

If your business is outside the UK and you do either of these, then UK GDPR applies to you.

Secondly, Article 27 UK GDPR requires the appointment of an UK representative for businesses not established in the United Kingdom.

Article 27 (1) requires that data controllers or processors not established in the United Kingdom, which UK GDPR applies to, shall designate a representative in the United Kingdom.

Thirdly, UK GDPR is a significant regulatory compliance risk to your business.

With fines of up to £10,000,000 or 2% of total revenue (whichever is greater) non-compliance represents a significant financial risk to your business, and should not be ignored.

To summarise:

If your business is outside the United Kingdom and you offer goods or services to UK residents, or monitor UK residents behaviour (e.g. web analytics) then you more than likely are required to appoint a UK representative. This representative must be in the UK. And if you choose not to appoint a representative, you may be exposing your business to significant regulatory risk.

Are there any exemptions?

Yes, there is one exemption. Article 27 (2) states:

"The obligation laid down in paragraph 1 of this Article shall not apply to:
(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
(b) a public authority or body."

If your organisation can demonstrate the processing of personal data is "occasional" and unlikely to result in a risk to the rights and freedoms of natural persons, then it is doubtful you are required to appoint a representative.

If you determine your processing is "occasional", you should document your decision and be prepared to prove that position. If you are unsure in any way, it may be worth considering the cost and risk of this position in comparison to the cost of appointing a representative.

Is this the same as a Data Protection Officer?

No, the role of a data representative is not the same as a Data Protection Officer (DPO) and comes with a separate set of responsibilities.

A DPO is an integral part of your organisations UK GDPR compliance program, with responsibilities to independently oversee data protection strategies, educate staff and assess and ensure UK GDPR compliance. Whereas, the representatives' primary purpose is to act on behalf of the data controller or processor to facilitate communication with UK data subjects on all issues relating to your personal data processing activities, as well as communication from supervisory authorities.

In November 2019 the European Data Protection Board (EDPB) published guidelines stating they do not consider the function of representative compatible with the role of an external DPO:

"Such requirement for a sufficient degree of autonomy and independence of a data protection officer does not appear to be compatible with the function of representative in the Union. The representative is indeed subject to a mandate by a controller or processor and will be acting on its behalf and therefore under its direct instruction. The representative is mandated by the controller or processor it represents, and therefore acting on its behalf in exercising its task, and such a role cannot be compatible with the carrying out of duties and tasks of the data protection officer in an independent manner."

If you have already engaged an external DPO, you should appoint a different provider to act as your representative.