Do I need to appoint an Article 27 GDPR UK representative?

Does your business process personal data of any individuals in the UK?

“process” includes using, transferring, modifying, holding, storing, archiving and backing up.

“personal data” includes any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly (i.e. when matched with other data that is currently available or may be available in the future), in particular by reference to an identifier such as a name, email address, an identification number, location data, an online identifier (e.g. IP address, geo locator, pixels that collect IP addresses) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data can be held electronically or in a structured (i.e. not randomly) organised manual filing system.

Does your business “offer” goods or services (including where no charge is made) to individuals in the UK?

“Offer” includes using a website to offer your goods or service provided that your website is targeting the UK (i.e. the website has pound denominated pricing, or the website text can display in the English language, or the website has testimonials from UK individuals.)

“Offer” does not include having a website which simply has your products and services advertised, but without “targeting” UK individuals.

Does your business monitor the behaviour of individuals who are in the UK?

An example of “monitoring behaviour” would include:

• where your business monitors the location of its employees or contractors in the UK (e.g. your employees have computers/phones and those computers/phones IP addresses are geo tracked for security reasons or other reasons);
• behaviour based marketing;
• market surveys and other behaviorally studies;
• personalized diet or health studies;
• monitoring or reporting on an individual’s health status.

Also you need to consider how your website operates. UK GDPR defines personal data very broadly and includes IP addresses, geo location data and similar data which is used by many websites, and especially website analytics tools to identify where devices that are using your website are located.

It does not matter whether the individual whose behaviour your business is monitoring are of UK citizenship or are living in the UK, the test is whether the individual is in the UK at the time of the monitoring.

Does your business processes personal data about UK individuals only “occasionally”, and not more frequently than that?

“Occasionally” means one-off, infrequent and not repetitive. So, for example, if your business is processing payroll data of UK individuals, or you are tracking the location and usage of users to your website through a website analytics program, or you actively receive orders for goods or services this would not be “occasional” use, and you should answer "No" to this Question.

Does your business do any large scale processing of special category data or criminal offence data, even occasionally?

“large scale” would include using website analytic with geo tracking of IP addresses for substantial numbers of people, or for example, CCTV coverage of public places.

“special category data” is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Is your business's processing of personal data of UK individuals likely to result in a risk of loss of privacy rights and freedoms to those individuals?

Even if your business only processes the personal data occasionally and even if it is not large scale processing of special category data or criminal offence data you should answer "Yes" if there's a likelihood of a risk of loss of privacy rights or freedoms.