UK Representative FAQs

Do I need a UK Representative for GDPR?

Under Article 27 of the UK GDPR, your business must appoint a “Representative” in the United Kingdom if:

1. it does not have a presence (e.g. an office) in the United Kingdom; And either
2. it is offering goods or services (whether free or for payment) to individuals in the UK; or
3. it is monitoring behaviour of individuals whilst in the UK (e.g. your business is using an analytics program on its website to track usage by IP address),

unless an exception applies.

Are there any exemptions?

Yes, a Public body does not need to appoint a GDPR Representative. Also, according to Article 27, a controller or processor does not need to appoint a “representative” if:

• the processing it carries out is unlikely to result in a risk to the rights and freedoms of UK data subjects; or
• the processing is occasional;

Suppose you determine Article 27 does not require you to appoint a Representative. In that case, you must document this fact and the reasons you made this decision to comply with the record-keeping obligations under Article 30.

Note: “Occasional” is not defined in UK GDPR, but repetitive processing, such as payroll, is unlikely to be "occasional" and businesses running website analytics on persons in the UK is highly unlikely to be "occasional".

If my company is part of a group of companies do I need to appoint a separate Representative for each entity?

Yes. Each separate legal entity in the group of companies must separately appoint a UK GDPR Representative. Each entity can appoint Juksta separately. If you have a large group of companies, please contact us for special rates for group companies.

What are the UK Representative responsibilities?

By you appointing Juksta as your Representative we are required to enable your customers/data subjects and relevant supervisory authorities to communicate with you via us. We encourage communication via our Representative Portal for all online communications.

Your customers/data subjects, the UK Information Commissioner and others can send post or fax communications to our office in the United Kingdom, and we will scan them and make them available within your Representative Portal.

You must make our representative service available, but it is not against the law for your customers/data subjects, the UK Information Commissioner and others to contact you directly, or for you to respond to them directly. The Representative must also co-operate with the Information Commissioner.

Can my DPO be my UK Representative?

No. The roles and functions of a DPO and a Representative are different. The European Data Protection Board (EDPB) has expressly stated that it considers the role of a Representative to be incompatible with that of the DPO. DPO’s are required to exercise their duties and tasks in an "independent manner", whereas a representative must act only in accordance with the written instruction of the company. The EDPB also considers the two roles to have potential conflicts of interest.

What are the penalities of non-compliance?

Under Article 3 of the UK GDPR, Territorial scope of the legislation includes processing of personal data of UK data subjects by organisations who reside outside the UK. Penalties for not complying with the requirement to appoint a UK representative can be up to 2% of annual worldwide revenue or €10,000,000, whichever is the greater.

The United Kingdom Information Commissioner may enforce penalties. You may also be liable for civil claims arising from your breaches of UK GDPR.