What Is a UK Representative and Why Do You Need One?

Natacha has held various senior positions at the Foreign Office, including as Deputy Ambassador for China and Director for Economic Diplomacy and Emerging Powers. She has also been involved in global trade policy and international development issues.

Businesses located outside the UK are bound by UK privacy laws. They must appoint a Representative in the UK to serve as their point of contact for data subjects, as well as the ICO.

What is an UK Representative?

The UK Representative is a person, company or organisation that is formally mandated by a data controller or processor to act on their behalf regarding the GDPR's compliance issues in general. They will be the primary contact for all queries from individuals who exercise their rights or requests from supervisory authority. They could also be subjected to national regulations which have been imposed due to the GDPR’s extraterritorial scope (see the UK case Rondon against LexisNexis Risk Solutions).

The EU GDPR Article 27 and its UK equivalent Section 3.2.2 of the Data Protection Act 2018, require the appointment of an official representative. The requirement applies to any entity that does not have its own place of business within the United Kingdom and that offers products or services or monitors the conduct of individuals residing in the United Kingdom, or that processes personal data of such individuals. The representative must be able to show evidence of their identity and that they are competent in representing the data controller or processor in respect to the UK GDPR's requirements.

In addition to acting as a portal for individuals to exercise their rights under GDPR and rights, the representative must be in a position to communicate with authorities in the event of a breach. The representative must inform the supervisory authority who appointed them, regardless of whether the breach affects data subjects in multiple jurisdictions.

It is recommended that your chosen Representative has experience of working with both European and UK-based authorities for data protection. It is also desirable that they are fluent in the local language because they are likely to receive calls from both individuals and data protection authorities in the countries where they work.

The EDPB declares that the Representative is accountable for non-compliance. However the UK case of Rondon v. LexisNexis UK Ltd. (2019) EWHC1427 has confirmed that a representative is not able to be sued by someone who believes the controller of the data has failed to comply with GDPR in the UK. The court ruled that the Representative had no direct connection to the processing of data by the represented entity.

Who is required to appoint the UK Representative?

To be in compliance with the EU GDPR, businesses that are not part of the EU that market their products or services to European citizens, but do NOT have an office, branch or establishment within the EU must designate an EU representative sales. This is in addition the requirements of the national data protection laws. The role of a Representative is to serve as an individual point of contact for supervisory authorities and individuals regarding GDPR compliance issues.

The UK has a similar requirement to the EU as laid out in Article 27 of the UK-GDPR. The threshold is the same as the EU requirement: any organization providing goods or services within the UK or monitoring the conduct of data subjects, must appoint an UK representative.

Under the UK-GDPR, a Representative must be mandated in writing "to be additionally or alternatively, addressed on behalf of the controller or processor by the data subjects and the British Information Commissioner's Office]". They are not personally responsible for GDPR compliance. However, they must cooperate with supervisory authorities in official proceedings and receive notifications from data subjects who exercise their rights (access request or right to be forgotten, etc. ).

Representatives must be situated within the EU member state in which the individuals whose data are processed reside. Most of the time, this is not an easy decision to make, and a thorough analysis of legal and business aspects is required to determine the location(s) most appropriate for an organization. We offer a dedicated service that helps organisations determine their needs and select the most suitable representative choice.

It is also recommended that representatives have experience interacting with both supervisory authorities and handling data subject requests. Language skills in the local area are often of importance as the job will be involving dealing with requests from supervisory authorities or data subject across Europe.

The identity of the Representative should be disclosed to the data subjects by including their contact information in privacy policies and the information provided to individuals before collecting their data (see Article 13 of the UK-GDPR). Contact details for the UK Representative should be made available on your website so that supervisory authorities can easily reach them.

When do you need to nominate an UK Representative?

If your organisation is located outside of the UK and provides products or services in the UK or monitors the behaviour of individuals, you could be required to appoint an UK Representative. The UK's Applied EU GDPR regime is available to non-UK established entities which are operating in the UK. It has the same reach as EU GDPR, with some exceptions. Take our free self-assessment to check if you're required to comply with this obligation.

A Representative is appointed by the appointing party under a contract of service to act on behalf of the party with respect to certain obligations under UK GDPR and EU GDPR, if applicable. In the UK, have a peek here this would primarily involve facilitating communication between the entity that appointed the representative and the Information Commissioner's Office or any data subjects affected in the UK. A Representative could be an individual or a business that is established in the UK. The appointing body must inform data subjects that the representative will be processing their personal data and that the identity of the individual or company is readily accessible to supervisory authorities.

In accordance with Articles 13 and 14 of the UK GDPR, the appointing entity is also required to provide the contact information of its representative to the ICO as well as to people who have data in the UK. It is essential to make clear that the job of a Representative is different from and incompatible with the duties of the role of a Data Protection Officer ("DPO") which requires a certain degree of autonomy and independence that cannot be provided by a representative.

If you need to appoint an UK representative, it is best to do it as soon as you can. This is because this requirement is required either immediately following Brexit (if it is an "hard" or "no deal" Brexit) or following an implementation period (if it's a "soft" or "with deal". There is no grace time.

What are the requirements avon for representatives the designation of a UK Representative?

According to UK data protection laws A representative is a person, or a business who is "designated" in writing by a company that has no physical presence in the UK however is subject to the law. The UK representative should be able to represent an entity in relation to its legal obligations. Their contact details should also be readily available to UK residents whose personal data are being processed by a non-UK business.

The individual who is the UK Representative must be a senior member of the foreign media or business organization and has been hired and appointed as an employee outside the UK by the media or business organisation. The visa applicant must intend to work as the UK representative of the business or media organization full-time and not engage in other business activities outside of the UK.

The applicant also has to prove they have the knowledge and experience required to perform their role as UK representative, which entails acting as an individual contact point for individuals who are data subjects as well as UK authorities responsible for data protection. The UK Representative must have the experience and knowledge of UK laws regarding data protection to be capable of responding to requests and enquiries from data protection authorities and individuals exercising their rights.

As the Brexit process progresses it is likely that the UK data protection laws will change in the future. At the moment, it is expected that businesses from outside the UK who do business in the UK and collect personal information of individuals in the UK will need to appoint an UK representative.

This is because the UK GDPR stipulates that companies with no UK presence must appoint a representative in accordance with article 27 of the UK GDPR, which has been retained as a national law in the UK. If you're not sure whether you need a UK data protection rep, it's recommended that you seek out a knowledgeable legal advisor.