EU GDPR representative for UK companies

The UK GDPR and the EU GDPR are now two laws. A UK company with no establishment in the EU that offers goods or services to EU residents, or monitors their behaviour, needs an EU representative under Article 27 of the EU GDPR. The ICO has nothing to do with it; the representative deals with EU supervisory authorities.

Who is caught

Online shops shipping to the EU, SaaS with EU customers, apps with EU users, agencies with EU clients' end users, newsletters marketed to EU readers. The occasional-and-low-risk exemption is narrow.

Where the representative must be

In one of the member states where the data subjects are. Malta qualifies for any company with EU-wide customers, and offers English-language contracts under Maltese law.

What you must change

Name the representative in your privacy notice and in information given to data subjects (Articles 13 and 14). We supply the paragraph. Keep your processing summary current so the Article 30 record we hold is accurate.

Prices

€299 / €599 / €1,499 a year by company size. Yearly, upfront, by card. Cancel with 30 days' notice.