GDPR Article 27 EU and UK Representative Services

UK companies without offices in any EU member states will need to appoint an EU GDPR Representative as of 1 Jan 2021, if they process personal data of individuals that are located in the EU.

EU companies without offices in the UK will need to appoint an GDPR Representative in the UK as of 1 Jan 2021, if they process personal data of individuals that are located in the UK.

All companies without offices in the UK or in any EU member states will need to appoint an EU GDPR Representative and a UK Representative as of 1 Jan 2021, if they process personal data of individuals that are located in the EU and the UK. GDPRLocal.com can of course provide offices in both states.

The EU GDPR applies to UK companies if the processing of personal data from individuals in the EU relates to either the offering of goods or service to data subjects in the EU.

This applies to almost all companies including financial, business and legal services, online retail, marketing and adtech products, technology, transportation and aviation, clinical trials, health and diagnostic services, cookie-based advertisement, as well as digital services, such as mobile apps and online communities.

There are few exceptions . Public authorities and bodies, and to data processing by companies which is occasional, does not include, on a large scale, processing of special categories of data and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing.

The EU Representative is mandated by the data controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to [data] processing. The Representative acts as a local point of contact for matters of data protection and privacy, and receives communications from data protection supervisory authorities in official proceedings, as well as, for example, requests from data subjects to exercise their GDPR rights.

The contact details of the EU Representative must be published in the company’s privacy policies.

The EU Representative must be established in one of the EU member states where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behavior is monitored, are.

As your EU Representative we need to complete our due-diligence and ensure we understand how you collect, store, and process data.  We need to keep a copy of the company’s record of processing activity spreadsheet along with other key documents to help us understand how you operate. Upon request of EU supervisory authorities, the EU Representative must cooperate with them and disclose the Article 30 documentation.

No, failure to appoint an EU Rep would be a breach of Article 27 of the GDPR and carries the same potential penalties.

You might. From the 16th of July a new regulation, called 2019/1020, comes into force. It means that most non-EU manufacturers that sell products to the EU need an economic actor in place, such as an importer or Authorised representative, to remain compliant. The same is true for the UK and non-UK manufacturers. We do not offer this service and instead recommend reaching out to www.24hour-ar.com who can help with AR services for both the EU and the UK and they can also help sort out if this new requirement is relevant for you.