EU representative for UK companies

Why Brexit brought this obligation back

Before 2021 a UK company was inside the EU GDPR and needed no representative. On 1 January 2021 that changed. The UK became a third country, and Article 27 applies to third-country controllers and processors exactly as it applies to any other. The distance is short, the legal position is not.

Article 27 catches your UK business if all three are true:

• You have no branch, office or subsidiary established in the EU or EEA.
• You offer goods or services to people in the EU, or monitor their behaviour. An analytics or advertising cookie set on EU visitors already counts as monitoring.
• Your processing is more than occasional, or involves special-category data. The exemption in Article 27(2) is narrow and rarely fits a company that actively sells into the EU.

The full rules, including the exemption, are set out in our EU GDPR representative guide. Not sure whether the obligation applies to you? The Article 27 compliance checker walks through the test in about a minute.

Adequacy does not remove the duty

This is the single most common misreading we see from UK businesses. On 19 December 2025 the European Commission renewed the UK adequacy decisions; they now run to 27 December 2031, with a Commission review after four years. That renewal is real and it is good news, but it answers a different question.

Adequacy governs whether personal data may flow from the EU to the UK without extra safeguards such as Standard Contractual Clauses. Article 27 governs whether EU residents and EU supervisory authorities have someone inside the EU to address. An adequacy decision does not appoint anybody, and nothing in it removes the representative obligation. A UK company can be fully covered by adequacy and still be in breach of Article 27.

Two regimes, and what we cover

Since Brexit the UK GDPR and the EU GDPR run in parallel. They mirror each other, and each has its own Article 27. Which one applies to you depends on which market you serve from where:

• UK company serving the EU: you need an EU representative. This is what Usantis provides.
• Non-UK company serving the UK: that company needs a UK representative, answerable to the ICO. Usantis does not offer this, and one does not substitute for the other.

The distinction is explained in full in our article on the UK GDPR representative. The UK Data (Use and Access) Act 2025 reshaped parts of the UK regime but left the EU-side obligation untouched.

What a UK company gets

• A named representative established in the EU, appointed by power of attorney.
• A physical EU address that receives post from supervisory authorities and data subjects, including registered and formal service.
• A hosted compliance page you link from your privacy notice, satisfying the Article 13 and 14 duty to name the representative and give contact details.
• Handling of data-subject requests that arrive through that channel.
• A record of processing kept in the form Article 30 expects.

What we do not do is give legal advice or act as your Data Protection Officer. Those are separate roles with separate rules.

Setup in about five minutes

1. Create an account and complete a short company profile.
2. Verify your identity with one document, handled online.
3. Sign the power of attorney electronically.
4. Copy the representative block into your privacy notice and publish.

No sales call, no onboarding fee. UK business hours and EU business hours are the same working day, so nothing waits overnight.

Price and VAT

$490 per year for the Standard tier, billed annually. Premium is $99 a month or $990 a year. Prices are quoted and charged in US dollars; your card issuer converts to sterling at their rate.

UK VAT at 20 per cent is a separate matter from EU VAT and is handled under UK rules. Prices are net; we do not add or calculate local tax, so any UK tax treatment is yours to determine. See full pricing for what each tier includes.

Sectors we see most from the UK

Frequently asked questions

Other countries we serve