What Is a UK Representative and Why Do You Need One?

Natacha has held a number senior positions at the Foreign Office, including as Deputy Ambassador for China and Director responsible for Economic Diplomacy and Emerging Powers. She has also worked on global trade policy and international issues related to development.

Companies that are not based in the UK must adhere to UK privacy laws. They must designate a representative in the UK to act as their point of contact for data subjects, as well as the ICO.

What is what is a UK Representative?

The UK Representative is an individual, company or jejuluonto.com official blog other entity that has been formally authorised by a data controller or processor to act on behalf of the controller or processor in all matters around GDPR compliance. They will be the primary contact point for inquiries from individuals exercising their rights, or for requests from supervisory authorities. They could also be subject to national regulations that have been enacted in the context of GDPR's extraterritorial scope (see the UK case Rondon v LexisNexis Risk Solutions).

The EU GDPR Article 27 and its UK equivalent, Section 3.2.2 of the Data Protection Act 2018, require the appointment of an official representative. The requirement applies to any entity that does not have its own place of business within the United Kingdom and that offers services or goods to or monitors the behavior of people who reside in the United Kingdom, or that manages personal data of those individuals. The Representative must be able authentic proof of their identity and prove that they are able to represent the data processor or controller in respect to UK GDPR obligations.

The representative must also be able to communicate with authorities if there is an incident. The representative must inform the supervisory authority who appointed them regardless of whether or not the breach affects data subjects in multiple jurisdictions.

It is recommended that the Representative has experience working with both European and UK-based authorities for data protection. It is also desirable that they have a local language proficiency as they are likely to receive contact from both individuals and data protection authorities in the countries where they work.

While the EDPB states that the Representative should be held liable in the event of non-compliance the UK court case of Rondon v LexisNexis UK Ltd (2019) EWHC 1427 has confirmed that become a Avon representative (ggw.acaunion.com) Representative cannot be sued by an individual for the data controller's inability to comply with the UK GDPR. This is because, according to the court the Representative does not have a direct connection to the processing of data by the represented entity.

Who is responsible for appointing the UK Representative?

To comply with the EU GDPR, businesses that are not part of the EU that market their products or services for European citizens, but do NOT have an office, branch, or establishment within the EU must designate an EU Representative. This is in addition to the requirements from national laws on data protection. The function of a representative is to serve as the local point of contact for individuals and supervisory authorities with respect to GDPR compliance issues.

The UK has similar requirements to the EU, which is outlined in Article 27 of the UK-GDPR. The threshold is the same as the EU requirement: any organization offering goods or services in the UK or monitoring the behavior of individuals who are data subjects, must designate an UK representative.

According to the UK-GDPR a representative must be authorized in writing by the data subjects or the British Information Commissioner's Office[British Information Commissioner's Office] "to be addressed, additionally or alternately, on behalf the controller or processor". They are not able to be personally held accountable for the GDPR's compliance. However, they must cooperate with supervisory authorities in formal proceedings and also receive notifications from data subjects exercising their rights (access request, right to be forgotten, etc. ).

Representatives should be based in the member state of the European Union in which the individuals whose personal data are processed reside. This is not an easy decision that requires an extensive legal and business analysis to determine the most suitable location for a company. We provide an individualized service that assists organizations in assessing their needs and choosing the best Representative option.

It is also advisable that the representative has experience dealing with supervisory authorities and handling data subject requests. Local language skills can also be essential, as the role may involve handling inquiries from supervisory authority or data subjects in a variety of countries across Europe.

The identity of the representative should be disclosed to data subjects by including their information in privacy policies and the information provided to individuals before collecting their data (see Article 13 UK-GDPR). Contact details for the UK Representative should be published on your website so that supervisory authorities can easily contact them.

When is the best time to appoint an UK Representative?

If your organisation is based outside the UK, offers goods or services to individuals within the UK or monitors their behaviour it is possible to designate a UK representative. The UK's Applied GDPR regime applies to established companies outside the UK that are conducting business in the UK and has the same scope of extraterritorial application as the EU GDPR (with limited exceptions). You can take our no-cost self-assessment and find out if you are subject to this obligation.

A Representative is mandated by the appointing entity in the terms of a service contract to represent that entity with regard to specific obligations under the UK and EU GDPR as applicable. In the UK the primary purpose of this is to facilitate communication between the appointing entity and the Information Commissioner's Office (ICO) or any data subjects affected in the UK. A Representative could be an individual or a company based in the UK. The body that appoints them must inform the subjects of data that the Representative will be processing their personal information and that the identity of the individual or business is readily accessible to supervisory authorities.

The entity that is appointing the representative must provide the contact details of its representative to ICO and the data subjects that are affected in the UK in accordance with Article 13 and 14 of the UK GDPR. It is imperative to make clear that a representative's role is different from the one of the role of a Data Protection Officer (DPO) which requires a level of autonomy and independence that is not available to the role of a representative.

If you have to designate an official from the UK representative the process should be completed in the earliest time possible. This is because the requirement will be in effect immediately after Brexit (if there is an 'hard' or 'no deal' Brexit) or after an implementation period (if there is a'soft' or "with deal" Brexit). There is no grace time.

What are the requirements to be a UK representative?

Under the UK laws on data protection (and specifically article 27 of the UK GDPR) A representative is an individual or a company that is "designated in writing" by an entity that has no presence in the UK but is subject to the provisions of the law. The UK representative is required to be able represent an entity in relation to its legal obligations. Their contact details should also be available to UK residents whose personal information are being processed by a business that is not a UK company.

The UK Representative must be an overseas senior employee of a business or media organization and have been hired and employed as an employee of the business or media organization outside of the UK. The applicant for the visa must be planning to serve as the UK representative for the business or media organization full-time and must not engage in other business activities in the UK.

Additionally the visa applicant must demonstrate the necessary skills and experience to fulfill their role as a UK Representative, which will include acting as the local point of contact for any queries from data subjects and the UK data protection authorities. This is to ensure that the UK Representative has sufficient knowledge of and expertise in the UK data protection laws and can be able to respond to requests from individuals exercising their rights under the law in addition to any other inquiries or requests received from data protection authorities.

As the Brexit process progresses it is likely that the UK data protection laws will be altered in the future. At present, it is expected that companies from outside the UK that do business in the UK and collect personal information of individuals in the UK will be required to appoint a UK representative.

This is because the UK GDPR requires that entities that do not have a UK presence must appoint sales representatives jobs under article 27 of the UK GDPR, which has been retained as a law of the nation in the UK. If you are not sure whether you are required to appoint a UK representative for data protection It is suggested that you speak to an experienced lawyer.