As the UK prepares to leave the EU, legislative changes will take effect. Organisations based outside the UK will need to consider how Brexit affects them.
If your organisation is located outside the UK but offers goods or services to individuals in the UK, or monitors their behaviour, and you are processing their personal data for those purposes, then the chances are that on Brexit the UK’s Applied GDPR regime will apply to you. Take our free self-assessment to find out if you need to appoint one.
This is the name given to the UK’s version of the EU General Data Protection Regulation. Applied GDPR will operate alongside, but be separate from, the EU GDPR post-Brexit.
If your organisation is processing personal data about data subjects in the EU and in the UK post-Brexit, then you may need to comply with both EU GDPR (in relation to the EU) and Applied GDPR (in relation to the UK) as separate, but complementary, regimes. See our Article 27 Representative page for information about your duties under EU GDPR.
If your organisation is based outside the UK but Applied GDPR applies to you, and you do not have your own establishment within the UK, the Applied GDPR will mandate you to appoint a representative within the UK following Brexit. This will either be immediately upon Brexit (if there is a ‘hard’ or ‘no deal’ Brexit) or after an implementation period (if there is a ‘soft’ or ‘with deal’ Brexit). There are limited exceptions to this requirement.
The function of the UK Representative is to:
hold your records of data processing activity
act on your behalf in relation to data protection matters in the UK
act as the first port of call for the UK’s data protection authority, the Information Commissioner’s Office, in relation to compliance action
act as a portal for the receipt of requests from individual data subjects in connection with their data protection rights.
We can act as your UK Representative but if you also need EU Representative solutions under GDPR Article 27, we can offer this service too
We have offices in the UK, Ireland and Switzerland
We have the capability to provide representative services in the UK and EU member states if the majority of your data subjects are located there, and can provide foreign language services.