EU & UK Representative Service

In a nutshell, EU representation is essential for all non-EU businesses that offer goods or services across the EU for the purposes of compliance with Article 27 of the GDPR. While a UK representative must be appointed by all non-UK businesses that offer goods or services in the UK. They will have to appoint a UK representative in the same way that a non-EU based business, dealing with people in the EU and holding data on behalf of people in the EU will need to do so currently. Any business located anywhere else internationally outside of the two jurisdictions will need one if they are dealing with data subjects who are located in the EU and the UK.

There are two major changes that took place recently that have impacted privacy regulation and the need for an EU/ UK Representative. One was the inadequacy of the privacy shield. The other being Brexit. While data transfers between the EU and the rest of the UK continue, the need for an EU/ UK Representative has become even more essential to the smooth and secure processing of information at all times. This person is a point of contact for any sensitive issues that may arise and more.

When should you hire an EU Representative to comply with GDPR?

An EU Representative is required under GDPR in any situation where a person who’s holding data on behalf of a data subject is based in the EU, but doesn’t actually have an establishment in the EU themselves. Any business outside of the EU that is collecting or holding data in relation to people who are based in the EU, but that business doesn’t have any presence in the EU itself, needs to appoint an EU Representative to ensure compliance under the GDPR.

Who needs an EU Representative?

The main takeaway here is that any business or firm that is located outside of the EU, even if it does not have a presence in the EU itself, but it conducts business with or holds data on behalf of people who are based in the EU must appoint an EU Representative.

Where should your EU/ UK Representative be located?

There are no hard and fast rules here. You can easily utilise an EU/ UK Representative Service with the EU/ UK Representative based anywhere in the EU/ UK to comply with the requirements under the GDPR.

What is the role of the EU Representative?

EU citizens are entitled to be able to contact somebody locally to them, based in the EU as well, who they can contact if they want to exercise their GDPR rights, if they want to make a Data Subject Access Request (DSAR) or to exercise any of their other GDPR rights.

If there are any issues at the Data Protection Supervisory Authority (DPSA), then they can contact the EU Representative in relation to a GDPR issue. If a DPSA gets a complaint from the data subject or has any other issues that it wants to raise with the Data Controller or Processor, then it can contact the EU Representative, on behalf of that controller who’s located outside the EU.

Are EU Representatives involved in advising companies on GDPR compliance in any regard?

Since an EU Representative is an expert at data transfers and practices involved in data protection then a company can ask them to assist it in dealing with GDPR compliance issues.The core function of the EU Representative is simply to provide a point of contact and liaison between local data subjects and supervisory authorities for a business, but there is nothing to prevent the EU Representative from being able to provide additional or ancillary services around GDPR compliance, as and when needed.

How should you choose your EU/ UK Representative?

The body or service you are appointing must be a reputable one. They must clearly understand the role that they are carrying out and should have the expertise to be able to perform this role for a company.

You may want to choose a responsible business in this area that should be insured and carry the appropriate business liability insurance for the function they are undertaking. Similarly, it would be good for a provider to be ISO 27001 certified as they are dealing with information security.

How have things changed under the GDPR after Brexit?

The primary change, resulting from Brexit is that the UK is no longer a member state of the EU. And prior to Brexit, there was a transition period with other 27 member states of the EU, since the transition period has now ended (on 31 December 2020) thus the UK is no longer a part of the EU. Therefore, if a business is located in the UK and provides goods or services to people across the EU (and does not have a physical presence in the EU) then it will need to appoint an EU Representative. All businesses located outside of the EU and the UK who are also providing goods or services to EU and UK citizens will also need to appoint an EU and UK Representative respectively.

What is the difference between an EU Representative and a UK Representative?

The UK has been observing the GDPR since it came into effect, and therefore under Article 27 of the GDPR, all non-UK businesses are required to appoint a UK Representative if the business does not have an establishment in the UK and it is holding data on behalf of people who are based in the UK. In contrast, all businesses that are based outside of the EU and hold data on behalf of people who are based in the EU must appoint an EU Representative.

An EU Representative takes care of the EU standards and data subject protection, while the UK Representative is responsible for the UK standards and data subject protection. If either one of these applies to your business then you must hire a EU/ UK Representative, and it is normal to have them both together as one service or representative. Outsourcing the services of the EU/ UK Representative allows you to make sure that you are fully compliant under GDPR and have access to best in class service in the industry in a cost-effective manner.