UK GDPR Article 27: representatives of controllers or processors not established in the United Kingdom (UK GDPR (Regulation (EU) 2016/679 as retained), Art. 27(1)-(2))
A business outside the UK that offers goods or services to people in the UK, or monitors their behaviour there, must name a representative in the UK in writing, unless its processing is only occasional, avoids special categories on a large scale and is unlikely to put people at risk.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in ... The obligation laid down in paragraph 1 of this Article shall not apply to: (a) processing which is occasional, does not include, on a large scale, processing of special categories of data”
Figures it counts in
It is shown on its own, not counted into a figure.