Short answer: A UK company may need an EU GDPR representative after Brexit if it offers goods or services to people in the EU or monitors their behaviour there, and it has no establishment in the Union for the relevant processing. The representative must be appointed in writing. It does not have to be in Spain in every case, but Spain can be a suitable location when some of the affected data subjects are in Spain and the mandate is structured accordingly.
UK companies often discover this issue during an EU customer questionnaire, a SaaS procurement review or a privacy-policy check. UK GDPR compliance, an ICO registration and an international transfer safeguard are separate matters. None of them automatically replaces the EU representative requirement.
For a practical assessment, see our GDPR representative service in Spain for companies outside the EU.
Check your EU representative position before an EU customer asks
We review your EU audience, establishment, products, privacy notice and Article 27 mandate.
Why Brexit matters for EU GDPR representation
A company established only in the United Kingdom is no longer established in a Member State of the European Union. If its processing falls within Article 3(2) of the EU GDPR, Article 27 can require a representative established in the Union. The analysis is about the company’s establishment and the processing activity, not the nationality of its directors or customers.
This is separate from the UK GDPR. A UK company may need to comply with both regimes when it serves people on both sides of the Channel, but the EU representative and any UK representative are not interchangeable appointments.
UK SaaS provider
Offers subscriptions to organisations or users in Spain, France or other EU countries and processes account, billing or usage data.
UK online retailer
Targets EU consumers with shipping, prices, marketing or customer support directed to the Union.
UK app or analytics provider
Monitors behaviour, location or engagement of people in the EU for product, advertising or personalisation purposes.
Does a UK company need a representative specifically in Spain?
Not automatically. Article 27 requires the representative to be established in the Union in a Member State where the data subjects whose personal data are processed are located, or where the relevant processing activities take place, as provided by the Regulation. If the company’s relevant audience includes people in Spain, a Spain-based representative may be a practical choice. If the activity is limited to another Member State, Spain may not be the appropriate location.
The right question is therefore not “Can I buy a Spanish address?” but “Where are the people affected by the processing, which activities are in scope and can the representative actually perform the mandate?” A paper-only mailbox is not a substitute for an informed, reachable representative.
What should a UK company review first?
- Identify whether the UK entity is the controller, processor or joint controller.
- Map the EU countries where customers, users or monitored individuals are located.
- Document whether the business offers goods or services or monitors behaviour in the EU.
- Check whether the Article 27(2) exception could genuinely apply; it is narrow and fact-specific.
- Check whether the group has a real EU establishment that carries out the relevant processing.
- Review the representative wording in the privacy notice and customer contracts.
- Separate the Article 27 analysis from international transfer safeguards and DPO obligations.
EU representative, DPO and UK GDPR: what is the difference?
| Issue | EU representative | DPO or UK GDPR compliance |
|---|---|---|
| Purpose | Acts as a contact point for certain EU GDPR matters within a written mandate. | A DPO advises and supervises independently; UK GDPR covers processing subject to the UK regime. |
| Location | Established in the EU/EEA in the relevant circumstances. | A DPO does not automatically need to be in Spain; UK GDPR contacts are separate. |
| Does it replace the company? | No. The UK company remains responsible for its processing. | No. A DPO does not take over liability and an ICO registration does not cover EU Article 27. |
| Does it legalise transfers? | No. Transfers require their own legal mechanism and assessment. | No. Adequacy or safeguards address transfers, not the representative designation. |
What the written mandate should cover
The mandate should identify the UK company, the representative, the processing activities and the channels for communications. It should make clear how data-subject requests, supervisory-authority correspondence and relevant records will be received, escalated and documented.
Five questions EU customers are likely to ask
Are you established in the EU?
Answer accurately. A UK company with no relevant EU establishment should not imply that a UK address satisfies Article 27.
Who is your Article 27 representative?
Provide the name and contact details that appear in your privacy information and mandate.
Does the UK adequacy decision solve this?
No. It concerns transfers to the UK. It is a different question from having a representative in the EU.
Frequently asked questions
Do all UK companies need an EU GDPR representative after Brexit?
No. The obligation depends on Article 3(2), the absence of a relevant EU establishment and the limited exceptions in Article 27(2). A UK-only business with no EU-targeted offer or monitoring may fall outside this obligation.
Does a representative in Spain cover all EU countries?
A single representative can cover the relevant EU GDPR matters for the company, but the location must be appropriate under Article 27 and the representative must be able to perform the mandate. It is not a reason to ignore where affected people are located.
Is an ICO registration enough?
No. ICO registration and UK GDPR compliance are separate from an EU GDPR Article 27 designation.
Does the UK adequacy decision remove the need for an EU representative?
No. Transfer adequacy and representative designation address different obligations. The data-flow assessment and the Article 27 assessment should be documented separately.
Official sources
- Regulation (EU) 2016/679 on EUR-Lex, especially Articles 3 and 27.
- ICO guidance on receiving personal information from the EEA, including the EU representative position for UK organisations.
- EDPB Guidelines 3/2018 on the territorial scope of the GDPR.
Close the EU GDPR representation gap
We help UK companies assess scope, choose the right EU location and prepare a workable mandate.