How Non-EU Companies Can Find a UK Representative After Brexit

• UK GDPR Article 27 requires a UK-based representative for non-UK companies processing UK data.
• REP27 LTD signs UK appointments for GDPR, product, and cosmetics compliance.
• Providers differ in price transparency, included services, and contract terms.
• Appointment is mandatory for CE/UKCA products and most data processing.
• Hidden costs and exclusions may apply—always check contract details.

Updated 29 October 2026 · 5 sources checked

Providers compared

Prices as published on each provider's website on 29 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article Numbers, Scope, and Who Must Comply

After Brexit, the UK implemented its own version of the General Data Protection Regulation (UK GDPR). Article 27 of UK GDPR requires any business outside the UK that offers goods or services to people in the UK, or monitors their behaviour, and processes their personal data, to appoint a UK-based representative. This representative acts as the official contact point for UK data subjects and authorities. The law applies to non-EU and non-UK companies with no UK establishment, branch, or subsidiary, but which target UK customers or process their data. Typical signs of targeting include prices in pounds, delivery to the UK, a .co.uk domain, or advertising aimed at UK consumers.

For physical products, non-EU and non-UK manufacturers placing CE- or UKCA-regulated products on the UK market must appoint a UK authorised representative. This is required under UK product safety legislation, and applies to goods such as electronics, toys, PPE, and cosmetics. The representative must be a UK entity, not an EU-based company. The same obligation exists for the EU, but with a representative established in an EU member state. The appointment is also mandatory for cosmetics and certain regulated products, with the representative's details required on product labels and in technical documentation.

• Article 27 UK GDPR: Mandates a UK-based representative for data processing.
• UKCA/CE Product Regulations: Mandate a UK authorised representative for market access and compliance.

Exemptions are very limited. Occasional processing, not involving special categories of data or large-scale monitoring, may be exempt, but most B2C and B2B companies selling or targeting the UK will need a representative. Failure to comply can result in enforcement action, fines, and removal from marketplaces.

How to Choose a UK Representative: Practical Steps and Comparison

Choosing a UK representative involves more than finding a company with a UK address. The representative must be legally established in the UK and capable of fulfilling the obligations set by UK GDPR and product regulations. Key factors to consider include:

• Legal establishment: The provider must be a registered UK entity. For example, REP27 LTD is registered in England and Wales, and its details are verifiable at Companies House.
• Service scope: Does the provider cover all your needs? Some, like REP27, cover GDPR, product, and cosmetics representation. Others, like Lappa and Iguana-Q, focus on product compliance, while Gabsor offers broader legal representation.
• Price transparency: REP27 publishes its prices, while others require a quote. Confirm whether the price includes all necessary services or if there are extra charges for additional products, certificates, or urgent requests.
• Contract terms: Review the contract for notice periods, liability limits, and exclusions. Some providers may exclude legal advice or tax representation, or charge extra for certain services.

Below is a comparison of what each provider includes, based on available data:

Always request a sample contract and ask specific questions about what is included, how requests are handled, and what happens if you need to terminate or change the agreement.

What the Price Really Includes: Understanding Service Packages

The cost of appointing a UK representative can vary significantly depending on the provider and the scope of services required. REP27 publishes its prices, starting from €290/year for a UK GDPR representative or product responsible person. This fee includes a signed mandate, certificate, verification code, and public verification page. For combined EU and UK representation, REP27 offers a package from €390/year, with both appointments covered under one contract and invoice.

Lappa, Iguana-Q, and Gabsor do not publish prices and require a quote based on your specific needs. Their services may include additional compliance support, such as product testing, certification, or guidance through the regulatory process. However, the actual inclusions and any extra fees (e.g., for multiple products, urgent requests, or document changes) are not specified on their websites.

When comparing providers, clarify whether the price covers:

• All required legal appointments (GDPR, product, cosmetics)
• Certificates and verification codes
• Support for multiple products or brands
• Ongoing compliance support and updates
• Additional fees for extra services or urgent requests

REP27 provides a transparent, all-in-one approach for GDPR, product, and cosmetics representation, but does not include legal advice or tax representation. Lappa and Iguana-Q may offer broader compliance support, but details and pricing must be confirmed directly. Gabsor is positioned for companies needing representation under multiple EU/UK digital laws.

Hidden Costs, Exclusions, and What Providers Usually Do Not Say

While the headline price may seem straightforward, hidden costs and exclusions are common in the UK representative market. Providers may charge extra for:

• Multiple products or brands (especially for product responsible person roles)
• Urgent requests or expedited processing
• Document changes or additional certificates
• Handling requests from authorities or data subjects beyond a certain volume

Legal advice and tax representation are typically excluded from standard packages. For example, REP27 does not provide legal advice or tax representation as part of its service. Notice periods for termination, per-request fees, and liability limits are often not advertised and must be checked in the contract. Some providers may limit their liability to the annual fee or exclude certain types of damages entirely.

Always ask for a full list of exclusions and potential extra charges before signing. Request a copy of the contract and check:

• Notice period for termination
• How requests from authorities or customers are handled
• Limits of liability and indemnity clauses
• Any per-request or per-product fees not included in the base price

Transparency varies by provider. REP27 offers a public verification system for appointments, which can be useful for demonstrating compliance to authorities or marketplaces. Lappa, Iguana-Q, and Gabsor do not specify these details on their websites, so direct inquiry is essential.

How Appointment Works: Step-by-Step Guidance and Real Examples

The process of appointing a UK representative is generally straightforward but must be handled carefully to ensure compliance. Here is a typical step-by-step process, using REP27 as an example:

1. Determine your obligations: Assess whether your business targets UK customers, processes UK data, or places regulated products on the UK market.
2. Choose a provider: Select a UK-established provider that covers your required services (GDPR, product, cosmetics).
3. Submit your details: Provide company information, product or service scope, and any supporting documentation.
4. Review and approval: The provider reviews your file for completeness and compliance (REP27 typically within 24 hours).
5. Sign the mandate: The provider issues a signed appointment letter, certificate, and verification code.
6. Update your compliance documents: Add the representative’s name, address, and contact details to your privacy notice, product labels, and technical files as required.
7. Ongoing compliance: The representative acts as your contact point for UK authorities and data subjects, forwards requests, and maintains required records.

For example, a US SaaS company with UK users would appoint REP27 as its UK GDPR representative, update its privacy notice, and be ready for any requests from the UK Information Commissioner’s Office. A Chinese Amazon seller would appoint a UK product responsible person and list REP27’s details on product labels and Amazon listings.

Risks, Fines, and Legal Consequences of Non-Compliance

Failing to appoint a UK representative when required exposes your business to significant legal and commercial risks. The UK Information Commissioner’s Office (ICO) can investigate and fine companies for non-compliance with UK GDPR Article 27. Trading Standards can take action against non-compliant product manufacturers, including removal from marketplaces and recalls.

For VAT, non-established taxable persons (NETPs) must register for UK VAT immediately after making their first taxable supply in the UK. There is no threshold for foreign businesses; failure to register can result in HMRC demanding backdated VAT, interest, and severe financial penalties (official VAT guidance).

• Data protection fines: The ICO can issue substantial fines for GDPR breaches, including failure to appoint a representative.
• Product compliance risks: Non-compliance can lead to products being blocked at the border, removed from sale, or recalled.
• Marketplace bans: Amazon, eBay, and other platforms require proof of a UK responsible person for certain products; failure to provide this can result in account suspension.

Appointing a qualified UK representative is not just a legal formality but a critical step to maintaining market access and avoiding costly enforcement actions.

Decision Matrix: Who Needs a UK Representative and When?

Use this matrix to determine if your business needs a UK representative:

Always verify your obligations based on your business activities, customer base, and product types. When in doubt, consult the official guidance or request a compliance check from your chosen provider.

Checklist: Steps to Appoint a UK Representative Today

1. Identify if your business targets UK customers or processes UK data.
2. Check if your products require a UKCA/CE authorised representative.
3. Compare providers and request a contract.
4. Submit your business and product details.
5. Review and sign the mandate.
6. Update privacy notices and product labels.
7. Keep records and monitor compliance.

This checklist ensures you cover every compliance step, from initial assessment to ongoing monitoring. For each step, document your decisions and keep copies of all correspondence and certificates.

What Providers Usually Do Not Say: Exclusions, Notice, and Liability

• Legal advice and tax representation are usually excluded from standard representative services. You may need to engage separate advisors for these areas.
• Notice periods for terminating the contract can apply, sometimes up to several months. Check the contract for details.
• Extra fees may be charged for urgent requests, document changes, or handling a high volume of authority or customer requests.
• Liability is often limited to the annual fee or excludes certain types of damages. Review indemnity clauses carefully.
• Some providers may not support all product categories or may restrict services to certain industries.

Always request full contract terms and clarify any unclear points before committing.

Realistic Scenarios: Which Obligation Applies and How to Comply

• Scenario 1: US SaaS company with UK users
  A US-based SaaS provider processes personal data of UK users. It must appoint a UK GDPR representative, such as REP27 LTD, and list the representative’s details in its privacy notice. The company does not need a product responsible person unless it sells physical goods.
• Scenario 2: Chinese Amazon seller shipping to UK
  A Chinese manufacturer lists toys on Amazon UK. It must appoint a UK product responsible person and may also need a UK GDPR representative if it processes UK customer data. REP27 offers both services, with certificates and verification codes for marketplace compliance.
• Scenario 3: UK online shop selling to EU
  A UK-based e-commerce shop sells to EU consumers. It needs an EU GDPR representative, not a UK one, and must comply with EU product regulations. REP27’s Europe Services SE can act as the EU representative.

Each scenario highlights the importance of matching your obligations to your business activities and choosing a provider that covers all required roles.