UK Representative Services for Overseas Companies After Brexit

• Article 27 UK GDPR requires a UK representative for non-UK companies targeting UK individuals.
• REP27 LTD signs UK GDPR, product, and cosmetics mandates for overseas companies.
• Provider prices and included services vary—always verify what is covered.
• Some representatives cover only GDPR, others add product or cosmetics roles.
• Exemptions exist for occasional, low-risk processing—check if you qualify.
• Not appointing a representative can result in fines or market access loss.

Updated 2 November 2026 · 6 sources checked

Providers compared

Prices as published on each provider's website on 2 November 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article 27 UK GDPR and Product Rules

Article 27 of the UK GDPR states that any controller or processor without a UK establishment must appoint a UK representative if they offer goods or services to individuals in the UK or monitor their behavior. This applies to both B2C and B2B activities if personal data of UK individuals is processed. The representative must be established in the UK, appointed in writing, and act as a contact point for the Information Commissioner's Office (ICO) and data subjects.

• Who must appoint: Any non-UK company targeting UK individuals (via sales, marketing, or behavior monitoring) and processing their personal data.
• What must be published: The representative's name, UK address, and contact details in privacy notices and, if applicable, on product labels.
• Other rules: For physical products and cosmetics, UK law also requires a responsible person or agent for service. REP27, for example, covers GDPR, product, and cosmetics roles under separate mandates.
• Exemptions: Occasional processing, not involving special categories of data or large-scale monitoring, may be exempt. However, these exemptions are narrow and do not apply to most active sellers or service providers.

Failure to appoint a representative can lead to enforcement action, fines, and removal from marketplaces. For product compliance, not having a responsible person can result in customs blocks or takedowns on platforms like Amazon and eBay.

How to Choose a UK Representative Service

Choosing a UK representative is a critical compliance decision. Providers differ in what they offer, how quickly they respond, and the scope of their services. Consider the following factors:

• Scope: Does the provider cover only GDPR, or also product and cosmetics responsibilities? REP27 is one of the few offering all three under one brand, while others focus solely on GDPR representation.
• Verification: Is a certificate or public verification included? REP27 provides a verifiable certificate and public lookup. Others may only provide an appointment letter.
• Response time: How quickly are data subject or ICO requests forwarded? Janus Compliance promises forwarding within one working day, but others do not specify.
• Legal form: Is the provider a registered UK company? This is essential for compliance. REP27 LTD, Janus Compliance, FSREG, and UK Establishment are all UK-registered entities. SIDD is Swiss-based but uses a London company for the role.
• Extra services: Are regulatory filings, advice, or additional products included? Most providers charge extra for these or do not offer them at all.

Always request the provider's full terms and ask about notice periods, scope, and any exclusions before signing.

What the Price Really Includes: Comparing Providers

Annual fees for UK representative services can range from £249 to £1,200 or more, depending on the provider and what is included. Lower-priced services (e.g., Janus Compliance at £249/year) typically cover only the basic GDPR Article 27 mandate and simple request forwarding. Higher-priced options (e.g., SIDD at £1,200/year) may include extras like ROPA retention, London legal entity, and initial compliance review.

• REP27: Covers GDPR, product, and cosmetics roles under separate mandates, includes a certificate and public verification, with prices starting from €290/year. Legal advice and regulatory filings are not included by default.
• Janus Compliance: Focuses on GDPR representation and request forwarding, with no product or cosmetics roles included. Extra services are available on request.
• FSREG: Offers GDPR representation and address for service. Product and cosmetics roles are not included.
• SIDD: Provides GDPR representation with a London company, ROPA retention, and initial review. Product and cosmetics roles are not included.
• UK Establishment and Axsuma: Offer agent for service and process agent roles, mainly for contracts and legal proceedings, not GDPR or product compliance.

Check if the price covers all your needs, especially if you sell physical products or cosmetics in the UK. Some providers charge extra for additional products, services, or high volumes of data subject requests. Always ask for a detailed fee schedule and clarify what is included in the annual price.

Hidden Costs, Exclusions, and What Providers Usually Do Not Say

Many providers advertise a low headline price but may charge extra for additional services or requests. Common hidden costs and exclusions include:

• Extra fees for handling large volumes of data subject or regulatory requests
• Charges for additional products or product categories (especially for product or cosmetics roles)
• Separate fees for regulatory filings, compliance reviews, or legal advice
• Notice periods for termination and automatic renewal clauses
• Strict limits on liability for non-compliance or missed requests

For example, most basic GDPR representative packages do not include product or cosmetics responsibilities—these are separate services. Some providers only forward requests but do not provide substantive responses or legal advice. Liability for non-compliance is usually limited to the amount paid for the service.

Always request the provider's full terms and conditions, including:

• Scope of service and what is not included
• Any per-request or per-product fees
• Notice period for termination
• Liability limits and exclusions

Providers rarely highlight these exclusions in their marketing. Make sure you understand the full cost and your ongoing obligations before appointing a representative.

How Appointment Works: Step-by-Step Guidance

Appointing a UK representative is a structured process. Here is a practical step-by-step guide:

1. Assess your obligation: Confirm your company is outside the UK and targets UK individuals (through sales, marketing, or monitoring).
2. Choose a provider: Compare providers based on scope, price, and included services. Request quotes and review terms.
3. Submit details: Provide your company information, activities, and (if applicable) product or cosmetics details to the provider.
4. Review and sign: The provider reviews your file and prepares the written mandate. For REP27, this is typically completed within 24 working hours.
5. Receive certificate: You receive a signed appointment letter or certificate, along with instructions for updating your privacy notice and product labels.
6. Update documentation: Add the representative's contact details to your privacy notice and, if required, to product packaging and listings.
7. Ongoing compliance: The representative acts as your contact point for the ICO and data subjects, forwarding requests and correspondence as needed.

Checklist for buyers:

1. Confirm you have no UK establishment
2. Assess if you target or monitor UK individuals
3. Gather company and product details
4. Request quotes and review inclusions/exclusions
5. Sign mandate and receive certificate
6. Update privacy notice and product labels
7. Retain proof of appointment for regulators/marketplaces

This process ensures you are compliant and can prove it to authorities, marketplaces, and business partners.

Risks and Fines for Non-Compliance

Failing to appoint a UK representative when required exposes your company to significant risks:

• Regulatory fines: The ICO can impose fines for non-compliance with Article 27 UK GDPR. While the exact amount depends on the breach, the risk is real for companies processing UK data without a representative.
• Market access: Marketplaces such as Amazon, eBay, and Etsy may require proof of a UK representative or responsible person for product listings. Without it, your products can be removed or blocked from sale.
• Customs blocks: For physical products, UK customs may block imports that lack a responsible person or correct labeling.
• Reputational damage: Failure to respond to data subject requests or regulatory inquiries can harm your brand and lead to negative publicity.

The representative acts as your official contact for the ICO and UK individuals. If you do not have one, you may miss important legal notices or requests, increasing your risk of enforcement action.

Appointing a reputable provider and maintaining up-to-date documentation is essential for ongoing compliance and risk management.

Decision Matrix: Do You Need a UK Representative?

Always assess your activities and data flows. If you target UK individuals or sell products into the UK, you almost certainly need a representative. If you only process UK data occasionally and not on a large scale, you may be exempt—but this is rare for active businesses.

Realistic Scenarios: Which Service Applies and How to Comply

• US SaaS company with UK users: Must appoint a UK GDPR representative. Product roles are not required. REP27, Janus Compliance, FSREG, and SIDD all offer this service. The simplest route is to appoint a provider, update your privacy notice, and retain the certificate.
• Chinese Amazon seller shipping to UK: Needs both a UK GDPR representative and a responsible person for products. REP27 covers both roles. The seller should appoint REP27, update privacy notices, and ensure product labels and Amazon listings display the correct UK contact details.
• UK online shop with no overseas presence: Does not need a UK representative, as it is already established in the UK. No action required.

For each scenario, the key steps are: assess your obligations, appoint the correct representative(s), update documentation, and retain proof for regulators and marketplaces. This ensures compliance and avoids disruption to your UK business activities.