Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 27 – Representatives of controllers or processors not established in the United Kingdom
Articles
Article 27Representatives of controllers or processors not established in [F1the United Kingdom]
1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in [F2the United Kingdom].
2. The obligation laid down in paragraph 1 of this Article shall not apply to:
- (a)processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
- (b)a public authority or body.
3. F3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, [F4the [F5Commission]] and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.
Amended text
This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations and footnotes
Textual Amendments
- F1 Words in Art. 27 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 21(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
- F2 Words in Art. 27(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 21(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
- F3 Art. 27(3) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 21(4) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)
- F4 Words in Art. 27(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 21(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
- F5 Word in Art. 27(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(e); S.I. 2026/1015, reg. 2(c)
https://uk-gdpr.digiphile.law/article/article-27.html
Text as at 17 September 2026.
This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.