United Kingdom
Does a UK company still need an EU representative?
The UK adequacy decision covers transfers, not representation. A UK company targeting EU customers is a third-country controller under the EU GDPR.
The pitfall
Adequacy is not representation
The United Kingdom benefits from an adequacy decision, which means personal data can flow from the Union to the UK without additional transfer safeguards. Many organisations read that as continuity and stop there. It is not continuity. Adequacy answers whether data may be transferred. It does not answer whether a UK organisation offering goods or services to people in the Union, or monitoring their behaviour, must designate a representative established in the Union.
Compliance with the UK GDPR is likewise not compliance with the EU GDPR. The two regimes began identical and have been diverging since. Where your activity reaches the Union, it is the European instrument that governs it.
The position is symmetrical: EU-established organisations targeting the UK face the mirror requirement under UK law.
What Brexit changed for your other rights
An EU trade mark no longer covers the United Kingdom, and a UK mark does not cover the Union. Portfolios built before Brexit often have gaps that only surface when someone tries to enforce them.
The UK is not bound by the AI Act or the Digital Services Act. But a UK provider placing an AI system on the Union market, or a UK platform reaching Union users, falls within both.
Scope
Services most likely to apply
- GDPR Article 27 representation
- AI Act authorised representative
- DSA legal representative
- UK-EU contract review
- EU trade mark filing
Working together
The role of your existing UK counsel
Your current advisers keep the relationship and the strategy. We take the European-side mandate and report back in English. Where you would rather we deal with the company directly, we do that instead — it is settled before we start, not afterwards.
For foreign law firmsPreparation
What to prepare before we speak
Your privacy notice. Your record of processing, if one exists. A description of the activity that reaches the Union. The Member States you target. Whether any EU entity, importer or reseller already exists. And whatever prompted the question — a customer questionnaire, a marketplace notice, a letter from an authority.
FAQ
Frequently Asked Questions
Start with a scope review
EU market entry assessmentThis page describes how these obligations generally work. Whether one applies to you depends on facts a web page cannot capture — your supply chain, your contracts and the role you actually play in them.