Do I need to serve a counter-notice?

No. The tenant's counter-notice was abolished in June 2004 by the Regulatory Reform (Business Tenancies) (England and Wales) Order 2003. Older guidance still says otherwise and is wrong.

What is the deadline?

An application to court must be made before the termination date specified in the notice. It can be extended only by written agreement under section 29B, made before the deadline passes.

What happens if I miss it?

The tenancy ends on the termination date and the statutory right to a new lease is lost. There is no discretion to extend it afterwards.

How long is a section 25 notice?

The termination date must be between six and twelve months from service, and no earlier than the contractual expiry date of the lease.

Can the landlord just refuse to renew?

Only on one or more of the seven grounds in section 30(1). Redevelopment and own occupation are the most common, both require a genuine and settled intention, and both entitle the tenant to statutory compensation.

What if my lease is contracted out?

Then the 1954 Act does not apply and there is no right to renew. Establishing this is the first step, because it decides everything else.

£495 fixed for the assessment: the notice and lease read, validity checked, the deadline identified and diarised, and a written view on your options. Agreed in writing before any work begins, no VAT.

Data protection · 7 min read · 29 September 2026

Do I need a UK GDPR representative? Article 27 for businesses outside the United Kingdom

Brexit did not take non UK businesses out of UK data protection law. It created a second regime that applies alongside the EU one, and it comes with its own requirement to appoint someone in the United Kingdom who can be addressed by the regulator and by the people whose data you hold.

FIXED FEE

Applicability check, a written answer on whether Article 27 applies to you, from £395. UK privacy notice and Article 30 records from £595. Full UK GDPR pack from £1,150. No VAT. Advice by Santosh Pandey, Solicitor of England and Wales, SRA No. 641612. Handled entirely in writing. UK GDPR representative service.

Where the obligation comes from

The UK GDPR is the EU regulation as retained and amended in domestic law, and Article 27(1) provides that where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the United Kingdom. The requirement bites on businesses with no establishment in the United Kingdom. A company with a UK branch, office or subsidiary that is involved in the processing is established here and falls under Article 3(1) instead; it needs no representative because it is already reachable.

Article 3(2): the two triggers

Article 3(2) applies the UK GDPR to processing of the personal data of data subjects who are in the United Kingdom by a controller or processor not established here, where the processing activities are related to either the offering of goods or services to those data subjects in the United Kingdom, irrespective of whether a payment is required, or the monitoring of their behaviour as far as that behaviour takes place within the United Kingdom.

Offering means targeting. A website that can be reached from the United Kingdom is not enough on its own. Pricing in sterling, delivery to UK addresses, UK customer reviews, a .co.uk domain, UK specific marketing and an English language site aimed at UK customers all point the other way. A software business selling subscriptions to UK companies, a retailer shipping to UK consumers and a free app with a UK user base are all offering. Monitoring covers behavioural advertising, tracking across sites, profiling and any analytics that follows identified individuals in the United Kingdom. An analytics tool on a site with UK visitors is often enough for the second limb even where the first is arguable.

The exemption in Article 27(2)

Article 27(2)(a) removes the obligation where the processing is occasional, does not include, on a large scale, processing of special categories of data under Article 9(1) or data relating to criminal convictions and offences under Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing. All three conditions must be met. Article 27(2)(b) exempts public authorities and bodies.

Occasional is the word that decides most cases and it is narrower than businesses hope. Processing that is part of the ordinary running of the business, such as maintaining a customer database, running an account system or serving targeted advertising, is not occasional however small the numbers. Occasional is a one off transaction with a UK customer, not a channel. A business that has decided to sell to the United Kingdom is, by that decision, outside the exemption.

What the representative is and is not

Article 27(4) sets the mandate. The representative must be mandated by the controller or processor to be addressed, in addition to or instead of the controller or processor, by the Information Commissioner and by data subjects on all issues related to processing, for the purposes of ensuring compliance. Article 27(5) adds that designation is without prejudice to legal actions which could be initiated against the controller or processor themselves. The representative is therefore a point of contact and service, not a shield. Liability for the processing stays with you.

The representative's details must appear where the law requires them. Articles 13(1)(a) and 14(1)(a) require the identity and contact details of the representative to be given to data subjects in the privacy notice, and Article 30 requires them in the records of processing. A representative appointed in writing but absent from the privacy notice is half an appointment and is the gap the ICO notices first.

What happens if you do not appoint one

Article 83(4)(a) places infringements of the obligations of the controller and processor under Articles 25 to 39 in the lower fining tier, with administrative fines up to £8,700,000 or, in the case of an undertaking, up to 2 per cent of total worldwide annual turnover of the preceding financial year, whichever is higher. Article 27 sits inside that range. The practical exposure is usually different from the headline: a UK customer complaint or a subject access request with no one in the United Kingdom to receive it, followed by an ICO enquiry to a business that has no compliant answer to the first question asked.

UK and EU: two appointments, not one

The EU GDPR contains an identical Article 27 requiring a representative established in one of the member states where the affected data subjects are, for a business outside the EU that targets or monitors people there. A United States company selling to both the United Kingdom and Germany needs a representative in each regime, and a representative located in Ireland satisfies the EU obligation but not the UK one. A UK business selling into the EU faces the mirror image and needs an EU representative; our EU GDPR compliance page deals with that side.

What the appointment should say

The designation must be in writing. A short mandate letter or service agreement should name the representative and its UK address, record that it is mandated under Article 27(4) to be addressed by the Commissioner and by data subjects on all issues related to processing, set out how correspondence is passed to you and within what time, and deal with termination, since a representative who resigns leaves you non compliant from that day. Alongside the appointment, the privacy notice and the Article 30 record are updated so that the representative is visible where the law requires.

Three questions that settle most cases

Do you have any establishment in the United Kingdom involved in the processing? If yes, Article 3(1) applies and no representative is needed. Do you offer goods or services to people in the United Kingdom, or monitor their behaviour there? If no, the UK GDPR does not reach you under Article 3(2) and no representative is needed. Is the processing occasional, free of large scale special category data, and unlikely to result in risk? Only if all three are true does Article 27(2)(a) excuse the appointment. Most trading businesses answer no to the first, yes to the second and no to the third, and need one.

Questions clients ask

Does having a UK website mean I need a representative?

Not by itself. The test in Article 3(2) is whether you offer goods or services to people in the United Kingdom or monitor their behaviour there. Sterling pricing, UK delivery and UK targeted marketing indicate offering; behavioural tracking of UK visitors indicates monitoring.

My business is tiny. Does the exemption apply?

Size is not the test. Article 27(2)(a) requires the processing to be occasional, free of large scale special category data and unlikely to result in risk. Regular sales to UK customers are not occasional whatever the turnover.

Can my EU representative cover the United Kingdom?

No. The UK GDPR requires a representative in the United Kingdom. An EU representative satisfies the EU GDPR only.

Does appointing a representative transfer liability?

No. Article 27(5) provides that the designation is without prejudice to legal actions against the controller or processor themselves.

What is the fine exposure?

Article 83(4) sets the ceiling at £8,700,000 or 2 per cent of worldwide annual turnover, whichever is higher, for infringements of Articles 25 to 39, which includes Article 27.