Article 27 of the UK GDPR requires any controller or processor outside the United Kingdom that offers goods or services to people in the UK, or monitors their behaviour, to designate a representative in the UK in writing. Western Legal Corporation Limited, a company established in England, acts as that representative: the named UK contact for the Information Commissioner and for UK individuals, holding your records and passing every communication to you the same day. Appointed on a short written service contract, exactly as the ICO describes.
Handled entirely in writing. No hearings, no meetings, no attendance required.
Prefer WhatsApp? Message us
Written advice within 24 hours of instruction. Trademarks filed within 48 hours of instruction. Documents in days, not weeks. Never "3 to 5 business days" just to hear back.
| Item | What it covers | Fee |
|---|---|---|
| UK representative appointment, annual | Western Legal named as your Article 27 representative for twelve months: written designation, our details for your privacy notice and Article 30 records, a copy of your records of processing held and produced to the ICO on request, and every enquiry from the ICO or a UK individual forwarded to you the same working day. Annual fee quoted in writing on the scope of your processing. | Quoted in writing |
| Do we need one? Applicability check | A written answer on whether Article 3(2) and Article 27 apply to you, and whether the occasional processing exemption is available, against the facts of your business. | from £395 |
| UK privacy notice and Article 30 records | Your privacy notice and records of processing brought into line with the UK GDPR, with the representative details in the right places. | from £595 |
| Full UK GDPR pack | Privacy notice, cookie policy, internal data protection policy, retention schedule and subject request procedure, drafted to your actual processing. | from £1,150 |
| Data processing agreement | Controller to processor DPA drafted or reviewed under the UK GDPR. | from £550 |
| Subject access or erasure response | A compliant, proportionate response to a request from a UK individual, drafted for you to send. | from £550 |
| ICO correspondence and incident support | Written handling of an ICO enquiry, a complaint or a breach notification decision, per matter. | from £395 |
Your fixed fee is confirmed in writing once I have seen your document. Pay within 24 hours of that confirmation for the reduced fee.
Bespoke and urgent matters outside the schedule: £650 per hour, capped estimates given in advance. Corporate retainers from £995/month.
Article 27 applies where Article 3(2) applies: you are not established in the UK, and you either offer goods or services to people in the UK or monitor their behaviour. The exemptions are narrow: public authorities, and processing that is occasional, does not include large scale special category or criminal offence data, and is unlikely to result in a risk to individuals.
Under Article 27(4) the representative is mandated to be addressed, in addition to or instead of you, by the Commissioner and by data subjects on all issues related to processing. In practice that means a UK address on your privacy notice, a contact the ICO can write to, and someone who reads and forwards what arrives.
When the ICO writes, the first reply matters. A representative who is also a Solicitor of England and Wales can tell you what the letter means and what the response should be, on a fixed fee, before anything goes back.
Any controller or processor not established in the UK that offers goods or services to individuals in the UK, or monitors their behaviour, under Article 3(2) of the UK GDPR. It applies to EU companies as much as to US, Indian or Gulf companies: an EU establishment does not count as a UK one.
Two. Public authorities and bodies. And processing that is occasional, does not include large scale processing of special category data or criminal offence data, and is unlikely to result in a risk to the rights and freedoms of individuals, taking into account its nature, context, scope and purposes. Most businesses selling online to UK customers do not qualify for the second exemption. We check it against your facts for a fixed fee.
The ICO says the representative may be an individual, a company or an organisation established in the UK, able to represent you regarding your UK GDPR obligations, and that the easiest way to appoint one is under a simple service contract. Western Legal Corporation Limited is a company registered in England, number 10453250.
No. Article 27(5) says the designation is without prejudice to legal actions against the controller or processor. The representative is your point of contact, not your insurer.
If you offer goods or services to people in the EU from outside the EU, EU GDPR Article 27 requires a representative established in an EU member state. That is a separate appointment under separate law. We do not act as EU representative; we advise on EU GDPR applicability and compliance from London and can introduce an EU representative through our correspondent network.
Your privacy notice must give the identity and contact details of your representative, under Articles 13 and 14. Your Article 30 records must also name the representative. Both are included in the privacy notice and records item on the schedule.
Send a brief outline of your matter. You will receive a personal reply from a solicitor, with a fixed-fee quote where the scope is clear. Payment is taken before work begins; every fee is fixed in writing first.
UK · EU · US · International