Since 1 January 2021 the United Kingdom is a third country under the GDPR. UK companies that previously relied on their UK establishment to be “in the Union” lost that status with the end of the transition period. A UK company that sells to customers in Germany or other EU Member States, or monitors their behaviour, and has no establishment in the EU must therefore appoint an EU representative under Art. 27 GDPR. Kanzlei Matutis provides this for UK companies from Germany for 350 EUR per year.
Does a company from the United Kingdom need an EU representative?
Yes, if it has no establishment in the EU and its processing of personal data relates to offering goods or services to people in the EU or to monitoring their behaviour there (Art. 3(2) in conjunction with Art. 27(1) GDPR). Examples: a London online retailer shipping to Germany and the Netherlands; a UK fintech app available in German; a UK recruitment platform that advertises to candidates in the EU; a Manchester SaaS company with EU customers and EUR pricing. A UK company that already has a subsidiary, branch or office in an EU Member State does not need a representative; that EU entity is the point of contact. The exceptions of Art. 27(2) GDPR (occasional, low-risk processing without large-scale sensitive data; public authorities) are narrow and rarely apply to a business that actively markets to the EU. The full criteria are explained on the page What is the legal situation?.
UK GDPR, the EU adequacy decision and the EU representative
The UK retained the GDPR as the “UK GDPR”, supplemented by the Data Protection Act 2018 and amended by the Data (Use and Access) Act 2025, supervised by the Information Commissioner’s Office (ICO). The European Commission has adopted an adequacy decision for the UK under Art. 45 GDPR, which allows EU companies to transfer personal data to the UK without additional safeguards. Neither the similarity of UK law to the GDPR nor the adequacy decision affects Art. 27 GDPR: a UK company without an EU establishment that targets people in the EU needs a representative in the EU, and its UK compliance programme does not fulfil this requirement. Conversely, UK companies with a subsidiary in Ireland, Germany or another Member State do not need a representative; that subsidiary is the contact point.
What we do as EU representative for UK companies
Rechtsanwaltskanzlei Matutis is a German law firm in Potsdam, near Berlin, specialised in data protection law. Under a written mandate pursuant to Art. 27(1) GDPR we act as your point of contact in the EU for all supervisory authorities of the Member States and for data subjects. Letters and emails addressed to us are checked, scanned and forwarded to your contact person without undue delay; we point out deadlines, such as the one-month period for data subject requests under Art. 12(3) GDPR. The time difference of one hour makes same-day communication straightforward. We communicate in English and German. We do not replace your Data Protection Officer and do not take over your compliance decisions; the difference is explained on the page EU representative vs. Data Protection Officer.
Cost for companies from the United Kingdom
The annual flat fee is 350 EUR. Because the service is provided by a German law firm to a business customer outside Germany, German VAT is not charged (reverse charge), so net equals gross. We invoice in EUR; payment by SEPA or SWIFT transfer, or by credit card or PayPal, is possible. Forwarding of scanned mail by email is included; postal forwarding of originals is charged at 2 EUR per item plus postage. Full details: What does it cost and what is included?
Next step
Send us your company name, website and a short description of your activities in the EU via the inquiry form. We confirm whether a representative is required in your case and send you the contract and written mandate. The complete process is described on the page How to appoint an EU GDPR representative. Other countries: EU representative by country.