Article 27 UK GDPR Representative
The UK contact point for organisations based outside the United Kingdom
UK Privacy Solutions Limited is appointed under Article 27 of the UK GDPR as the UK representative for data controllers established outside the United Kingdom. If a privacy notice directed you here, this is where to reach us.
Making a request
You can contact us about access to your personal data, rectification, erasure, restriction, portability, objection, withdrawing consent, or any general enquiry about how an organisation we represent is using your information.
Get in touch
Email us, or write to our Belfast address. Tell us which organisation your request concerns and what you are asking for. You do not need to use any particular form of words.
We log and pass it on
We record your request with the date we received it and pass it to the organisation we represent, so they can deal with it.
They respond to you
Under Article 12(3) of the UK GDPR the organisation must respond without undue delay and within one month of receiving your request. In limited cases that period can be extended, and they must tell you if it is.
Where to reach us
- Telephone
- +44 28 9560 9328
- Post
- UK Privacy Solutions Limited, Titanic Suites, 55-59 Adelaide Street, Belfast BT2 8FE, United Kingdom
Email is the quickest route and gives us a clear record of when your request arrived. If you leave a voicemail, please include an email address or postal address so we can reply.
What an Article 27 representative is
Under Article 3(2) of the UK GDPR, the UK GDPR applies to organisations outside the United Kingdom that offer goods or services to people in the UK, or monitor their behaviour. Article 27 then requires those organisations to designate, in writing, a representative established in the United Kingdom.
The point of the role is practical. Without a UK representative, someone here wanting to exercise their data protection rights would be writing to a company in another country with no UK address and no straightforward route to recourse. The representative is the party that the Information Commission and data subjects can address directly, in the UK, on all issues relating to the processing.
Alongside acting as that contact point, we maintain the record of processing activities required by Article 30 and make it available to the Information Commission on request.
What we do not do
It is worth being clear about the limits of the role, so you know what to expect from us and what to take up with the organisation itself.
We do not decide the outcome
Whether a request is granted, and what information is disclosed, is decided by the organisation that holds your data. They remain the data controller and they are responsible for those decisions.
We do not hold their records about you
We are not given access to the organisation’s systems or databases. What we hold is your correspondence with us and a log of the requests we have passed on.
We are not a Data Protection Officer
A Data Protection Officer under Article 37 is a separate statutory role, and we do not hold it. We also do not provide data protection advice or compliance consultancy.
If you are not satisfied with how an organisation has handled your request, you can complain to the Information Commission, the UK supervisory authority for data protection.