EU and UK Representative Services

Under Article 27 of the EU GDPR (General Data Protection Regulation), your organisation must appoint an EU representative if it:

• Is based outside the EU.

• Processes or controls the processing of EU residents’ personal data – either by offering goods or services, or by monitoring behaviour.

The EU representative acts as a local contact for data subjects and supervisory authorities in relation to all issues arising from the processing of personal data.

The NIS2 Directive applies to:

• Essential entities – including qualified trust service providers, top-level domain name registries, DNS service providers, medium-sized or larger public electronic communications network providers, and larger organisations in sectors of high criticality (such as energy, transport, health and digital infrastructure); and

• Important entities – other medium-sized or larger organisations in NIS2’s listed sectors that don’t meet the essential entity criteria.

UK organisations that provide services to organisations in these sectors within the EU, operate EU-based infrastructure or form part of EU supply chains may fall in scope, and may need to designate an EU representative as a point of contact for EU regulators.

Under the EU AI Act, organisations outside the EU that offer AI systems within the EU must appoint a representative to ensure regulatory accountability and communication with EU authorities.

The EU representative acts as your official point of contact for EU national authorities, handling registration requirements, maintaining technical documentation for regulator inspection, and reporting serious incidents involving high-risk AI systems. They also support your organisation with wider AI Act obligations, including risk management, transparency and conformity assessment.

Under Article 27 of the UK GDPR, your organisation must appoint a UK representative if it:

• Is based outside the UK.

• Processes or controls the processing of UK residents’ personal data – either by offering goods or services, or by monitoring behaviour.

The UK representative acts as a local contact for data subjects and supervisory authorities in relation to all issues arising from the processing of personal data.

Under Section 8A of the NIS Regulations, OES (operators of essential services) based outside the UK that provide essential services within the UK must nominate a person to act on their behalf in the UK.

Under Section 14A, larger RDSPs (relevant digital service providers) based outside the UK that offer digital services within the UK must designate a representative in the UK.

GRC Solutions can fulfil that role for both, acting as a point of contact in the UK.