EU/UK data-subject exposure but no Article 27 representative named
GDPR (General Data Protection Regulation) Article 27 requires certain non-EU businesses that offer goods or services to, or monitor, people in the EU or UK to appoint and name a local representative in their privacy policy. This check looks at whether the site targets or mentions EU/UK users while being based outside the EU/UK, and whether a representative is named. On this site, EU/UK exposure was found, but no representative is named in the policy.
Why this matters
Under GDPR Article 27 and the UK GDPR, some organisations outside the EU or UK that offer goods or services to people there must appoint a representative. It does not apply to every business, and exemptions exist, so check with a privacy adviser. Where it applies, a named representative gives regulators and individuals a formal contact point, and enterprise due diligence may ask about it.
How to fix it
If the business genuinely has EU or UK customers, your privacy lawyer should appoint a formal EU representative, and a UK one too since UK GDPR is separate, and name them, along with a contact address, in the privacy policy. Several services offer this as a low-cost ongoing subscription rather than requiring an in-house appointment, so this is typically about a day to set up.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit