Home
5
Services
5
UK GDPR Support for Australian Companies

UK GDPR Support for Australian Companies

If your Australian business offers goods or services to people in the UK, or monitors their behaviour online, UK GDPR applies to you directly - regardless of where your servers or your staff sit. We tell you plainly whether you are in scope, act as your UK representative where Article 27 requires one, and build the documentation the ICO would actually ask to see, translated from APP language into UK GDPR terms.



Speak to an expert
01234 923643

Data protection expertise trusted by hundreds of organisations.

Get a Fast UK GDPR Support for Australian Companies Quote

Australian compliance does not make you UK compliant - the two regimes diverge where it matters

Australian organisations that have done the work on the Privacy Act 1988 often assume they are most of the way there. On principles like transparency, security and accuracy, they are. On the things UK enforcement actually turns on, they are not.

The Privacy Act works through 13 Australian Privacy Principles and does not require a lawful basis for each processing activity. UK GDPR does: every use of personal data needs one of the six Article 6 bases identified and recorded, and consent has a much narrower and more demanding definition than Australian practice usually assumes. UK GDPR also gives individuals rights the Privacy Act does not – erasure, portability, objection, and rights around solely automated decisions – each with a statutory response deadline.

Then there is the documentation. UK GDPR expects a record of processing activities, DPIAs for high-risk processing, documented retention periods, and a demonstrable accountability trail. The APPs require a privacy policy and reasonable steps; UK GDPR requires evidence. That gap is where Australian businesses entering the UK get caught.

Align Your AU Privacy to UK Rules

Are you actually in scope? The honest answer is often no

UK GDPR reaches beyond the UK under Article 3(2), but not as far as some compliance vendors imply. It catches you if you offer goods or services to individuals in the UK – which means deliberately targeting them, not merely being visible to them – or if you monitor the behaviour of individuals in the UK, which is where analytics, advertising pixels, cookies and behavioural profiling bring in businesses that have no UK operations at all.

A GBP price list, a .co.uk domain, UK shipping options, UK-targeted advertising, or UK-specific content all point towards targeting. A purely Australian site that happens to receive UK visitors generally does not.

We give you a written scope assessment rather than a sales answer. If you are out of scope, we will tell you, and you will have a documented reason for that conclusion – which is worth more than a representative appointment you did not need.

How we support Australian businesses with UK GDPR

A written scope assessment first

We assess whether Article 3(2) actually catches you - targeting, monitoring, or neither - and give you the conclusion in writing. If you are out of scope, you get a documented reason instead of an unnecessary retainer.

UK Article 27 representative services

Appointment in writing, a UK point of contact named in your privacy notice, correspondence from UK individuals and the ICO handled, and your record of processing held and maintained on our side.

APP-to-UK GDPR gap analysis

We take the compliance work you have already done under the Privacy Act 1988 and show you exactly what UK GDPR adds: lawful bases, the wider rights set, DPIAs, retention and the accountability evidence trail.

UK-facing privacy notice and rights procedures

A privacy notice that meets Articles 13 and 14 for your UK audience, plus a data subject rights process that can realistically answer a UK request inside the one-month deadline.

Transfer paperwork your UK customers will ask for

IDTA or UK Addendum plus a Transfer Risk Assessment, prepared from the importer's side, so UK procurement and due diligence questionnaires stop being a blocker.

UK-based specialists, not an offshore mailbox

Your work is led by a named lead practitioner from our UK team of experienced, certified privacy professionals, with CIPP/E, CIPM, FIP and GDPR Practitioner qualifications among them.

Article 27: what a UK representative actually is, and when you need one

Where UK GDPR applies to an organisation with no UK establishment, Article 27 requires the appointment of a representative in the UK, in writing, named in your privacy notice and available to individuals and to the ICO. There are narrow exemptions – notably for occasional processing that does not involve large-scale special category data and is unlikely to result in risk – but most Australian businesses with a genuine UK customer base will not meet them.

A representative is not a mailbox and it is not a DPO. The role is to be a point of contact for UK data subjects and the regulator, to maintain a copy of your record of processing, and to be somewhere the ICO can address correspondence and actually get a response. Appointing a representative also does not transfer your liability – you remain accountable.

We act as UK representative from a UK address, handle the correspondence that arrives, and escalate to you with a recommendation rather than a forwarded email. Where a DPO is also required under Article 37, we will tell you, because those are separate appointments that are frequently conflated.

What we do, in order

We start with a scope assessment, because everything else depends on it. If UK GDPR applies, we work through the documentation in priority order: lawful bases mapped to your actual processing, a UK GDPR-compliant privacy notice for your UK-facing audience, a record of processing activities, a data subject rights procedure that can meet the one-month deadline, a breach response process built around the ICO’s 72-hour reporting duty, and retention periods you can defend.

Alongside that we handle the transfer question in both directions. Australian organisations receiving UK personal data are on the receiving end of a restricted transfer, so your UK customers and partners will ask you for an IDTA or UK Addendum and a completed Transfer Risk Assessment. Having those ready is a commercial advantage in UK procurement, not just a compliance item.

The work is delivered by UK-based, certified privacy professionals who deal with the ICO as a matter of routine. Where a question needs a definitive Australian law position, we say so and work with your Australian advisers rather than pretending the two regimes are one job.

Does UK GDPR apply to an Australian company with no UK office?

It can. Article 3(2) applies UK GDPR to controllers and processors outside the UK where they offer goods or services to individuals in the UK, or monitor the behaviour of individuals in the UK. Having no UK entity, staff or servers does not take you out of scope. The test is what you do, not where you are. Deliberate targeting – GBP pricing, UK shipping, UK-directed advertising, a UK domain – points to scope; incidental UK visitors to an Australian site generally do not. Behavioural monitoring through cookies, pixels and analytics is the route that catches most businesses by surprise.

Do we need a UK representative as well as an EU representative?

If you are in scope of both UK GDPR and EU GDPR, yes – they are now two separate regimes and one appointment does not satisfy the other. Since Brexit, an EU-based representative has no standing with the ICO, and a UK representative has none with EU supervisory authorities. Australian businesses selling across Europe and the UK typically need both. We can act as your UK representative and coordinate with your EU appointment so the two privacy notices stay consistent.

Is a UK representative the same as a Data Protection Officer?

No, and this is the most common misunderstanding we see. A representative under Article 27 is a contact point in the UK for individuals and the ICO, required because you have no UK establishment. A DPO under Article 37 is an advisory and oversight role, required in specific circumstances – public authority, large-scale systematic monitoring, or large-scale special category processing – and must be able to act independently. You may need one, both, or neither. We assess both questions at the same time and tell you which applies.

We comply with the Australian Privacy Act. How much more work is UK GDPR?

Less than you fear on operational security and transparency, more than you expect on documentation and legal basis. The main additions are: identifying and recording an Article 6 lawful basis for every processing activity; a materially broader set of individual rights with statutory deadlines; DPIAs for high-risk processing; documented retention periods; and an accountability trail that shows compliance rather than asserting it. For most mid-sized Australian businesses this is a defined project rather than an ongoing burden, followed by a light maintenance cycle.

Our UK customers are asking for an IDTA. What is that?

When a UK organisation sends personal data to you in Australia, that is a restricted transfer under UK GDPR, and Australia has no UK adequacy decision. The UK exporter needs an Article 46 safeguard – normally the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses – plus a Transfer Risk Assessment. Your customer is asking you to sign the importer’s side. Having a populated version ready, with your technical and organisational measures already documented, removes a genuine friction point in UK sales cycles.

What happens if we ignore UK GDPR?

Two separate regulators, with two separate ceilings. Your Australian exposure is already substantial: the civil penalty for a serious interference with privacy under section 13G of the Privacy Act 1988 is, for a body corporate, the greatest of A$50 million, three times the benefit obtained from the conduct, or 30% of adjusted turnover for the breach turnover period. UK GDPR does not replace that, it sits on top of it. Fines under UK GDPR reach the higher of GBP 17.5 million or 4% of total worldwide annual turnover for the most serious breaches, with a lower tier of GBP 8.7 million or 2%, and the ICO can act against organisations established outside the UK. In practice, though, enforcement is rarely the first consequence. The commercial consequences arrive sooner: UK B2B buyers run data protection due diligence, UK partners ask for a named representative and a DPA, and a missing Article 27 appointment is a visible gap in any procurement questionnaire.

Can you also advise us on Australian privacy law?

No, and we would not claim to. We are a UK data protection practice. We can tell you where UK GDPR and the Privacy Act 1988 point in different directions, and we work alongside your Australian legal advisers so the two sets of documents agree with each other – but a definitive position on Australian law should come from an Australian adviser.