UK GDPR Support for New Zealand Companies

If UK GDPR applies to you and you have no establishment in the UK, then yes, Article 27 requires you to appoint one in writing. The exemption is narrow: occasional processing, no large-scale special category or criminal offence data, and unlikely to result in a risk to individuals. An ongoing UK customer base will not qualify. The representative must be named in your privacy notice and must be a real, responsive point of contact for UK individuals and the ICO. If you also sell into the EU, note that a UK representative and an EU representative are separate appointments – since Brexit, neither satisfies the other.

You will be ahead on breach response, because the mandatory notifiable privacy breach regime already gives you an assessment and notification process – the UK’s 72-hour ICO duty is tighter but the process exists. The real work is in four places. First, identifying and recording an Article 6 lawful basis for every processing activity, plus an Article 9 condition for special category data. Second, the wider rights set: erasure, portability, objection and rights around solely automated decisions. Third, documentation: a record of processing activities, DPIAs for high-risk processing, documented retention. Fourth, the DPO question under Article 37. For most mid-sized New Zealand businesses that is a defined project, not a permanent overhead.

No. An Article 27 representative is a UK-based contact point required because you have no UK establishment; its function is accessibility for individuals and the regulator. An Article 37 DPO is an advisory and monitoring role with statutory independence, required where you are a public authority, carry out large-scale systematic monitoring, or process special category data at scale. The two roles have different purposes and different triggers, and one person or provider holding both can create a conflict. We assess both at the same time so you appoint what you actually need.

UK GDPR penalties reach the higher of GBP 17.5 million or 4% of total worldwide annual turnover for the most serious infringements, with a lower tier of GBP 8.7 million or 2% for others – a different order of magnitude from New Zealand, where statutory offences under the Privacy Act carry modest fines and the larger financial exposure runs through Human Rights Review Tribunal awards. In reality, most New Zealand businesses feel the commercial consequence first: UK B2B buyers run data protection due diligence, and a missing Article 27 appointment or privacy notice is an obvious gap on a procurement questionnaire.

You will usually need an Article 28 processor agreement, even though no IDTA is required. Adequacy removes the transfer mechanism requirement; it does not remove your UK client’s obligation to have a compliant processor contract in place, with the mandatory terms on purpose limitation, security, sub-processors, audit and deletion. If you then send that data onward to a country without UK adequacy – Australian hosting, United States infrastructure, offshore support – that onward transfer does need a mechanism. Having your sub-processor list and hosting regions documented and ready is the fastest way to clear a UK client’s due diligence.

No. We are a UK data protection practice and we will not claim New Zealand law expertise. What we do is show you exactly where the Privacy Act 2020 and UK GDPR diverge, build the UK-side compliance, and work alongside your New Zealand advisers so your two sets of documents agree with each other rather than contradict.