Skip to content

    EU & UK GDPR · Articles 27 and 22

    Your roadmap to GDPR readiness

    Six steps that take a US, UK, or Swiss company from scattered paperwork to defensible GDPR compliance — covering your Article 27 representative, Article 22 automated decision safeguards, and the ongoing advisory work that keeps it all current.

    The six steps

    Step 1 · Start now · Articles 5(2), 24, 30

    Establish accountability and your record of processing

    You must be able to demonstrate compliance, not just claim it. That starts with a named owner and a written record of what personal data you process and why.

    • Name an accountable owner — a DPO where Article 37 requires one, otherwise a documented responsible person.
    • Map every personal data flow: sources, systems, storage locations, recipients, and international transfers.
    • Maintain an Article 30 record of processing activities and keep it under version control.
    • Document your governance: policies, training, and how decisions about personal data get approved.

    Step 2 · Weeks 1–4 · Articles 6, 13, 14 · ePrivacy

    Fix your lawful bases and transparency

    Every processing purpose needs a lawful basis on record, and the people affected need to be told about it in plain language before you process.

    • Record a lawful basis for each purpose — and a documented legitimate interests assessment where you rely on Article 6(1)(f).
    • Refresh your privacy notice so it covers purposes, bases, retention, recipients, transfers, and rights.
    • Ensure non-essential cookies and trackers default to off, with genuine granular consent and an equally easy refusal.
    • Keep evidence of consent where consent is the basis: what was shown, when, and by whom it was given.

    Step 3 · Before offering goods or services in the EU/UK · Article 27 EU GDPR · Article 27 UK GDPR

    Appoint your Article 27 representative

    If you are established outside the EU or UK but target or monitor people inside it, you must appoint a representative in writing in one of the Member States (and separately in the UK) where those people are.

    • Confirm whether Article 3(2) applies to you: offering goods or services to, or monitoring the behaviour of, EU or UK individuals.
    • Appoint the representative by written mandate, covering record custody, authority liaison, and handling of data subject enquiries.
    • Publish the representative's identity and contact details in your privacy notice so individuals and regulators can use them.
    • Check the Article 27(2) exemptions before concluding you are out of scope — occasional, low-risk processing only.

    Step 4 · Weeks 2–6 · Articles 12–22

    Operationalise rights, including Article 22 automated decisions

    Rights requests have a one-month statutory clock, and any solely automated decision with legal or similarly significant effect brings extra Article 22 duties.

    • Document an end-to-end process for subject access, erasure, rectification, portability, and objection — answered within one month.
    • Identify any solely automated decision-making or profiling with legal or similarly significant effects on individuals.
    • For those decisions, confirm an Article 22(2) exception applies and provide meaningful information about the logic involved.
    • Guarantee human intervention, an explanation, and a route to contest the decision — and evidence that the safeguard works.

    Step 5 · Weeks 2–8 · Articles 28, 32, 33, 34

    Secure the data and control your processors

    Security failings and missing processor contracts are the two most commonly penalised gaps. Both are fixable with documentation you can produce on request.

    • Sign Article 28 data processing agreements with every vendor that touches personal data, with transfer safeguards where relevant.
    • Encrypt personal data at rest and in transit, and record your technical and organisational measures under Article 32.
    • Run a breach procedure that can notify the regulator within 72 hours and affected individuals without undue delay.
    • Keep an internal breach register — including incidents you decide are not notifiable, with the reasoning.

    Step 6 · Ongoing advisory · Articles 5(1)(e), 24, 35

    Keep compliance current

    GDPR compliance is a standing obligation. New products, vendors, and markets change your risk profile — the paperwork has to move with them.

    • Enforce a retention schedule that deletes or anonymises personal data once its purpose has been met.
    • Trigger a DPIA for high-risk processing: new AI features, large-scale profiling, sensitive data, or systematic monitoring.
    • Review the record of processing, notices, representative mandate, and DPAs at least annually or on material change.
    • Keep a dated remediation log so you can show a regulator the direction of travel, not just the current state.

    Not sure where you stand?

    Take the 2-minute GDPR Health Check for a scored assessment against these steps, or talk to us about acting as your Article 27 representative with ongoing compliance advisory.

    Disclaimer: This roadmap is provided for informational purposes only and does not constitute legal advice. VeriSure Compliance recommends consulting a qualified legal professional for advice specific to your circumstances.