At this moment, the future of the UK GDPR remains uncertain. It’s unclear whether the government will move forward with the Data Protection and Digital Information Bill announced over the summer, or whether Michelle Donelan’s promise to replace the UK GDPR with a British data protection system(1) will see a greater departure from existing legislation. Either way, there will undoubtedly be important changes to discuss and debate as we go. This includes the proposal in the current version of the Bill to remove Article 27 of the UK GDPR, which would mean overseas controllers and processors without an office or other establishment in the UK but that offer goods or services in the UK or monitor the behaviour of UK data subjects would no longer be required to appoint a UK representative as their local point of contact. This proposal threatens the ability of data subjects to exercise their rights, weakens the ICO’s international enforcement capabilities and would leave overseas organisations to face the complexities of competing regimes in an ever-changing data ­protection ­landscape alone.