Setting Up a Business Website in Germany After Brexit

British companies expanding into Germany now navigate a different legal landscape than they did before 2021. The UK is no longer part of the EU's single market or its data protection framework in the same way, which has practical implications for German websites operated by UK entities.

This guide is for UK companies that either already have German clients or are actively expanding into the German market and need to understand what their website needs to comply with.

What Actually Changed After Brexit

Before January 2021, a UK company operating in the EU operated under a unified legal framework. Post-Brexit, several things changed that directly affect websites:

• Data protection jurisdiction: The UK is now a "third country" under EU GDPR. Data transfers from EU users to UK-based systems must comply with GDPR Chapter V, using adequacy decisions, standard contractual clauses (SCCs) or binding corporate rules
• EU representative requirement: GDPR Article 27 requires non-EU companies that process EU personal data to appoint an EU-based representative. A UK company with German customers may now need one
• Existing EU subsidiaries: UK companies with German GmbHs or German branches remain subject to EU GDPR for those entities, as before - but the relationship between the UK parent and the German subsidiary now involves cross-border data transfers that need to be documented
• UK GDPR: The UK retained a version of GDPR (UK GDPR) which applies domestically. For UK-to-EU data flows, a separate adequacy decision is in place, but it is time-limited and subject to renewal

What Didn't Change

Several things are the same as before Brexit for UK companies operating German-facing websites:

• EU GDPR still applies to your website if you target German users - Brexit didn't change the targeting criterion
• The German Impressum requirement (TMG) still applies to any commercial website targeting German users, regardless of where the company is based
• German cookie consent rules are the same - consent before tracking, equal prominence for accept and reject
• A German Datenschutzerklärung is still required on your German-facing website

The Impressum for UK Companies

This is the most common compliance gap for British companies entering Germany. The German Telemedia Law (TMG) requires every commercial website targeting German users to display a complete legal notice reachable within two clicks from every page.

For a UK Ltd. operating a German-facing website, the Impressum must include:

• Full company name: e.g., "Smith Digital Ltd."
• Registered address: your UK registered address is valid - P.O. boxes are not
• Company registration number: your Companies House number
• Direct contact: phone number or email address (a contact form alone doesn't satisfy the requirement)
• If VAT registered in Germany (if applicable): your German VAT ID (DE-number)
• If you have a German GmbH: that entity's information separately, including Amtsgericht registration and all managing directors

GDPR Compliance for UK Companies Targeting Germany

The EU representative requirement (GDPR Article 27)

If your UK company processes personal data of EU residents and has no establishment in the EU, GDPR Article 27 requires you to designate an EU representative in writing. This is a person or company located in the EU (typically in the country where most of your EU data subjects are located - in your case, Germany) who can be contacted by EU supervisory authorities and data subjects.

This representative is NOT a data protection officer (DPO). The DPO role is separate. An Article 27 representative is specifically a contact point for regulators and individuals in the EU.

Companies exempt from this requirement: those that process EU personal data only occasionally, on a small scale, without high risk, and with no special categories of data. Most UK companies actively marketing in Germany are not exempt.

Data transfer documentation

When an EU-based user submits a contact form on your website and that data flows to your UK-based CRM or email system, this is a cross-border data transfer from the EU to a third country (UK). You should document this in your privacy policy and - to be safe given the uncertainty around the adequacy decision - implement standard contractual clauses with your UK-based data processors.

Privacy policy requirements

Your German Datenschutzerklärung (privacy policy) must disclose:

• That data may be transferred to the UK (now a third country under EU GDPR)
• The legal basis for that transfer (adequacy decision, SCCs or other Article 46 mechanism)
• Where to find the relevant adequacy decision or SCCs if a user wants to verify compliance
• Contact details for your EU representative under Article 27, if you have appointed one

Domain Strategy for UK Companies in Germany

The .eu domain situation changed after Brexit: UK entities can no longer hold .eu domains. If you had a .eu domain as a UK entity, you will have already lost access to it. For new German market entry:

• .de: Requires a German legal entity or a postal address in Germany. If you have a German GmbH, branch or registered agent, this is available. Best option for German SEO and local credibility
• .com: No restrictions. Works well for international companies presenting in English and German. Less local signal in German search than .de
• .co.uk: Sends a clear British signal - fine for UK-focused content but counterproductive for targeting German customers who expect local operators

For most UK companies expanding into Germany, the practical answer is a .com with German-language content and a German address in the footer - either your German GmbH or a registered agent address. This satisfies the Impressum requirement and gives you reasonable German search visibility without requiring a separate .de registration.

Pre-Launch Checklist for UK Companies

• Impressum with UK company details - full legal name, registered UK address, Companies House number, direct contact
• German Datenschutzerklärung - specific to your site, disclosing UK data transfers and legal basis
• Cookie consent - blocking non-essential scripts until acceptance, with genuine reject option
• EU representative under Article 27 - if you're actively marketing to German users at scale
• Standard contractual clauses - documented for EU-to-UK data transfers via contact forms and analytics
• Data processing agreements - with your German hosting provider, if applicable
• Domain strategy confirmed - .com or .de with correct entity assignment
• SSL certificate active across all pages

FAQ