If your organisation is located outside the EU/EEA but processes personal data of people in the European Union, you may need to appoint an EU Representative under Article 27 of the GDPR.
Answer five questions to get an indicative assessment of whether the Article 27 representative requirement is likely to apply to your organisation.
Estimated completion time: 1 minute
What Does an EU Representative Do?
An EU Representative acts as a point of contact in the Union for certain GDPR-related communications.
Under Article 27, the representative is designated in writing and can be addressed by:
- Data subjects
- Supervisory authorities
- Other relevant parties
The representative acts on behalf of the controller or processor within the scope of the written mandate.
The appointment of a representative does not transfer the controller's or processor's GDPR responsibility or liability to the representative.
EU Representative vs DPO
An EU Representative is not the same as a Data Protection Officer (DPO).
| EU Representative | Data Protection Officer |
|---|---|
| Relevant primarily to certain organisations not established in the EU | Required only in circumstances specified by GDPR |
| Acts under a written mandate | Must perform DPO duties with appropriate independence |
| Serves as a contact point for certain GDPR matters | Advises, monitors and supports GDPR compliance |
| Can interact with data subjects and supervisory authorities | Has specific statutory DPO responsibilities |
| Does not replace the controller/processor's responsibility | Does not replace the controller/processor's responsibility |
The EDPB has specifically stated that the representative function is not compatible with the role of an external DPO because of the different mandates and independence requirements.
Where Should an EU Representative Be Established?
Article 27 requires the representative to be established in one of the EU Member States where the relevant data subjects are located in connection with the offering of goods or services or where their behaviour is monitored.
An organisation operating across multiple EU countries does not necessarily need a separate representative in every Member State.
The EDPB's guidance indicates that one representative can act for multiple processing activities falling within Article 3(2), provided the applicable requirements are satisfied.
Do I Need an EU Representative if I Only Have a Few EU Customers?
Not necessarily.
The number of EU customers is only one factor. The analysis depends on whether Article 3(2) applies and whether the Article 27(2) exception applies.
A low customer count does not automatically create or remove the obligation.
Does an EU Representative Make My Company GDPR Compliant?
No.
An EU Representative is one element of GDPR governance where Article 27 applies.
Your organisation remains responsible for its GDPR obligations, including:
- Lawful processing
- Transparency
- Data subject rights
- Security
- Data breach management
- International transfers
- Processor management
- Accountability
The representative requirement should therefore be treated as part of a broader GDPR compliance programme.
What Happens If I Do Not Appoint a Required Representative?
Failure to satisfy an applicable Article 27 requirement can create regulatory compliance exposure.
An EU Representative does not eliminate the underlying GDPR obligations, but where Article 27 applies, organisations should document the designation and ensure that the representative has an appropriate written mandate.
Get Your EU Representative Requirement Assessed
Not sure whether Article 27 applies to your organisation?
RegulatoryBridge can help you:
- Assess GDPR territorial scope
- Determine Article 27 applicability
- Review Article 27(2) exceptions
- Establish an EU Representative
- Prepare representative documentation
- Update privacy notices
- Establish data-subject communication processes
- Support regulatory communications
- Monitor ongoing GDPR requirements
Know Your Requirement. Appoint With Confidence.