This guide explains when the requirement applies, how to assess the available exemptions, what an EU Representative does, and how to document an appointment.
An EU Representative provides a designated point of contact for relevant supervisory authorities and individuals. Appointing one does not transfer your organisation's underlying GDPR responsibilities or remove its potential liability.
§GDPR Article 27 at a Glance
Article 27 requires certain controllers and processors that are not established in the EU to designate a representative in writing when GDPR Article 3(2) applies, unless a specified exception is available.
The requirement is particularly relevant to businesses based outside the EU that deliberately serve EU customers or monitor the behaviour of individuals in the EU.
Before appointing a representative, assess:
- Whether your organisation is established in the EU for GDPR purposes.
- Whether the relevant processing falls within Article 3(2).
- Whether an Article 27(2) exception applies.
- Where the representative must be established.
- What the written mandate and privacy disclosures need to cover.
The assessment should be based on your actual processing activities, business model, and target markets rather than website accessibility alone.
§Who Needs an EU Representative?
An organisation should assess the Article 27 requirement where it is not established in the EU and processes personal data within the territorial scope of GDPR Article 3(2).
Article 3(2) addresses two main situations.
Offering Goods or Services to Individuals in the EU
The GDPR may apply when an organisation outside the EU offers goods or services to individuals who are in the Union, whether or not payment is required.
Relevant indicators may include targeted advertising, EU-specific service offerings, delivery arrangements, or other evidence that the organisation intends to serve individuals in EU Member States.
However, the mere fact that a website can be accessed from the EU does not, by itself, establish that the organisation is offering goods or services to individuals there.
Monitoring Behaviour in the EU
The GDPR may also apply when an organisation monitors the behaviour of individuals in the EU, provided the monitoring takes place within the Union.
Depending on the circumstances, this can include tracking and profiling used to analyse or predict an individual's preferences, interests, behaviour, or movements.
Not every use of analytics or tracking technology automatically constitutes monitoring for Article 3(2). The purpose, nature, and context of the processing must be assessed.
What About Organisations With an EU Establishment?
Article 27 is directed at controllers and processors that are not established in the Union and whose processing falls within Article 3(2).
If your organisation has an EU establishment, assess GDPR applicability under Article 3(1) and the relevant establishment criteria. The existence of a subsidiary or branch should be considered alongside the actual arrangements and activities involved.
Practical takeaway: Determine GDPR territorial scope first. Do not assume that every non-EU company with EU website traffic must appoint an EU Representative.
§When Is an EU Representative Not Required?
Article 27(2) provides two exceptions to the representative requirement.
Occasional, Low-Risk Processing
The requirement does not apply where the processing meets all the conditions in Article 27(2)(a):
- The processing is occasional.
- It does not include large-scale processing of special-category personal data under Article 9(1) or personal data relating to criminal convictions and offences under Article 10.
- It is unlikely to result in a risk to individuals' rights and freedoms, taking account of the nature, context, scope, and purposes of the processing.
These conditions must be assessed together. Occasional processing alone is not sufficient, and an organisation should not assume it qualifies simply because it has relatively few customers.
Regular business operations, continuous processing, or ongoing monitoring may make this exception difficult to rely on, depending on the circumstances.
Public Authorities and Bodies
Article 27(2)(b) excludes public authorities and bodies from the representative requirement.
This exception should be assessed against the organisation's status and the relevant legal context. Commercial businesses should not assume that it applies to them.
Documenting the Decision
If your organisation concludes that an exception applies, document the reasons for that conclusion, including the relevant processing activities and supporting facts.
Reassess the decision when your business expands into new markets, introduces new processing activities, or changes how personal data is collected and used.
§What Does an EU Representative Do?
Under Article 27(4), the representative is mandated to be addressed, in addition to or instead of the controller or processor, by supervisory authorities and data subjects on matters relating to processing under the GDPR.
Depending on the written mandate, the representative's work may include:
- Serving as a designated contact for relevant supervisory authorities.
- Providing a contact point for individuals with questions or concerns about processing.
- Receiving and routing privacy-related correspondence to the organisation.
- Cooperating with supervisory authorities as required under the GDPR.
- Supporting the availability of relevant records and information within the scope of its mandate.
The organisation should establish clear internal processes for responding to communications received by its representative. Appointing a representative does not remove the need for appropriate internal ownership, escalation, and response procedures.
§Where Must the Representative Be Established?
Article 27(3) requires the representative to be established in a Member State where the individuals whose personal data is processed are located, in connection with the offering of goods or services to them or the monitoring of their behaviour.
Where an organisation serves individuals across several EU Member States, it should select an appropriate location based on the distribution of its relevant processing activities and the applicable legal requirements.
The representative must be designated in writing. The mandate should clearly identify the parties, define the scope of the representative's role, and establish practical arrangements for receiving and handling communications.
§How to Appoint an EU Representative
A structured appointment process helps ensure that the arrangement is properly documented and operational.
Assess GDPR Applicability
Determine whether Article 3(2) applies to your organisation's processing activities and whether either Article 27(2) exception is available.
Select an Appropriate Representative
Evaluate the proposed representative's establishment, ability to perform the mandated role, relevant experience, communication processes, and service scope.
Prepare a Written Mandate
Document the appointment and define responsibilities, contact arrangements, information access, escalation procedures, and the process for handling authority or individual communications.
Update Privacy Information
Where required, communicate the representative's identity and contact details in the applicable privacy information provided under Articles 13 and 14 GDPR.
Ensure that relevant notices and internal records remain consistent with the appointment.
Establish Ongoing Procedures
Assign internal responsibility for handling correspondence, meeting applicable response deadlines, maintaining relevant records, and informing the representative of changes that affect the mandate.
Review the appointment when your processing activities, geographic coverage, or service arrangements change.
§Publishing the Representative's Contact Details
Articles 13(1)(a) and 14(1)(a) GDPR require the identity and contact details of the representative, where applicable, to be provided in the relevant privacy information.
Organisations should review their privacy notices and related communications to ensure that the information is accurate, accessible, and consistent with the written mandate.
The exact disclosures required should be assessed in the context of the applicable transparency obligations and the organisation's processing activities.
§Does an EU Representative Take on the Company's Liability?
No. Article 27(5) expressly states that appointing a representative does not prejudice legal actions that may be initiated against the controller or processor itself.
The organisation remains responsible for its own applicable GDPR obligations. Appointment should therefore be treated as one element of a wider compliance programme rather than a substitute for lawful processing, appropriate security, transparency, and accountability.
The representative's own responsibilities depend on the GDPR and the scope of the mandate. The arrangement should clearly define how information is received, maintained, and made available when required.
§What Are the Penalties for Failing to Appoint a Representative?
Failure to comply with Article 27 can expose an organisation to administrative enforcement under the GDPR.
Article 83(4)(a) provides a maximum administrative fine of €10 million or, for an undertaking, 2% of its total worldwide annual turnover for the preceding financial year, whichever is higher, for specified infringements including Article 27.
These figures are statutory maximums, not automatic fines. The applicable penalty in a particular case depends on the GDPR's enforcement framework and the circumstances of the infringement.
Organisations should assess the requirement proactively and document their decisions rather than treating a representative appointment as a purely administrative formality.
§Common Mistakes to Avoid
- Assuming EU website traffic automatically triggers Article 27. Accessibility alone does not establish that goods or services are being offered to individuals in the EU or that behaviour is being monitored there.
- Treating the occasional-processing exception as a default. All conditions in Article 27(2)(a) must be satisfied.
- Confusing the representative with a Data Protection Officer. The roles have different legal purposes and requirements. EDPB guidance considers the role of an external EU Representative incompatible with that of an external DPO; organisations should assess the arrangements carefully.
- Appointing a representative without a clear mandate. A written designation should establish the representative's role and practical operating arrangements.
- Failing to update privacy information. Review applicable privacy notices when the appointment is made or changed.
- Assuming the appointment transfers GDPR accountability. The controller or processor remains responsible for its own obligations.
- Overlooking the distinction between EU and UK representation. The EU GDPR and UK GDPR have separate representative provisions and should be assessed independently.
§EU Representative vs UK Representative
The EU GDPR and UK GDPR contain separate provisions for representative appointments.
An organisation established outside the EU that is subject to Article 3(2) should assess the EU Article 27 requirement. Separately, an organisation outside the UK that falls within the relevant territorial scope of the UK GDPR should assess the UK representative requirement under the UK framework.
An appointment covering one jurisdiction should not be assumed to satisfy the other. The organisation should confirm the applicable scope, establishment requirements, mandate, and privacy disclosures for each appointment.
§Frequently Asked Questions
Does every non-EU company need an EU Representative?
No. The requirement generally applies where the organisation is not established in the EU, its processing falls within GDPR Article 3(2), and neither Article 27(2) exception applies.
Is a representative required if our website is accessible in Europe?
Not on that fact alone. The organisation must assess whether it offers goods or services to individuals in the EU or monitors their behaviour there, alongside the other relevant criteria.
Can an EU Representative also be our Data Protection Officer?
These are distinct roles. EDPB guidance considers the role of an external representative incompatible with that of an external DPO. Organisations considering combined arrangements should obtain a role-specific assessment rather than assume that one appointment satisfies both requirements.
Do we need a separate representative in every EU Member State?
Article 27(3) requires the representative to be established in a Member State where the relevant data subjects are located. A single appropriately established representative may serve an organisation's covered activities across multiple Member States, subject to the applicable requirements and scope of the mandate.
Can an EU Representative replace our legal adviser?
No. A representative provides the contact and cooperation functions defined by the GDPR and the mandate. It should not be assumed to replace legal counsel or provide every service required for a broader compliance programme.
Does appointing an EU Representative remove our liability?
No. Article 27(5) preserves the possibility of legal action against the controller or processor. The appointment does not transfer the organisation's underlying GDPR obligations.
When should we appoint an EU Representative?
Where Article 27 applies and no exception is available, the organisation should arrange the appointment as part of its preparations for the relevant processing. The applicability assessment and appointment should be completed in a timely manner rather than left until an authority or individual contacts the business.
Assess Your EU Representation Requirements
Understanding whether Article 27 applies is the first step towards establishing the right representation arrangements.
RegulatoryBridge helps organisations assess regulatory obligations and establish practical privacy representation arrangements. Our support can help you evaluate applicability, understand appointment requirements, document the mandate, and establish processes for handling relevant communications.
Explore our GDPR compliance services or contact RegulatoryBridge to discuss your EU representation requirements.