Do you need an EU representative under the GDPR? (Article 27 explained)

If your company is based outside the European Union but reaches people inside it — by offering them goods or services, or by monitoring their behaviour — the GDPR can apply to you, and that often means you are required to appoint an EU representative. We explain those triggers precisely below. For many non-EU technology companies it is the single most overlooked obligation in the regulation.

What is an EU representative?

An EU representative is an entity established in the Union that you designate in writing to act as your local point of contact for data protection matters. Your representative is addressed by data subjects (your users) and by supervisory authorities (regulators) on your behalf, instead of having to reach you outside the EU.

Two instruments create the role:

• Article 3(2) extends the GDPR to organisations outside the EU that (a) offer goods or services to data subjects in the EU, or (b) monitor their behaviour (including profiling).
• Article 27 requires that a controller or processor in that position designate a representative in the Union — unless an exemption applies.

Do you need one? The two triggers

You generally need an EU representative if both are true:

1. You are not established in the Union — no branch, subsidiary, or other stable establishment in an EU member state that carries out the relevant processing. (Note: a company can be “not established” for GDPR purposes even if it has customers, servers, or a website in the EU.)
2. Your processing falls under Article 3(2) — you:
   • offer goods or services to people in the EU (even free services count), or
   • monitor the behaviour of people in the EU (analytics, profiling, tracking, behavioural advertising, some security monitoring).

If both apply, the default is that you must appoint a representative, in a member state where your data subjects are located (Article 27(3)).

The exemptions (Article 27(2))

The representative requirement does not apply when your processing is:

• Occasional, does not include large-scale processing of special-category data (Article 9(1)) or criminal-conviction data (Article 10), and is unlikely to result in a risk to people’s rights — or
• Carried out by a public authority or body.

The exemption is narrow in practice. Selling to EU customers, running a website with EU visitors, or processing user data at scale is rarely “occasional”. When in doubt, the safer reading is that you need a representative.

What an EU representative does — and does not do

Your representative:

• acts as the point of contact for data subjects and supervisory authorities on GDPR matters (Article 27(4));
• cooperates with supervisory authorities, at their request, on your processing (Article 31);
• holds a copy of your record of processing activities and can make it available to a supervisory authority (Article 30) — the EDPB’s Guidelines 3/2018 on territorial scope describe this expectation.

What the representative is not: it does not take over your obligations. You remain the controller (or processor) and stay accountable. The representative is your accountable presence in the EU — not a mailbox.

What if you don’t appoint one?

Article 27 sits inside the range of obligations covered by Article 83(4), where fines reach up to €10 million or 2% of total global annual turnover, whichever is higher. Beyond fines, a missing representative makes it harder to respond to a data subject or regulator, which tends to compound the underlying problem.

EU representative vs DPO — don’t confuse them

They are different roles:

• An EU representative (Article 27) is about geography — a local contact for a non-EU organisation.
• A Data Protection Officer (Articles 37–39) is about a function — monitoring GDPR compliance on an ongoing basis. The role may be in-house, or engaged from an outside body by service contract (Article 37(6)); where it is external, a named person is responsible for it. You must appoint one only in defined cases, but a voluntary appointment (Article 37(4)) carries full statutory force.

You may need one, both, or neither. If you need both, they must be kept strictly separate: under the EDPB’s Guidelines 3/2018, the EU representative and the DPO cannot be the same person or provider for the same controller.

A UK representative is separate

If you also offer services to people in the United Kingdom, the UK GDPR has its own representative requirement, and the EU representative does not satisfy it. UK and EU representation are separate appointments.

Appointing a representative — what you’ll provide

A credible appointment is quick when the paperwork is ready. Expect to prepare:

• Confirmation that you are not established in the EU and that Article 3(2) applies.
• The member state(s) where your data subjects are located.
• A written mandate authorising the representative (Article 27(1)).
• A current record of processing activities to place with the representative.
• Your privacy notice updated to name the representative and its contact details.
• A named contact on your side for correspondence.

More from Insights: EU representative vs a DPO — what's the difference?