INSIGHTS
Two GDPR roles people confuse. What each requires, when you need one, and which one you need — in plain English.
If your company is outside the European Union and does business in it, you may be told two different things: that you need an EU representative, and that you need a Data Protection Officer. Both are GDPR roles, both are about having a real, accountable person reachable from the EU — and they are frequently confused. They solve different problems, are triggered by different rules, and for one controller they can never be the same person or provider.
This is the plain-English difference: what each role is, when you need it, whether you can combine them, and what it costs to get it wrong.
Geography, versus function.
The representative requirement applies only to controllers and processors not established in the Union whose processing falls under Article 3(2) — typically because they offer goods or services to people in the EU, or monitor their behaviour. It does not apply when the processing is occasional, does not include large-scale special-category (Article 9(1)) or criminal-conviction (Article 10) data, and is unlikely to result in a risk — or when it is carried out by a public authority or body (Article 27(2)).
If it applies, you must designate in writing a person or entity established in a member state where your data subjects are located (Article 27(1), (3)). The representative is the point of contact for data subjects and supervisory authorities, cooperates with regulators on your behalf, and keeps a copy of your record of processing activities available (Articles 27(4), 31, 30). Critically, appointing one does not take over your obligations — the mandate is simply in addition to you, and you stay the controller, you stay liable (Article 27(4)–(5)).
We covered the full requirement, including who’s exempt, in our earlier guide to Article 27.
The DPO is a different test, and it applies to any controller or processor subject to the GDPR — inside or outside the EU — that meets the criteria in Article 37(1):
These tests are fact-specific, with no fixed size threshold — so the answer isn’t automatic. Even when not required, a voluntary appointment (Article 37(4)) carries full statutory force and is a recognised accountability signal.
The DPO’s tasks are to inform and advise on data protection law, monitor compliance, give advice on data protection impact assessments, cooperate with supervisory authorities and act as their contact point, and act as the point of contact for data subjects (Articles 39, 38(4)). The role can be filled in-house or by an outside body under a service contract (Article 37(6)), and the guidelines recommend a single named lead — a “person in charge” — for each client (WP29 Guidelines 243 rev.01 §2.5). An external DPO is independent by law: the controller may not instruct the DPO on the exercise of its tasks (Article 38(3)), and the DPO may not have any conflict of interest (Article 38(6)).
For the same controller, the EU representative and an external DPO cannot be combined. The two roles answer to different duties: the representative is subordinate and acts as your contact, while the DPO must remain independent and monitor you objectively. That is an inherent conflict of interest, and the EDPB’s Guidelines 3/2018 describe the two roles as not compatible for the same controller.
So a provider offering you both out of one seat is selling you a problem. If you need both, they must be separate appointments — separate people, separate providers.
| Your situation | EU representative? | DPO? |
|---|---|---|
| Established inside the EU | No (you’re already in the Union) | Only if the Article 37(1) tests apply — see below |
| Established outside the EU; offers goods/services to the EU or monitors people in it | Yes (Article 27, unless an exemption applies) | Only if the Article 37(1) tests apply — see below |
| Core activities = large-scale regular and systematic monitoring | — | Yes (Article 37(1)(b)) |
| Core activities = large-scale processing of special-category / criminal-conviction data | — | Yes (Article 37(1)(c)) |
So a non-EU company doing large-scale behavioural tracking often needs both — an Article 27 representative and a DPO — kept strictly separate. By contrast, a company that is established in the EU, or whose processing falls outside Article 3(2), may need neither on the facts — though a voluntary DPO (or a documented decision not to appoint one) is still a reasonable accountability step for those that process personal data at scale. Note the two tests are independent: a non-EU company offering goods or services to people in the EU needs a representative regardless of its monitoring or special-category volumes, while the DPO question turns on the Article 37(1) tests.
Both obligations sit in the same enforcement block: infringements of Articles 25–39 are punishable by fines of up to €10 million or 2% of the total worldwide annual turnover, whichever is higher (Article 83(4)). The operational cost is bigger than the fine: with no representative, a data subject or regulator has no clear route to reach you in the EU; with no DPO, nobody is continuously watching compliance. Both problems tend to surface exactly when things go wrong.
More from Insights: Do you need an EU representative under the GDPR? (Article 27 explained)
The obligation: non-EU controllers and processors subject to Article 3(2) may need a designated, written EU point of contact (Article 27); any controller or processor meeting the Article 37 tests may need a statutory DPO. The two roles must never be combined for the same controller.
How we solve it: we offer the two roles as strictly separate products — our EU representative service (a real, contactable presence established in Cyprus, with a documented process behind every letter) and our DPO as a service (a named, statutory DPO under a service contract, independent by law). We never provide both to the same client.
What you provide: for representation — a written mandate, a current record of processing, an updated privacy notice, and a named contact. For the DPO — the facts of your processing so we can confirm whether the test is met and confirm the DPO’s scope in a service contract.
Where it needs more detail: if your operations are unusual, we send a short questionnaire first, so the appointment and its documentation reflect what you actually do rather than a template.
Zeno Kition is an EU compliance partner for companies outside the Union, established in Cyprus. We practise privacy by design and by default (GDPR Article 25) — starting with this site, which runs on the highest privacy standards: no cookies, no tracking, nothing collected about your visit. We handle email via Proton Mail (zero-access encryption, Swiss jurisdiction) and recommend a VPN if you consider your enquiry sensitive. Specialists work within and beyond the EU; where any third-country processing occurs, transfers are documented using GDPR Article 46 safeguards. Marketing copy is not legal advice.
