Organisations with no establishment in the EU that sell to, or monitor, people in the EU often discover the Article 27 representative duty only when a regulator or a customer contract asks who theirs is. Article 27 of the GDPR requires those organisations to designate, in writing, a representative established in the Union who can be contacted by supervisory authorities and data subjects. This guide explains the trigger test, the two exemptions, where the representative must sit, what it actually does, how it differs from a data protection officer, and how security and privacy teams keep the arrangement working in practice. It is written for privacy leads, security managers and legal teams at non-EU controllers and processors, including UK, US and Asian SaaS providers. For the wider GDPR programme, see the GDPR Compliance Guide for Security Teams.
Key takeaways
- The trigger is Article 3(2), not company size. If you have no EU establishment and you offer goods or services to people in the EU, or monitor their behaviour there, you need a representative unless an Article 27(2) exemption applies.
- The exemptions are narrow. Processing must be occasional, must not involve large-scale special category or criminal offence data, and must be unlikely to result in a risk; or you must be a public authority or body. A business whose core service reaches EU users rarely qualifies.
- The representative is a contact point with real duties. It holds your record of processing (Art. 30), cooperates with supervisory authorities (Art. 31) and can be ordered to provide information (Art. 58(1)(a)).
- It does not buy you a one-stop-shop. A representative is not an establishment, so a non-EU organisation deals with each relevant supervisory authority, including for breach notification.
- A DPO and a representative are different roles. The EDPB does not consider an external DPO compatible with also acting as representative, because one is independent and the other acts on your instructions.
What Article 27 requires
Article 27 is short. Its five paragraphs, read with the definition in Article 4(17) and Recital 80, set out the whole obligation.
| Provision | What it says (paraphrased from the official text) | Practical meaning |
|---|---|---|
| Art. 4(17) | A representative is a natural or legal person established in the Union, designated in writing under Article 27, who represents the controller or processor regarding their obligations under the Regulation | A named person or entity in an EU Member State, with a written mandate |
| Art. 27(1) | Where Article 3(2) applies, the controller or processor shall designate a representative in the Union in writing | Applies to processors as well as controllers |
| Art. 27(2) | Exemption for occasional processing that does not include large-scale special category (Art. 9(1)) or criminal offence (Art. 10) data and is unlikely to result in a risk; and for public authorities or bodies | All three limbs of the first exemption must be met |
| Art. 27(3) | The representative must be established in one of the Member States where the data subjects whose data is processed are | Not anywhere in the EU: where your EU users or monitored people are |
| Art. 27(4) | The representative is mandated to be addressed in addition to or instead of the controller or processor by supervisory authorities and data subjects on all issues related to processing | Regulators and individuals can deal with the representative alone |
| Art. 27(5) | Designation is without prejudice to legal actions which could be initiated against the controller or processor itself | Your own liability is unchanged |
| Recital 80 | The representative is explicitly designated by written mandate; designation does not affect the responsibility or liability of the controller or processor | The mandate is evidence; keep it signed and current |
Other articles give the representative work to do. Under Article 30(1) and 30(2), each controller or processor "and, where applicable," its representative maintains a record of processing activities, and Article 30(4) requires that record to be made available to the supervisory authority on request. Article 31 requires controllers, processors and their representatives to cooperate with the supervisory authority. Article 58(1)(a) lets an authority order the controller, the processor and, where applicable, the representative to provide any information it requires. Articles 13(1)(a) and 14(1)(a) require the representative's identity and contact details to be given to data subjects in the privacy notice.
Do you need one? The Article 3(2) test
Article 3(2) applies the GDPR to a controller or processor not established in the Union where processing of personal data of data subjects in the Union relates to offering goods or services to them, whether or not payment is required, or to monitoring their behaviour as far as that behaviour takes place within the Union. If you have an EU establishment within the meaning of Article 3(1), Article 27 does not apply, though the GDPR does. The EDPB's Guidelines 3/2018 on territorial scope (final version of 12 November 2019) are the authoritative reading of both limbs.
Offering goods or services
The EDPB says mere accessibility of a website, an email address or contact details, or use of a language generally used in your own country, is not enough on its own. Its indicative factors, assessed together with no single factor decisive, include:
- Naming the EU or a Member State: in marketing, terms or the service itself.
- Paid targeting: search engine referencing or advertising campaigns aimed at EU audiences.
- Language and currency: a language or currency of one or more Member States with the option to order in it.
- EU contact points and domains: dedicated EU phone numbers or addresses, and country or .eu top-level domains.
- Delivery and customer base: delivering goods to Member States, or mentioning EU customers.
Goods or services provided to EU residents inadvertently or incidentally do not bring you within Article 3(2), according to the EDPB.
Monitoring behaviour
Monitoring covers tracking people in the EU online, including behavioural advertising, profiling and analytics that follow individuals over time, as well as location tracking. For security and product teams this matters because telemetry, fraud scoring and adtech in a product used by EU residents can trigger the duty even where nothing is sold to them.
Decision table
| Situation | Article 27 outcome | Why |
|---|---|---|
| US SaaS company, no EU office, sells subscriptions in euros to EU businesses and processes their users' data as a processor | Representative needed | Art. 27(1) covers processors; offering services to people in the EU |
| UK retailer, no EU establishment, ships to Ireland and Germany from a UK site with euro pricing | Representative needed | Delivery and currency factors show targeting |
| Non-EU company with an EU subsidiary that carries out the relevant processing | No Art. 27 representative for that processing | Art. 3(1) establishment, so Art. 3(2) and Art. 27 do not apply |
| Hotel outside the EU that receives a handful of direct bookings from EU travellers, with no EU marketing | Possibly outside Art. 3(2) entirely, or exempt | Incidental service; if in scope, the processing may be occasional and low risk |
| Non-EU health app with EU users, processing health data | Representative needed | Exemption fails: processing is regular and involves special category data |
| Non-EU public authority | Exempt under Art. 27(2)(b) | Assessed case by case under national law, per the EDPB |
The two exemptions, read narrowly
The first exemption in Article 27(2)(a) has three cumulative conditions. The EDPB reads "occasional" as processing that is not carried out regularly and occurs outside the regular course of business or activity. "Large scale" is assessed with the factors from the Article 29 Working Party guidance on DPOs (WP243): number of data subjects, volume and range of data, duration and geographic extent. The risk limb covers any risk to rights and freedoms, not only high risk, and considers both likelihood and severity.
In practice, if serving EU users is part of your business model, processing is not occasional and the exemption does not apply. Record the assessment either way: an authority asking why you have no representative will expect to see the reasoning, and the Data Mapping and ROPA Guide shows how to build the processing inventory that the assessment depends on. The second exemption, for public authorities or bodies, is rarely relevant to commercial organisations.
Choosing and locating the representative
Article 27(3) ties the representative to a Member State where your data subjects are. The EDPB recommends, as good practice, establishing the representative in the Member State where a significant proportion of data subjects are, while staying easily accessible to authorities and individuals in the others. The place where processing happens is not the deciding factor. Its Example 25 describes a non-EU trial sponsor whose patients are mostly in Belgium, so Belgium is the recommended location.
| Option | Suits | Trade-offs |
|---|---|---|
| Specialist representative service provider | Most SMEs and SaaS providers with users across several Member States | Fast to appoint, multilingual intake; check service levels, escalation path and that it will not also act as your external DPO |
| Law firm in the main market | Organisations expecting regulator contact or with high-risk processing | Strong on authority correspondence; can cost more; check it can handle data subject request volume |
| Group company or affiliate in the EU that is not an establishment for the processing | Groups with an EU presence unrelated to the processing in question | Low cost; test carefully whether the affiliate's activities actually create an Art. 3(1) establishment instead |
| Individual consultant | Very small, low-volume controllers | Single point of failure for absence and continuity; agree cover arrangements |
The EDPB confirms that a natural or legal person, such as a law firm, consultancy or private company, can act under a service contract; that one representative may act for several non-EU organisations; that, where an organisation acts as representative, naming a single individual as lead contact is advisable; and that you do not need a separate representative for each processing activity. Communication with authorities and data subjects should use the languages they use, or other effective means where translation would be disproportionate.
Representative versus DPO
Articles 37 to 39 on the data protection officer do not mention representatives, and the EDPB considers the two roles incompatible when held by an external DPO in the EU: a DPO must act independently, while a representative acts on the controller's or processor's instructions and can be the target of enforcement. Some non-EU organisations need both. See DPO vs CPO for how the DPO role sits alongside internal privacy leadership.
What the representative actually does
- Contact point for authorities: receives correspondence from any relevant supervisory authority and passes it on promptly, in a channel you have agreed and tested.
- Contact point for data subjects: receives access, erasure and objection requests. The EDPB says the representative is not itself responsible for complying with data subject rights, but must facilitate communication between individuals and the controller or processor.
- Holder of the record of processing: the non-EU organisation remains responsible for the content and updates of the Article 30 record and must supply it to the representative, who must be able to produce it on request.
- Cooperation and information: responds to Article 31 cooperation and Article 58(1)(a) information orders on your behalf, with your input.
- Not a liability shield: the EDPB states the GDPR creates no substitute liability for the representative; its direct liability is limited to its own obligations under Articles 30 and 58(1)(a), and your liability is unchanged under Article 27(5).
What the representative does not do: run your security programme, decide breach notification, act as your lead authority contact under the one-stop-shop, or carry out DPIAs. Those stay with you.
Breach notification and supervisory authorities without a one-stop-shop
Article 56 gives the lead authority role to the authority of a controller's or processor's main or single establishment. The EDPB states that controllers or processors without an EU establishment cannot benefit from the one-stop-shop, and that designating a representative does not create one. The consequence for incident response is significant: the GDPR Compliance Guide for Security Teams notes the EDPB expectation that a non-EU controller notifies every authority in whose Member State affected data subjects reside. The Article 33 clock (without undue delay and, where feasible, within 72 hours of becoming aware) still applies.
Build this into the incident playbook before you need it:
- Keep a register of the Member States where your data subjects are, by product, refreshed at least quarterly from customer and analytics data.
- Hold the notification portal or contact details for each relevant authority, with language requirements.
- Agree the representative's role in a breach: usually to receive authority follow-up questions and forward them within hours, not to file notifications.
- Pre-draft notification templates and test them in a tabletop exercise that includes the representative.
The Data Breach Notification Checklist covers the content of notifications, and GDPR Procedural Regulation covers how cross-border cases are being handled between authorities.
How to appoint and run the arrangement
- Scope assessment: document the Article 3(2) analysis per product and entity, and any Article 27(2) exemption reasoning, signed off by legal and the privacy lead.
- Location decision: use the data subject register to pick the Member State with the largest share of affected people, per the EDPB good practice.
- Written mandate: a service contract that names the parties, the scope (controller, processor or both, and which entities), the duties above, response times for forwarding requests, confidentiality, data protection terms for the personal data the representative handles, language coverage, sub-contracting, and termination with handover of records.
- Record of processing: deliver the current Article 30 record to the representative and agree an update cadence, for example on every material change and at least twice a year. Note Article 30(5): the fewer than 250 employees exemption does not apply where processing is not occasional, involves risk, or includes special category or criminal data, so most in-scope organisations keep a record.
- Transparency: add the representative's identity and contact details to every privacy notice and data collection point (Arts. 13(1)(a), 14(1)(a)). The EDPB treats a failure here as a breach of transparency obligations. The Privacy Notice Template has a field for it.
- Intake channel: a monitored, logged route from the representative into your privacy and security teams, with a named owner and backup.
- Test: send a test data subject request and a mock authority letter through the representative and measure end-to-end handling time.
- Review and exit: review annually and on any change in EU footprint. If you open an EU establishment for the processing, document why Article 27 no longer applies before terminating, and update notices on the same day.
Registration with a supervisory authority is not required by the GDPR, according to the EDPB, though some authorities publish their own expectations. The ICO says the same for the UK equivalent: you need not inform the ICO, but the representative's details should be easily accessible to it.
The UK mirror and other EU laws with representatives
The UK GDPR contains an equivalent rule. The ICO states that controllers or processors outside the UK with no UK establishment, who offer goods or services to people in the UK or monitor their behaviour, need a UK representative authorised in writing, subject to the same public authority and occasional, low-risk exemptions. The ICO notes its guidance is under review following the Data (Use and Access) Act 2025, which became law on 19 June 2025. A UK company selling into the EU, or an EU company selling into the UK, may therefore need both. See UK GDPR vs EU GDPR and the UK GDPR and Data Protection Act 2018 Guide.
The same design appears in NIS2. Article 26(3) of Directive (EU) 2022/2555 requires certain digital providers not established in the Union but offering services in it (including DNS and TLD services, cloud, data centre, CDN and managed service providers, online marketplaces, search engines and social networks) to designate a representative in a Member State where they offer services; they then fall under that Member State's jurisdiction, and Article 26(4) keeps legal action against the entity itself available. That is a separate appointment from the GDPR representative, with a different trigger, though one provider may be able to fill both roles. See the NIS2 Directive Guide.
Where identity fits
A representative receives data subject requests from people it cannot identify. Do not let the representative, or your own team, release personal data on the strength of an email. Route requests into your normal verification procedure, proportionate to the data involved, and restrict the representative's access to your systems: it should forward requests, not log in to production. If you do give it a portal account, apply named accounts, MFA and quarterly access review as for any third party. See the Data Subject Request Verification Procedure.
Measuring that it works
- Forwarding time: median hours from receipt by the representative to receipt by your privacy team, target within one business day.
- Request closure: percentage of data subject requests received via the representative closed within the one-month Article 12(3) period.
- Record currency: days since the representative last received an updated Article 30 record.
- Notice coverage: percentage of privacy notices, apps and collection forms that show the representative's details.
- Footprint review: date of last review of the Member State data subject register against the representative's location.
Common failure patterns
- Assuming no office means no GDPR: the Dutch Autoriteit Persoonsgegevens fined Locatefamily.com, a site publishing people's contact details, EUR 525,000 in May 2021 for failing to appoint an EU representative, and ordered it to appoint one subject to a penalty. The authority also found erasure requests were not handled.
- Claiming the occasional exemption for core business: processing that is part of how you serve EU users is regular, so the exemption fails.
- Appointing the external DPO as representative: the EDPB considers the roles incompatible.
- Representative details missing from notices: the appointment exists in a contract but no data subject can find it.
- Stale record of processing: the representative cannot produce a current Article 30 record when an authority asks.
- Treating the representative as a one-stop-shop: breach notifications go to one authority when people in several Member States are affected.
Infringements of Articles 25 to 39, which include Article 27 and Article 30, fall under Article 83(4)(a): administrative fines up to EUR 10,000,000 or, for an undertaking, up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher, weighed against the Article 83(2) factors.
Framework mapping
| Framework | Reference | How the representative duty fits |
|---|---|---|
| NIST CSF 2.0 | GV.OC-03 | Legal and regulatory requirements, including privacy obligations, are understood and managed: the Article 3(2) assessment and appointment |
| NIST CSF 2.0 | GV.SC-05 | Requirements are integrated into contracts: the written mandate with the representative |
| ISO/IEC 27001:2022 Annex A | 5.31 Legal, statutory, regulatory and contractual requirements | Identify and document the obligation and how it is met |
| ISO/IEC 27001:2022 Annex A | 5.34 Privacy and protection of PII | Representative role within the privacy compliance framework |
| GDPR | Arts. 13, 14, 30, 31, 58(1)(a) | Transparency, records and cooperation duties that involve the representative |
Practitioner checklist
- Document the Article 3(2) analysis for each non-EU entity and product, and any Article 27(2) exemption reasoning.
- Build a register of Member States where your data subjects are and refresh it quarterly.
- Appoint the representative by written mandate in the Member State with the largest share of affected people.
- Confirm the representative is not also your external DPO.
- Deliver the Article 30 record to the representative and agree an update cadence.
- Publish the representative's details in every privacy notice and collection point.
- Test the intake path with a mock data subject request and authority letter, and measure forwarding time.
- Update the breach playbook for multi-authority notification without a one-stop-shop.
- Check whether you also need a UK representative or a NIS2 Article 26 representative.
Standards and references
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
- EDPB: Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
- EDPB: Guidelines 3/2018, final version (PDF)
- ICO: UK representatives
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- NOS: Half miljoen boete voor website Locate Family voor overtreden privacywet (12 May 2021)
- Hunton Andrews Kurth: Dutch DPA fines company EUR 525,000 for failure to designate EU representative
This guide summarises GDPR Article 27 and related provisions as of November 2026 and is not legal advice. Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · UK GDPR and Data Protection Act 2018 Guide · GDPR Variations in Six EU Member States · Data Mapping and ROPA Guide