Who needs an EU representative
Article 27 applies to controllers and processors not established in the Union whose processing falls under Art. 3(2) GDPR, which means that they:
- offer goods or services to people in the EU, with or without payment: an English or local-language website aimed at EU customers, prices in euro, delivery to EU countries or advertising aimed at them are typical signs;
- or monitor the behaviour of people in the EU, for example through online tracking, profiling or location data.
Having a few European customers who find you on their own is not enough: what matters is that your offer is directed at people in the Union.
When it is not required
No representative is needed if the processing is occasional, does not include large-scale processing of special categories of data or criminal data, and is unlikely to result in a risk to people’s rights and freedoms, taking into account its nature, context, scope and purposes (Art. 27(2)). Public authorities and bodies are also exempt. In practice, a business that sells regularly into the EU rarely qualifies.
What the representative does
| Task | What it means in practice |
|---|
| Contact point | Receives and forwards requests from supervisory authorities and from data subjects in the EU. |
| Records of processing | Keeps the record of processing activities available to the authorities (Art. 30). |
| Transparency | Name and contact details are stated in your privacy notices. |
| Cooperation | Cooperates with the supervisory authorities on your behalf when they ask for information. |
The representative does not replace your own responsibility: the company remains the controller or processor, and the authorities can take enforcement action against it.
How I work as your representative
- Assessment of whether Art. 3(2) and Art. 27 actually apply to you, and in which Member States your data subjects are.
- Written mandate defining tasks, response times and how we exchange information.
- Documentation check: privacy notices, record of processing, contracts with processors, international transfers.
- Ongoing service: handling requests from authorities and individuals, and keeping your records up to date.
I am established in Italy, so I can be designated where your data subjects are in Italy or across several Member States. If the AI Act also applies to your products, I can assess that at the same time.
Frequently asked questions
Is an EU representative the same as a DPO?
No. The DPO monitors compliance from inside the organisation and must be independent; the representative is the contact point in the EU for a company established outside it. They are different roles with different tasks.
Where must the representative be established?
In one of the Member States where the people whose data you process are located (Art. 27(3) GDPR).
Do UK or Swiss companies need one?
Yes, if they have no establishment in the EU and the GDPR applies to them under Art. 3(2), unless the occasional, low-risk exception applies.
Can a lawyer outside the EU act as representative?
No. The representative must be established in the European Union.
Dr Pietro Cravero, certified Data Protection Officer (IDcert; Second-level Master in Personal Data Processing, Roma Tre University). Studio Cravero Consulting, Sassari, Italy.
Do you need an EU representative?
Tell me what you sell and to whom: I will tell you whether Art. 27 applies and what the mandate would involve.
Studio Cravero Consulting