Regulation (EU) 2016/679
Five paragraphs decide whether you need a representative, what that person does, and what happens if you skip it. Here they are, one by one, with the practical meaning next to each.
A controller or processor caught by Article 3(2) must designate, in writing, a representative in the Union.
In practice: a verbal arrangement, a clause buried in a contract or a distributor who never signed anything are not designations.
You have no establishment in the Union and you either offer goods or services to people in it — paid or free — or monitor their behaviour inside it.
A price in euros, an EU shipping option, a language selector or an analytics pixel on European visitors is usually enough.
Processing that is occasional, excludes special categories of data on a large scale and criminal-conviction data, and is unlikely to result in a risk.
Continuous commercial processing is not occasional. Ordinary businesses do not qualify; public authorities are exempt under 27(2)(b).
The representative is mandated to be addressed, in addition to or instead of the company, by supervisory authorities and data subjects on all issues related to processing.
We receive, log and forward within two business days. We never answer on the merits and we are not your data protection officer.
The designation is without prejudice to legal actions which could be initiated against the controller or processor itself.
A representative is not a shield. Anyone telling you it stops proceedings against your company is selling something the regulation does not contain.
Failure to designate is a standalone infringement: up to €10 million or 2% of total worldwide annual turnover, whichever is higher.
The Dutch authority fined Locatefamily.com €525,000 on this ground alone, with periodic penalties until it complied.