REP27 · Enforcement
Article 83(4)(a) · Enforcement
Article 27 is unusual among GDPR obligations: it can be checked from outside, in a browser, in about ten seconds. There is no need to audit your systems or read your contracts — either your privacy notice names an entity established in the Union, or it does not. That visibility is why the missing designation turns up so often in enforcement, and why it is treated as a breach on its own.
This is the practical reason the wording on your site matters as much as the mandate behind it. A designation that exists but is not published is invisible to exactly the people it was created for.
Article 83(2) lists the factors. Four of them are directly affected by how quickly you act.
| Factor | What it means here |
|---|---|
| Nature and gravity | Whether data subjects had any route to reach you at all |
| Duration | How long the processing ran with no designation in place |
| Intentional or negligent | Whether the obligation was known and left unaddressed |
| Mitigating steps | Appointing promptly once identified counts here |
| Cooperation | Answering through a working contact point rather than silence |
| Previous infringements | Whether the same gap was raised before |
In our experience the regulator is rarely the first consequence. A European enterprise buyer asks for the representative's name in a security questionnaire, the field comes back blank, and the file goes to legal. The deal does not die — it slips, and the slip is measured in quarters.
That is the argument that persuades finance teams: not the theoretical ceiling under Article 83, but the contract that stopped moving because of a missing line in a privacy notice.
Supervisory authorities have limited resources and a large mandate. What they can act on cheaply, they act on more often — and Article 27 is the cheapest thing in the regulation to verify.
Establishing whether a company's security measures are appropriate under Article 32 takes an investigation, technical expertise and months. Establishing whether a privacy notice names a representative established in the Union takes a browser and a minute, in any language, without notifying anyone. An authority can survey a hundred non-EU websites serving its market in an afternoon.
That asymmetry shapes enforcement in a way worth understanding. The missing designation is rarely the reason an investigation starts, but it is very often the first thing recorded once one has, because it is already established before the first letter is sent. It also colours everything that follows: a company that never provided a contact point is harder to characterise as diligent on the other Article 83(2) factors.
The inverse is equally true. A designation published clearly, verifiable independently and in place from the beginning, is the cheapest evidence of good faith available in the entire regulation.
Yes. Article 83(4)(a) lists Article 27 among the provisions whose breach attracts the lower tier of fines, and EDPB Guidelines 3/2018 state that the absence of a designation is a breach in its own right. It does not need to accompany a data breach or any other failure.
Up to €10 million, or 2% of worldwide annual turnover of the preceding financial year, whichever is higher. Turnover is assessed at group level, not for the entity that happens to have signed the contract.
Yes. Several supervisory authorities have issued penalties where the missing representative was among the infringements found, and it is a standard finding in investigations of non-EU websites. It is also one of the easiest things for an authority to establish: the privacy notice is public.
Usually a complaint from a data subject who could not find anyone to write to, or a sweep by an authority reading privacy notices in its own market. Both start from what your site says publicly.
It stops the ongoing breach, which matters: authorities weigh the duration of the infringement and the steps taken. It does not erase the period during which no designation existed.
For most companies the commercial cost arrives first. European buyers ask for the representative during vendor onboarding, and a missing answer stalls contracts long before any authority writes.
The ceiling is proportionate, since 2% of a small turnover is a small number, but the €10 million alternative applies where it is higher. Authorities also consider cooperation and duration, which is why prompt appointment matters more than size.
Designation signed within 24 hours, with the wording your notice needs and a certificate anyone can verify.
Appoint us Check your notice first