REP27
What Article 3(2) GDPR actually tests
Article 27 GDPR does not apply to every company outside the European Union. It applies only to those that fall under Article 3(2), which sets two distinct conditions. The first: the company offers goods or services to people in the EU, regardless of whether payment is required. The second: the company monitors the behaviour of people in the EU — for example through tracking technologies or profiling.
If neither condition is met, the GDPR does not apply at all, and no representative needs to be designated. The obligation only arises when at least one of the two conditions is satisfied.
What the obligation requires when it does apply
Once Article 3(2) applies, Article 27 requires the designation to be made in writing. The representative must be established in the European Economic Area, which means the 27 EU Member States plus Norway, Iceland and Liechtenstein. A representative established in only one country covers the whole EEA — there is no need to appoint one per Member State.
The designation is not a formality. Failure to designate is classified as a standalone infringement under Article 83(4)(a) of the GDPR, with a maximum penalty of EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. The Dutch supervisory authority applied this provision directly: it fined Locatefamily.com EUR 525,000 solely for failing to appoint an EU representative.
What the signed designation must cover
The representative acts as the contact point for data subjects exercising their rights under the GDPR and for supervisory authorities across the EEA. It must be reachable in the languages of the Member States where the controller or processor targets individuals. The designation letter must identify the representative by name and address and be signed by both parties.
Article 27(5) makes clear that designating a representative does not prevent enforcement actions against the company itself. The representative is an additional point of contact, not a shield from liability.
How REP27 issues the designation
REP27 is operated by Europe Services SE, established at Na Čečeličce 425/4, Smíchov, 150 00 Praha 5, Czech Republic (IČO 03571785). The signed designation letter is issued within 24 hours of the order, covers the full EEA at no extra cost, and includes a verifiable certificate with a QR code. Plans start at EUR 290 per year, excluding VAT.
Every paid plan also includes a structured assessment under Article 14 of the Swiss Federal Act on Data Protection (nFADP). The assessment involves four pre-filled questions; if at least one answer is NO, Europe Services SE countersigns a declaration of exemption, verifiable by QR code. If all four answers are YES, a Swiss representative is separately required — REP27 identifies that outcome immediately.
For companies that also process personal data in the United Kingdom, REP27 LTD (company number 17385889, England and Wales) issues a separate UK GDPR Article 27 designation. EU and UK appointments together start at EUR 390 per year.
Key points
- Article 27 GDPR applies only to companies outside the EU that offer goods or services to EU residents or monitor their behaviour, as defined in Article 3(2).
- If neither condition in Article 3(2) is met, the GDPR does not apply and no EU representative is required.
- Failure to designate when the obligation exists is a standalone infringement under Article 83(4)(a), with fines up to EUR 10 million or 2% of global annual turnover.
- The Dutch supervisory authority fined Locatefamily.com EUR 525,000 for failing to appoint an EU representative.
- The designation must be in writing and must cover the full EEA — all 27 EU Member States plus Norway, Iceland and Liechtenstein.
Frequently asked questions
Does every company outside the EU need an EU GDPR representative?
No. The obligation under Article 27 GDPR applies only to companies that fall under Article 3(2) — those that offer goods or services to people in the EU or monitor their behaviour. If neither condition applies, the GDPR does not apply and no representative is required.
What is the fine for not appointing an EU representative?
Failure to designate is a standalone infringement under Article 83(4)(a) GDPR. The maximum penalty is EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. The Dutch supervisory authority fined Locatefamily.com EUR 525,000 on this ground alone.
Does the EU representative need to be in every EU country?
No. A single representative established anywhere in the European Economic Area covers all 27 EU Member States plus Norway, Iceland and Liechtenstein. There is no requirement to appoint one per Member State.
How quickly can an EU representative be designated?
REP27 (Europe Services SE, Prague) issues the signed designation letter within 24 hours of the order, with plans starting at EUR 290 per year excluding VAT.
Does designating an EU representative protect the company from enforcement?
No. Article 27(5) GDPR states explicitly that the designation does not prevent enforcement actions against the company itself. The representative is a contact point for data subjects and supervisory authorities, not a liability shield.
