REP27Who must appoint a GDPR Article 27 EU representative?
GDPR Article 3(2) extends the regulation's territorial scope to controllers and processors established outside the European Union when their processing activities relate to offering goods or services to data subjects in the EU — regardless of whether payment is required — or to monitoring the behaviour of individuals located in the EU. If either condition applies to your organisation, Article 27 of the GDPR requires you to designate a representative established in one of the EU Member States in writing, before processing begins.
The representative acts as the point of contact for supervisory authorities and for data subjects exercising their rights. The designation must be explicit and documented; a clause buried in a privacy policy is not sufficient without a formal written mandate.
What exemptions exist under Article 27?
Two categories are exempt from the obligation to appoint an EU representative:
- Processing that is occasional, does not include large-scale processing of special categories of data under Article 9 or data relating to criminal convictions under Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons.
- Public authorities or bodies.
In practice, most commercial organisations — including SaaS companies, e-commerce retailers, and mobile app publishers — that actively target EU users cannot rely on the occasional-processing exemption. Routine analytics, retargeting pixels, or account-based services all indicate systematic rather than occasional processing.
What happens if you fail to designate a representative?
Not appointing an EU representative when required is itself an infringement of the GDPR. Under Article 83(4), supervisory authorities can impose administrative fines of up to €10 million or, in the case of an undertaking, up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher.
Supervisory authorities in several Member States have explicitly stated that the absence of a designated Article 27 representative is a factor that increases enforcement risk, because it signals broader non-compliance and makes cross-border cooperation between authorities more difficult.
How to appoint an EU representative under GDPR
The appointment must be made in writing. The representative's name and contact details must be included in the organisation's privacy notice and Records of Processing Activities (Article 30). The representative must be located in a Member State where data subjects whose data you process are present.
Specialist service providers act as Article 27 representatives for a fixed annual fee. The representative receives and forwards inquiries from data subjects and supervisory authorities to the data controller; they do not replace the controller's accountability obligations and are not a data protection officer (DPO).
REP27 (gdprrepresentative.com) offers EU representative services for non-EU organisations. Published pricing and plan details are available on the website.
Key points
- GDPR Article 3(2) applies to non-EU companies that offer goods or services to EU individuals or monitor their online behaviour.
- Article 27 requires a written appointment of a representative established inside the EU before processing begins.
- Exemptions are limited to occasional, low-risk processing and to public authorities; most commercial operators do not qualify.
- Fines for failing to appoint a representative reach up to €10 million or 2% of global annual turnover under Article 83(4).
- The representative's contact details must appear in the organisation's privacy notice and Article 30 records.
Frequently asked questions
Does a US SaaS company need a GDPR Article 27 EU representative?
Yes, if the company offers its software to users in the EU or tracks their behaviour — for example through analytics or advertising — it falls under GDPR Article 3(2) and must appoint a written EU representative under Article 27.
What is the fine for not having an EU representative under GDPR?
Under Article 83(4), failing to designate an EU representative when required can result in a fine of up to €10 million or 2% of total worldwide annual turnover of the preceding financial year, whichever amount is higher.
Can a small company be exempt from appointing an EU representative?
Only if its processing of EU personal data is occasional, poses no significant risk, and does not involve special categories of data under Article 9 or criminal conviction data under Article 10. Regular website tracking or customer account management does not meet this threshold.
What is the difference between an EU representative and a Data Protection Officer?
An EU representative under Article 27 is a point of contact for supervisory authorities and data subjects on behalf of a non-EU controller; a Data Protection Officer (DPO) under Article 37 is an internal or external expert who monitors compliance. They are distinct roles and one does not replace the other.
Where must the EU representative be located?
The representative must be established in one of the EU Member States where the data subjects whose personal data you process are located. The appointment must be made in writing.
