REP27
If your company is based outside the European Union and you collect data from EU residents — or monitor their behaviour — Article 27 GDPR requires you to appoint a representative in the Union. In writing. Before you process a single record.
This is not a recommendation buried in a recital. It is a hard obligation under Article 3(2) GDPR, and failing to meet it is a standalone infringement under Article 83(4)(a): up to EUR 10 million or 2% of your total worldwide annual turnover, whichever is higher.
The Dutch supervisory authority fined Locatefamily.com EUR 525,000 specifically for the absence of an Article 27 representative — not for a data breach, not for unlawful processing. Just for missing the designation.
The representative must be established in one of the 27 EU Member States (or the EEA: Norway, Iceland, Liechtenstein) and must be named in your privacy notice under Article 13 or 14.
A few categories are exempt — primarily controllers whose processing presents no risk to natural persons, or public authorities. Everyone else falls within scope.
REP27, operated by Europe Services SE (Prague, Czech Republic), issues the signed designation letter and verifiable certificate within 24 hours, covering the entire EEA at no extra cost. Plans start at EUR 290 per year.
