REP27
Article 27 of the GDPR has applied since 25 May 2018. The rule is straightforward: if your company has no establishment in the European Union, but you offer goods or services to people there or monitor their behaviour, you must appoint a representative established in the EU — in writing.
The representative is named in your privacy notice, holds a copy of your record of processing activities, and acts as the point of contact for data subjects and supervisory authorities.
Failure to designate one is itself an infringement of the GDPR. Under Article 83(4), it can attract fines of up to €10 million or 2% of total worldwide annual turnover, whichever is higher.
The obligation applies regardless of company size. A five-person SaaS team selling subscriptions to EU residents is subject to the same rule as a large enterprise.
REP27 — Europe Services SE, Praha, since 2014.
