REP27 · Subsidiary or representative
Article 3(2) and Recital 22 GDPR
Companies weighing the two usually frame it as a cost question, and it is — but only after a legal one. Article 27 applies where there is no establishment in the Union, so the first thing to settle is whether what you have, or plan to have, amounts to an establishment at all. The word carries far more weight in the GDPR than in company law, and a registered entity is not automatically one.
Recital 22 sets the standard: effective and real exercise of activity through stable arrangements. Legal form is explicitly not determinative.
The consequence runs both ways. A single agent with sufficient stability can amount to an establishment, so a company convinced it has none may in fact have one. Equally, a fully incorporated subsidiary with no staff, no premises and no role in the processing may not qualify, leaving Article 27 in force despite the certificate of incorporation on the wall.
Companies open subsidiaries for commercial reasons — hiring, invoicing in euro, being closer to customers — and the compliance effect is a by-product. Where Article 27 is the only driver, the representative is the proportionate answer by a wide margin.
Appoint a representative now and revoke it when the entity is genuinely operating. The obligation is live today; an intention is not a defence.
Almost certainly not an establishment. Do not rely on it — an authority will ask what activity it carries out.
Likely an establishment, which removes the Article 27 obligation but brings the rest of the GDPR to bear directly. Worth confirming with counsel rather than assuming either way.
The concept predates the GDPR, and the case law under the previous directive still shapes how authorities read Recital 22.
In Weltimmo the Court held that a company registered in one Member State but operating through a single representative, a bank account and a letterbox in another could be established in the second — the test being real and effective activity through stable arrangements, however minimal. The threshold is deliberately low, and it looks at what happens rather than at what is registered.
Google Spain went further, treating a local subsidiary selling advertising as bringing the parent's processing within EU law because the two activities were inextricably linked. The lesson for a group structure is that a European entity doing something commercially connected to the processing may pull the parent in, even if it never touches the data itself.
Neither case removes the practical difficulty: the answer depends on facts specific to your structure, and getting it wrong in the confident direction means no designation exists at all. Where there is genuine doubt, the proportionate move is to appoint a representative and revoke it later if the establishment position becomes clear. Revocation costs a letter.
Not if the subsidiary is a genuine establishment carrying out the processing. Article 27 applies only where Article 3(2) applies, and Article 3(2) applies only in the absence of an establishment in the Union. A real subsidiary removes the obligation.
No. Recital 22 requires effective and real activity through stable arrangements. A brass plate, a virtual office or a company registered but dormant does not amount to an establishment for these purposes.
Look at which entity determines purposes and means. If the parent outside the Union is the controller and the subsidiary is only a sales channel, the parent may still fall within Article 3(2) for its own processing.
Legal form is not decisive. A branch with staff and stable arrangements can be an establishment; a subsidiary with neither may not be. The test is activity, not incorporation.
Different orders of magnitude. A subsidiary means incorporation, annual accounts, statutory filings, local advisers and corporate tax exposure in that Member State. A representative is an annual fee and a signed mandate.
Only if they agree in writing to act as representative. Distribution and representation are different roles, and most distributors decline once they read what Article 27 asks of them.
Appoint a representative now and revoke it when the subsidiary is genuinely operating. The obligation runs today, not from the date you intended to solve it differently.
A designation takes a day and is revoked with a letter, so it costs nothing to be covered while a subsidiary is being considered.
See pricing Run the free check