GDPR · Article 27 · EU representative · Updated November 2026Your company has no office in Europe, yet it sells to customers there, runs an app they download or tracks their visits to your website. Under Article 27 of the GDPR, that is usually enough to require a written appointment of a representative established in the European Union. Many companies in the United States, Canada, the United Kingdom, Switzerland or Asia have never heard of the rule. European data protection authorities have already fined companies for ignoring it.
Key points
- Who: any controller or processor with no establishment in the EU that offers goods or services to people in the EU, or monitors their behaviour there.
- Risk: up to EUR 10 million or 2% of worldwide annual turnover for failing to appoint one (Article 83(4)(a) GDPR). The Dutch authority fined Locatefamily.com EUR 525,000 for this failure alone.
- Role: the representative is the contact point for supervisory authorities and individuals, keeps a copy of your record of processing activities and cooperates during investigations.
- Not your DPO: the European Data Protection Board considers the two roles incompatible for the same company.
- Other laws: the DSA, NIS2, the AI Act, the Data Act and the Data Governance Act also require an EU representative, each with its own rules.
The fine that put Article 27 on the map
In May 2021, the Dutch data protection authority (Autoriteit Persoonsgegevens) announced a EUR 525,000 fine against Locatefamily.com. The website was run from outside the EU and had never appointed a representative in Europe. That failure was the basis of the fine.
Locatefamily.com published names, addresses and often phone numbers of a very large number of people, Europeans included, to help reconnect lost relatives. Dutch residents who wanted their details removed found nobody to write to. The authority said there had to be an easy way to get that information deleted. On top of the fine, it set a penalty of EUR 20,000 for every two weeks without a representative, capped at EUR 120,000.
The case surprised many advisers because a step often treated as paperwork cost more than a full compliance project would have. It also shows what the rule is for: without a representative, a person living in Europe has no practical way to exercise their rights against a company thousands of kilometres away.
What is a GDPR representative?
Article 4(17) of the GDPR defines the representative as a natural or legal person established in the Union, designated in writing by a controller or processor, who represents it with regard to its obligations under the regulation. Article 27 sets out when the appointment is required and what the representative does.
The appointment is mandatory when the GDPR applies to a non-EU organisation through Article 3(2). That article covers two situations. In the first, the organisation offers goods or services to people who are in the Union, whether paid or free. In the second, it monitors their behaviour when that behaviour takes place in the Union, for example through advertising trackers, profiling, location data or connected devices.
The representative must be established in one of the Member States where the people whose data you process are located. When a large share of them is concentrated in one Member State, the EDPB recommends, as good practice, choosing a representative there.
How to tell whether you target the EU
A website that people in Europe can simply open is not enough. Authorities look for signs that you intend to reach them. The table lists the usual signals, what they mean and how to check your own situation.
| Signal | What you see | What it means | How to check yourself |
|---|---|---|---|
| Currency | Prices shown in euros, or another EU currency, at checkout | You expect European buyers | Open your checkout from an EU address or VPN and look at the currency offered |
| Language | Pages translated into French, German, Spanish, Italian or another EU language | You are writing for European readers | List the language versions of your site and app store pages |
| Delivery | Shipping options to EU countries | You sell to people located there | Check the country list in your shipping settings |
| Advertising | Campaigns targeted at EU audiences | You are actively looking for EU customers | Review the location targeting in your ad accounts |
| Tracking | Cookies, pixels or SDKs that profile EU visitors | You monitor behaviour in the Union | Run a cookie scan from an EU location and read the data flows of your app SDKs |
| Contact | An EU phone number or EU domain name | You present yourself as available to EU customers | Look at your contact page, footer and domain portfolio |
One signal alone may not settle the question. Several together usually do. When in doubt, write down your analysis and date it: an authority will ask for it.
What should I do in my situation?
Open the case closest to yours. Each answer says what the situation means and what to check.
We have no office in the EU and we sell to customers there
We only get occasional EU visitors and never target them
We track EU users with cookies, ads or an app
We have a real subsidiary or branch in the EU
We are a processor (SaaS, hosting, support) for EU clients
We process sensitive data such as health, biometrics or sexual orientation
We run a platform, cloud service or AI model used in the EU
Real-world examples
These situations come up regularly. The label on each card gives the usual answer.
Required
Required
Required
Required
Required
Required
Required
Required
Required
Check your case
Check your case
Check your case
Not required
Not required
Not required
Why appoint an EU representative
Authorities do sanction the omission
Article 83(4)(a) of the GDPR allows fines of up to EUR 10 million or 2% of worldwide annual turnover for a failure to appoint a representative. In March 2022, the Italian authority fined Clearview AI, a US facial recognition company, EUR 20 million and called on it to designate a representative in the EU. In 2024, the Dutch authority fined Clearview again and listed the missing representative among the infringements.
Without a representative, every authority can come to you
The GDPR one-stop-shop mechanism is reserved for organisations with an establishment in the EU. A non-EU company without one can receive requests from several national authorities, each following its own procedure. Clearview was sanctioned separately by several authorities, and none of them could act as lead authority. A representative gives all of them an address, a working language and a person to talk to, so that a formal notice does not go unanswered because nobody received it.
European customers will ask for it
Procurement and vendor security questionnaires from European companies and public bodies routinely include a line on the Article 27 representative. A software vendor or service provider that cannot fill it in loses points, and sometimes the deal. Buyers in healthcare, local government and finance pay close attention to it.
Requests from individuals get answered on time
An access or erasure request written in a European language and sent to a generic mailbox abroad is easily lost. The one-month deadline under Article 12 still runs. A representative who receives the request, acknowledges it in the person’s language and forwards it to the right team prevents the complaint that triggers an investigation.
Other EU laws attach consequences to where your representative sits
The DSA, NIS2, the Data Act and the Data Governance Act place a non-EU company under the jurisdiction of the Member State where its representative is located. Until one is appointed, every Member State may consider itself competent. Choosing the country is a strategic decision.
DPO FRANCE
What an EU representative does
Article 27(4) makes the representative the contact point, in addition to or instead of the controller or processor, for supervisory authorities and data subjects on all issues related to processing. Other articles add specific duties. Each task below says what it involves and how you can check that your representative actually performs it.
1. Contact point for supervisory authorities
Articles 27(4) and 58(1)(a) GDPR
- acknowledge receipt and forward to head office without delay
- track the deadlines set by the authority and chase head office
- send the reply, translated where needed, in the authority’s language
2. Contact point for individuals
Articles 12 to 22 and 27(4) GDPR
- receive the request by post or email
- acknowledge it in the person’s language
- forward it to the right team and track the one-month deadline
- relay the answer and keep a record of the exchange
3. Record of processing activities
Article 30 GDPR
- hold a complete, dated copy of the record
- flag new processing it becomes aware of
- produce the record on first request from an authority
4. Cooperation during investigations
Article 31 GDPR
5. Receiving formal decisions
Recital 80 and EDPB Guidelines 3/2018
6. Visibility and availability
Articles 13(1)(a) and 14(1)(a) GDPR
- check that the contact details are published and current
- provide a postal address and a dedicated email address
7. Relay in case of a data breach
Articles 33 and 34 GDPR
EU representative and DPO: two different roles
A data protection officer advises and monitors compliance independently. A representative acts under the mandate and instructions of the company that appoints it. In its Guidelines 3/2018, the EDPB considers the representative role incompatible with that of an external DPO, and with that of a processor for the same controller, because of the risk of conflicting obligations in enforcement proceedings.
| Criterion | EU representative (Art. 27) | DPO (Art. 37 to 39) |
|---|---|---|
| Who appoints | Non-EU organisations covered by Article 3(2) | Public bodies, large-scale monitoring, large-scale sensitive data |
| Position | Acts under mandate and instructions | Independent, takes no instructions on its tasks |
| Main role | Contact point, record, cooperation | Advice, compliance monitoring, awareness |
| Location | Established in a Member State where data subjects are | Easily accessible from each establishment |
| Combining | Not recommended by the EDPB for the same company | Use two separate providers |
Beyond the GDPR: other EU laws that require a representative
Since 2022, the EU legislator has copied the Article 27 model into many new laws. Each has its own scope, timetable and liability regime.
| Law | Who must appoint | Article | Applies since | Good to know |
|---|---|---|---|---|
| GDPR | Non-EU controllers and processors that target or monitor people in the EU | Art. 27 | 25 May 2018 | Liability limited to its own duties |
| DSA | Non-EU providers of intermediary services: hosting, online platforms, marketplaces, social networks | Art. 13 | 17 February 2024 | The legal representative can be held liable; its details are notified to the Digital Services Coordinator of its Member State |
| NIS2 | DNS, TLD registries, domain registration, cloud, data centres, CDN, managed and managed security services, marketplaces, search engines, social networks | Art. 26 | October 2024, through national laws | The entity falls under the jurisdiction of the representative’s Member State |
| AI Act (GPAI) | Non-EU providers of general-purpose AI models | Art. 54 | 2 August 2025 | Authorised representative verifies the technical documentation |
| AI Act (high risk) | Non-EU providers of high-risk AI systems | Art. 22 | 2 December 2027 (Annex III), 2 August 2028 (Annex I) | Dates postponed by Regulation (EU) 2026/1744; the representative must end the mandate if the provider breaches its obligations |
| Data Act | Covered non-EU entities: connected products, data processing services | Art. 37 | 12 September 2025 | Jurisdiction follows the representative’s Member State |
| DGA | Data intermediation services and data altruism organisations | Art. 11(3) and 19(3) | 24 September 2023 | The service can be suspended if requested information is not provided |
| TCO | Non-EU hosting providers that disseminate content to the public | Art. 17 | 7 June 2022 | Receives removal orders; liable in its own right |
| e-evidence | Non-EU providers of electronic communication and related services | Directive 2023/1544 | 18 August 2026 | Receives European production and preservation orders |
| MDR | Non-EU manufacturers of medical devices, software included | Art. 11, Reg. 2017/745 | 26 May 2021 | Jointly and severally liable for defective devices |
| Clinical trials | Non-EU sponsors of clinical trials of medicinal products | Art. 74, Reg. 536/2014 | 31 January 2022 | Receives all notifications addressed to the sponsor |
Similar rules exist next door. The UK GDPR has its own Article 27, so a company that targets people in the United Kingdom needs a UK representative as well. Switzerland’s Federal Act on Data Protection (Article 14) can require a Swiss representative for regular, large-scale processing of data about people in Switzerland.
Choosing the right EU representative
Signing the mandate takes an afternoon. Problems show up later, the day a letter from an authority or an urgent erasure request arrives.
- The country. Pick a Member State where your users are, ideally the one with the largest share. Under the DSA, NIS2 and the Data Act, that choice also determines your competent authority.
- Languages. The representative must be able to deal with individuals and authorities in their language.
- Independence from your other providers. Following the EDPB, do not give the role to your external DPO or to a processor that handles your data.
- A precise written mandate. It sets out the tasks, forwarding times, access to the record, the breach workflow and the conditions for ending the mandate.
- Coverage of several laws. If the DSA, NIS2 or the AI Act also apply to you, check that your representative can take on those mandates, or coordinate several representatives.
- Evidence. Ask for a log of requests received and forwarded. It will be useful during an investigation.
Quick quiz: test your knowledge
Five questions. Open the answer you think is right.
Question 1 of 5
A. Yes, a written appointment is required
B. No, the GDPR only applies to EU companies
C. Only if it has more than 250 employees
Question 2 of 5
A. Yes, it is the simplest option
B. The EDPB considers the two roles incompatible
C. Only if both are in the same country
Question 3 of 5
A. The representative, who replaces the company
B. The company, while the representative answers for its own duties
C. Nobody until the authority decides
Question 4 of 5
A. EUR 20,000
B. EUR 10 million or 2% of worldwide turnover
C. A warning only
Question 5 of 5
A. Yes, every non-EU group does
B. No, the GDPR applies through the EU establishment
C. Yes, in addition to the subsidiary
See how you scored
- 5 out of 5: you know the rule well. Check that your privacy notice names your representative.
- 3 or 4: the basics are there. Reread the sections on liability and the DPO.
- 0 to 2: worth a closer look. Use the situation guide above, then ask for a review of your obligations.
Frequently asked questions
Does a US company need an EU representative?
Is the EU representative liable for the company’s breaches?
Can my DPO also be my EU representative?
In which country should the representative be based?
Does a representative give access to the one-stop-shop?
What happens if we do not appoint a representative?
Are UK and Swiss companies concerned?
What should the appointment contract contain?
Request an EU representative
Tell us about your organisation. DPO FRANCE representatives speak French, Spanish and German, so they can answer European authorities and individuals in their own language. The role is handled by a network member who is not your DPO, as the EDPB recommends. We will review your situation and get back to you, usually within two business days.
DPO FRANCE · EU representation
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 3, 4, 27, 30, 31, 58 and 83
- EDPB, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.0
- National Law Review, Dutch DPA fines Locatefamily.com EUR 525,000 for failure to designate an EU representative
- Biometric Update, Italian authority fines Clearview AI EUR 20 million (March 2022)
- Taylor Wessing, Representatives under European digital law (updated 2025)
- European Commission, AI Omnibus (Regulation (EU) 2026/1744) enters into force