Home › Resources

GDPR EU Representative: What Article 27 Requires and How to Comply

Published September 19, 2026 · Updated October 9, 2026

A GDPR EU representative is a person or organization based in the European Union that a non-EU company designates as its local contact point for data protection authorities and individuals whose data it processes. Article 27 of the GDPR requires this appointment whenever a company outside the EU is subject to the regulation under Article 3(2) -- meaning it offers goods or services to people in the EU, or monitors their behavior. If your app or website serves EU users and you have no EU establishment, you almost certainly need one.

This guide covers what Article 27 actually says, who qualifies for an exemption, how a representative differs from a Data Protection Officer, what the appointment process involves, and how to disclose your representative in your privacy policy with ready-to-use clause text. If you are not yet sure whether the GDPR applies to your company at all, start with our breakdown of whether GDPR applies to US companies -- it covers the Article 3 territorial-scope test in detail.

What Article 27 Actually Requires

Article 27(1) of the GDPR states:

"Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union."

In plain language: if you are a company outside the EU and the GDPR applies to you because you offer goods or services to people in the EU or monitor their behavior (the two triggers in Article 3(2)), you must appoint a representative who is physically established in an EU member state. The appointment must be in writing -- a verbal agreement does not satisfy the requirement.

Article 27(3) adds a geographic constraint. Your representative must be established in one of the member states where the data subjects whose data you process are located. If your app's EU users are spread across multiple countries, the representative can be in any one of those member states -- you do not need a representative in every country where you have users.

Article 27(4) defines the representative's role: they are "mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing." The representative is not a shield or a substitute for your own accountability -- Article 27(5) makes clear that appointing a representative does not affect any legal actions that could be brought against you directly.

The obligation applies to both data controllers (companies that decide why and how personal data is processed) and data processors (companies that process data on behalf of a controller). If you are a US-based SaaS company that processes EU user data on behalf of your clients, you need a representative just as much as a company collecting that data directly.

Who Is Exempt

Article 27(2) carves out two exemptions from the representative requirement. Both are narrower than most small companies expect.

The occasional-processing exemption

Article 27(2)(a) exempts processing that meets all three of the following conditions simultaneously:

• The processing is occasional -- not regular, systematic, or ongoing.
• The processing does not include large-scale processing of special categories of data (Article 9(1) data such as health, biometric, racial, or political opinion data) or data relating to criminal convictions and offences (Article 10).
• The processing is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope, and purposes of the processing.

All three conditions must be met. Fail any one and the exemption does not apply. For most US companies with a publicly available app or website that continuously collects user data (email addresses, device identifiers, analytics data, IP addresses), the processing is not "occasional" -- it is ongoing and systematic. The exemption was designed for one-off or irregular data transfers, not for companies with a persistent digital presence serving EU users.

A practical example of processing that would qualify: a US consulting firm that occasionally receives a spreadsheet of employee data from a one-time EU client engagement, does not process any special-category data, and the data involves a small number of individuals with minimal risk. That is genuinely occasional. A US mobile app with EU downloads collecting analytics data daily is not.

The public-authority exemption

Article 27(2)(b) exempts public authorities and bodies. This is straightforward: if you are a government entity, you do not need to appoint a representative. This exemption is irrelevant to private companies, startups, and independent developers. If you are reading this guide, it almost certainly does not apply to you.

What a Representative Does (and Does Not Do)

The most common confusion around Article 27 is conflating the EU representative with a Data Protection Officer (DPO). They are different roles with different legal bases, different responsibilities, and different appointment triggers.

What the representative does

• Acts as a local contact point. The representative is the address that EU data protection authorities and data subjects use to reach your company on data protection matters. When a supervisory authority in Germany wants to contact you about a complaint, they contact your representative.
• Maintains records of processing activities. Under Article 30, the representative must keep a copy of the records of processing activities that you, as the controller or processor, are required to maintain and provide to them.
• Cooperates with supervisory authorities. If a data protection authority initiates an inquiry or investigation, the representative cooperates with them on your behalf.

What the representative does NOT do

• The representative is not a DPO. A Data Protection Officer (required under Article 37 for certain types of organizations) has an internal advisory and oversight role -- they monitor compliance, conduct data protection impact assessments, and serve as the contact point for data subjects within the organization. The representative is an external-facing contact for authorities and data subjects to reach you. They are different obligations that can coexist: a company may need both a DPO and a representative.
• The representative does not make compliance decisions for you. They do not audit your data practices, design your data protection strategy, or advise you on lawful bases. Those responsibilities remain yours (or your DPO's, if you have one).
• The representative does not absorb your liability. Article 27(5) is explicit: appointing a representative does not limit or shift the legal actions that can be brought against you. The representative is a communication channel, not a liability buffer.

Think of it this way: the DPO is your internal compliance advisor. The representative is your EU mailbox. Both are required under different conditions, and neither replaces the other.

How to Appoint an EU Representative

The appointment process under Article 27 requires a written mandate. There is no official form or registration with an EU authority -- the mandate is a contract between you and your representative. Here is what the process involves:

Step 1: Choose your representative

Your representative can be a natural person (an individual) or a legal person (a company or organization) established in the EU. Many companies use specialized representative service providers, but you can also appoint an EU-based law firm, a consultancy, or even an individual. The representative must be in a member state where your data subjects are located.

Step 2: Draft the mandate letter

The written mandate should contain at a minimum:

• The identity and contact details of both the appointing company (controller or processor) and the representative.
• An explicit statement that the representative is designated under Article 27 of the GDPR.
• The scope of the mandate: that the representative is authorized to be addressed by supervisory authorities and data subjects on all issues related to processing for the purposes of ensuring compliance with the GDPR.
• The obligation of the representative to maintain the records of processing activities provided by the controller or processor under Article 30.
• The obligation of the representative to cooperate with supervisory authorities on request.
• Duration, termination, and liability provisions between the parties.

Step 3: Provide your records of processing

Under Article 30(1) and 30(2), the representative must hold a copy of your records of processing activities. Prepare these records and provide them to the representative before or at the time of the appointment. The records must include the categories of data you process, the purposes, the categories of recipients, international transfer details, and retention periods.

Step 4: Publish the representative's details

Once appointed, you must make the representative's name and contact details available to data subjects and supervisory authorities. The standard place to do this is your privacy policy. Article 13(1)(a) and Article 14(1)(a) require that you provide the identity and contact details of your representative when informing data subjects about data processing.

Naming Your Representative in Your Privacy Policy

Your privacy policy must identify your EU representative when one is required. Articles 13 and 14 of the GDPR require that you provide the representative's identity and contact details as part of the information you give to data subjects at the point of data collection.

Below is a sample clause you can adapt for your own privacy policy. Replace the placeholder values with your representative's actual details:

Place this clause near the top of your privacy policy alongside your own company's identity and contact information, or in a dedicated "Contact Us" or "Data Controller" section. The key requirement is that data subjects can find it without difficulty.

If you are building a privacy policy from scratch and want to make sure all required GDPR sections are covered -- including the representative disclosure -- you can generate a privacy policy with the free generator. To check whether your app's setup triggers GDPR at all (and which other laws may apply), the privacy law checker walks through the factors in a few clicks.

The UK GDPR Representative Requirement

After Brexit, the United Kingdom retained the GDPR as domestic law under the name "UK GDPR." Article 27 of the UK GDPR mirrors its EU counterpart almost word for word, but applies independently. If your company is outside the UK and processes personal data of people in the UK under UK GDPR Article 3(2) -- by offering them goods or services, or monitoring their behavior -- you must appoint a separate representative based in the United Kingdom.

The practical consequence is that a non-EU, non-UK company serving users in both the EU and the UK may need two representatives: one in an EU member state under EU GDPR Article 27, and one in the UK under UK GDPR Article 27. An EU-based representative does not satisfy the UK requirement, and a UK-based representative does not satisfy the EU requirement. They are separate legal obligations under separate legal regimes.

How the UK GDPR representative differs

• Location. The UK representative must be established in the United Kingdom, not in an EU member state. Article 27(3) of the UK GDPR requires the representative to be in the UK where the data subjects whose data you process are located.
• Supervisory authority. The UK representative's counterpart is the Information Commissioner's Office (ICO), not an EU data protection authority. The ICO enforces the UK GDPR and the Data Protection Act 2018.
• Exemptions. The same two exemptions apply -- occasional processing that meets all three conditions of Article 27(2)(a), and public authorities under Article 27(2)(b). The threshold analysis is the same.
• Penalties. Non-compliance with the UK GDPR representative requirement carries fines under UK GDPR Article 83(4)(a), mirroring the EU fine structure: up to 8.7 million pounds or 2% of annual worldwide turnover, whichever is higher (the UK-adjusted equivalent of the EU's 10 million euro tier).

If your privacy policy already names an EU representative, add a parallel disclosure for your UK representative. The sample clause format in the previous section works for the UK representative as well -- replace the Article reference with "Article 27 of the UK GDPR" and list the UK-based representative's contact details separately. For a full walkthrough of how UK data protection law intersects with the GDPR for US-based companies, see our guide on whether GDPR applies to US companies.

Article 83 Penalties for Non-Compliance

Failure to appoint a representative under Article 27 is not a minor procedural oversight -- the GDPR treats it as a sanctionable violation with a dedicated penalty tier.

Article 83(4)(a) of the GDPR lists the representative obligation among the violations subject to administrative fines of up to 10 million euros, or 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher. This is the GDPR's "standard" fine tier -- the same tier that covers violations of data controller and processor obligations under Articles 8, 11, 25 through 39, and 42 and 43.

For context, the GDPR's upper fine tier under Article 83(5) -- up to 20 million euros or 4% of worldwide turnover -- is reserved for violations of the core data processing principles, lawfulness conditions, data subject rights, and international transfer rules. The Article 27 obligation falls in the lower tier, but "lower" is relative: 10 million euros or 2% of turnover is a material exposure for any company.

How enforcement works in practice

Supervisory authorities consider several factors under Article 83(2) when deciding the amount of a fine, including the nature, gravity, and duration of the infringement; whether the violation was intentional or negligent; what measures the company took to mitigate damage; the degree of cooperation with the supervisory authority; and the categories of personal data affected.

A company that has never appointed a representative and ignores correspondence from a supervisory authority faces a worse outcome than one that appointed a representative late but cooperated fully once contacted. The absence of a representative also creates a practical enforcement problem: without a local contact point, supervisory authorities may have difficulty reaching you, which can lead to default decisions and higher penalties.

The representative obligation interacts with other compliance requirements. A supervisory authority investigating a data breach or a data subject complaint will notice the absence of a representative as an additional violation, compounding the total exposure. It is rarely the primary reason for a large fine, but it adds to the list of infringements and signals systemic non-compliance, which Article 83(2)(b) treats as an aggravating factor when the supervisory authority finds "relevant previous infringements by the controller or processor."

If you need to verify whether your current privacy setup meets the GDPR's baseline requirements -- including the representative disclosure, lawful basis statements, and data subject rights sections -- the GDPR compliance checklist covers each obligation with a pass/fail check.

Frequently Asked Questions