By Daniel de Almeida Afonso · Last updated: October 12, 2026
Yes, if your organization has no office or other establishment in the EU, but offers goods or services to people in the EU or monitors their behavior, GDPR Article 27 requires you to appoint an EU representative in writing, unless the processing is only occasional and low risk or you are a public authority. The representative must be established in an EU Member State where those people are, and appointing one does not move any legal responsibility away from you. Failing to appoint one can lead to fines of up to €10 million or 2 percent of worldwide annual turnover, whichever is higher.
The UK and Switzerland have their own representative rules, with different triggers. This article is general information, not legal advice. For the wider question of who the GDPR covers, see our guide on who the GDPR applies to.
Who must appoint an EU representative
Article 27(1) applies when two conditions are both true.
- You are a controller or processor that is not established in the EU.
- Your processing falls under Article 3(2), because it relates to offering goods or services to people in the EU, or to monitoring their behavior in the EU.
If you do have a branch, office, or other establishment in the EU and the processing happens in the context of its activities, Article 3(1) applies instead and you do not need a representative. Appointing a representative does not create an establishment either. The European Data Protection Board (EDPB) says so in its Guidelines 3/2018 on territorial scope (version 2.1).
Offering goods or services
Payment is not required. A free app, a free trial, or a free report counts if you are targeting people in the EU. Merely having a website that EU residents can reach does not. The EDPB points to signals such as:
- selling in euros or another EU currency
- offering the site in an EU language you would not otherwise use
- naming customers or users in the EU
- delivering to EU countries only or advertising to them
If goods or services reach someone in the EU by accident, the GDPR does not apply to that processing.
Monitoring behavior
The EDPB lists behavioral advertising, geolocation for marketing, online tracking with cookies or fingerprinting, personalized health analytics, and market surveys built on individual profiles. It also says that not every online collection of data counts. The EDPB looks at your purpose and at any later behavioral analysis or profiling. A site that runs ad tracking on visitors in France is a much stronger case than one that logs a stray IP address.
When you do not need a representative
Article 27(2) gives two exemptions.
Occasional, low-risk processing. All three parts must hold: the processing is occasional, it does not involve large-scale special category data or criminal offense data, and it is unlikely to result in a risk to people's rights and freedoms. The EDPB reads "occasional" narrowly: processing that is not carried out regularly and happens outside your normal course of business. A company that markets to the EU every month is not occasional. The EDPB also notes that the test is any risk, not "high risk" as in some other GDPR provisions.
Public authorities and bodies. Processing by a public authority or body is exempt. The EDPB expects few cases where a third-country public body offers services to or monitors people in the EU, and says supervisory authorities will assess the status case by case.
Two common mistakes are worth correcting. There is no exemption for companies with fewer than 250 employees in Article 27. That threshold appears in Article 30(5), which covers records of processing, and it does not excuse you from appointing a representative. Also, handling sensitive data is a reason the exemption does not apply, not a separate trigger for needing a representative.
Where the representative must be located
Article 27(3) requires the representative to be established in one of the Member States where the people you target or monitor are. One representative is enough, even if you serve several countries. The EDPB recommends, as good practice, choosing the Member State where most of those people live. The representative must still be easy to reach for people and authorities in the other countries where you operate.
Where you process the data is irrelevant. A Canadian consulting firm with clients in Estonia, Malta, and Belgium could appoint in any of those three, and Estonia would be the sensible choice if most clients are there. It could not choose Germany on the strength of a German cloud server.
You do not have to register or notify the representative with any supervisory authority. You do have to name the representative and give contact details to the people whose data you handle, for example in your privacy notice, under Articles 13(1)(a) and 14(1)(a). The EDPB says failing to do so breaches your transparency obligations.
How to appoint one
- Confirm you are in scope. Check Article 3(2) and the exemptions above, and write down your reasoning, including why you concluded an exemption applies if you rely on one.
- Pick the Member State. Use the location of the people you target or monitor, and prefer the country with the largest share.
- Choose the representative. It can be an individual or an organization, such as a law firm, a consultancy, or a dedicated provider, as long as it is established in the EU. One representative can act for several non-EU controllers.
- Sign a written mandate. Recital 80 requires explicit designation by written mandate. In practice this is usually a service contract. The EDPB suggests naming one lead person at the representative organization.
- Publish the details. Put the representative's name and contact details in your privacy notice and in the information you give at collection.
- Feed the representative accurate information. See the section on duties below.
What to look for in a representative
The GDPR does not require the representative to be a data protection expert, but the role is practical, so test these points before you sign:
- Language coverage. The EDPB says communication with authorities and individuals should in principle happen in their languages, with a team if needed.
- Response process. Ask how requests reach you, how fast, and who owns the answer. The representative is not itself responsible for answering data subject requests, but it must help them reach you.
- No conflicting roles. The EDPB does not consider the representative role compatible with being your external data protection officer (DPO) or your processor, because of the conflict of interest. Ask whether the provider also holds those roles for you.
- Contract scope. Check that it covers authority inquiries, Article 30 records access, and complaint handling, and what happens if you stop paying.
- Contact point continuity. A named person, a shared inbox, and a plan for staff turnover.
What the representative does, and what it does not do
Under Article 27(4), supervisory authorities and individuals can address the representative in addition to or instead of you on all issues about GDPR compliance. Other articles add specific tasks:
- Records of processing. Article 30 lists the controller's representative among the people who keep a record of processing activities. The EDPB says you remain responsible for the content and updates, and you must give the representative accurate information so it can produce the record when an authority asks. Our guide to Article 30 records covers how to build one.
- Cooperation. Article 31 requires controllers, processors, and where applicable their representatives to cooperate with the supervisory authority on request.
- Facilitating rights requests. The representative passes requests between individuals and you. It does not answer for you.
Article 27(5) and Recital 80 are clear that appointing a representative does not affect your responsibility or liability. The EDPB adds that the GDPR does not make the representative liable in your place. Authorities can still address corrective measures, fines, and penalties to the representative as the contact point, but direct liability is limited to the representative's own duties under Articles 30 and 58(1)(a). Read your mandate for indemnity terms.
Representative versus DPO
The representative acts on your instructions. A DPO must be able to work independently and, under Article 38(3), may not receive instructions on how to do the job. That is why the roles differ and why the EDPB treats them as incompatible when the DPO is external. If you also need a DPO, see our guide to data protection officers.
UK and Swiss representatives
The EU representative does not cover the UK or Switzerland. Each has its own rule, and the thresholds differ.
| Topic | EU GDPR Article 27 | UK GDPR Article 27 | Swiss FADP Article 14 |
|---|---|---|---|
| Who must appoint | Controllers and processors outside the EU that fall under Article 3(2) | Controllers and processors outside the UK that fall under Article 3(2) | Private controllers abroad that process personal data in Switzerland |
| Trigger | Offering goods or services to, or monitoring, people in the EU | Offering goods or services to, or monitoring, people in the UK | All four must apply: offering or monitoring in Switzerland, large scale, regular, and high risk to personality rights |
| Exemptions | Occasional low-risk processing; public authorities | Same as the EU wording | Not required if any of the four conditions is missing; appointment is voluntary |
| Where located | A Member State where the people are | The United Kingdom | Switzerland |
For the UK, Article 27 on legislation.gov.uk still requires a representative in the "United Kingdom". The Data (Use and Access) Act 2025 did not remove it. The latest version of Article 27 on that site shows only a one-word change to paragraph 4 from September 30, 2026, made by a consequential amendments regulation, and no other outstanding changes. A non-UK controller that targets UK customers should treat the UK rule as separate from the EU one. Our UK GDPR guide covers the wider UK regime.
For Switzerland, Article 14(3) requires you to publish the representative's name and address, for example in your privacy policy. The Federal Data Protection and Information Commissioner (FDPIC) says all four conditions must be met, and it assesses the risk without counting measures you have taken to reduce it. Disclosure to the FDPIC is voluntary. Read our Swiss FADP guide for the rest of the Swiss law.
Penalties and enforcement
Article 83(4)(a) puts breaches of the controller and processor obligations in Articles 25 to 39 into the lower fine tier, which covers Article 27. The ceiling is €10 million or 2 percent of total worldwide annual turnover, whichever is higher. Supervisory authorities can also order you to appoint a representative and attach a periodic penalty to the order. For how fines are set in general, see our GDPR fines explainer.
Public decisions on this point do exist, though fewer than for other violations:
- Locatefamily.com, Netherlands. The Dutch Autoriteit Persoonsgegevens fined this people-search website €525,000, announced in May 2021, for not designating a representative. The company had no EU establishment and the authority concluded it was offering its services to people in the EU. Secondary reports add that the authority also set a penalty of €20,000 per two weeks, up to €120,000, if the company stayed without a representative.
- Clearview AI, Netherlands. The Dutch authority's decision of May 16, 2024, which carried a total fine of €30.5 million, found that Clearview had not designated a representative as Article 27(1) requires, and ordered it to stop. The fine covers several violations, so no part of it is attributable to Article 27 alone.
- Clearview AI, Greece. The Hellenic Data Protection Authority's decision of July 13, 2022 found violations of Articles 12, 14, 15, and 27 and imposed a €20 million fine for all of them.
Frequently asked questions
Do I need an EU representative if I only have a website that EU residents can visit?
Not just because they can visit it. Mere accessibility does not trigger Article 3(2), but if you target EU residents, for example with EU currencies, EU languages, or tracking for advertising, you probably do. Check both triggers and the occasional-processing exemption before deciding.
Does a free product or service count as offering goods or services?
Yes, if it is directed at people in the EU. Article 3(2)(a) applies whether or not the person pays. A free app or newsletter aimed at EU users counts.
Can my EU representative also be my DPO?
The EDPB says the two roles are incompatible when the DPO is external, because a DPO must work independently and a representative acts on your instructions. A DPO who is an employee but not also the representative is a different question. Keep the two separate.
Do I need a representative in every EU country where I have customers?
No. You need one representative, established in one of the Member States where your targeted or monitored people are. Choose the Member State with the largest share of them if you can. The representative must stay reachable by people in the other countries.
Does appointing a representative make them liable instead of me?
No. You stay fully responsible, and the GDPR does not create liability for the representative in your place. Authorities can still address enforcement to the representative, but its direct liability is limited to its own duties, such as Articles 30 and 58(1)(a). Check your contract for indemnities.
Do I have to tell the supervisory authority who my representative is?
No. The GDPR does not require you or the representative to notify any authority. You must name the representative and give contact details to individuals, for example in your privacy notice.
Does the UK or Switzerland accept my EU representative?
No. The UK GDPR requires a representative in the United Kingdom if the same targeting or monitoring test is met for UK residents, and the Swiss FADP has its own four-part test for a Swiss representative. An EU representative does not satisfy either.
What to do next
Write down whether Article 3(2) applies, which exemption you rely on if any, and which Member State you chose. Sign the mandate, publish the details, and revisit the decision when your market changes.
