EU representative under GDPR (Article 27): who needs one and how to appoint one

If your company is based outside the EU, in London, Geneva, Toronto or New York, and the GDPR applies to you because you sell to people in the EU or track what they do online, one obligation is easy to miss: appointing a GDPR EU representative. It comes from Article 27 of the regulation and has applied since 25 May 2018.

Setting one up takes a written mandate and a few lines in your privacy policy. Not having one has already cost a website based outside the EU a six-figure fine in the Netherlands.

I work between London and Paris, so this guide looks at both sides of the Channel: businesses outside the EU selling into it, and EU businesses selling into the UK, which has its own version of the rule. It belongs to my complete guide to GDPR. If you are not yet sure the GDPR applies to you at all, start with the two tests for companies outside the EU.

What a GDPR EU representative is, and what it is not

The GDPR defines a representative as a natural or legal person established in the EU, designated in writing by a controller or processor that is not established there, to represent it with regard to its obligations under the regulation (Article 4(17)). In plain words: your official contact point inside the EU.

Article 27 of the GDPR sets out the mandate. Data protection authorities, such as the CNIL in France or the Data Protection Commission in Ireland, and the people whose data you process can address the representative in addition to you, or instead of you, on any issue related to your processing.

Three things it is not:

• Not a data protection officer. A DPO (Article 37) advises you and monitors your compliance with guaranteed independence. A representative acts on your instructions, as your contact point.
• Not a transfer of responsibility. Article 27(5) says legal action can still be brought against you directly.
• Not a compliance service. Its legal role is to be reachable and to keep your record of processing, not to write your privacy policy or set up your cookie banner.

Who needs an EU representative under Article 27

You need one when both of these are true:

1. Your company has no establishment in the EU: no office, branch, subsidiary or stable team there.
2. The GDPR applies to you anyway, through Article 3(2): you offer goods or services to people who are in the EU, or you monitor their behaviour there, for example through behavioural advertising or profiling.

The obligation covers processors as well as controllers when they fall under Article 3(2). Size makes no difference: Article 27 sets no threshold in staff or turnover, so a team of two is in the same position as a multinational.

Some examples:

Since Brexit, the first line describes a lot of UK businesses: selling into the EU from Manchester puts you in the same position as a company in Toronto.

The exemption: occasional, low-risk processing

Article 27(2) lifts the obligation for public authorities and bodies, and for processing that meets all three of these conditions:

• it is occasional;
• it does not include, on a large scale, special categories of data (health, religion, sexual orientation and the others listed in Article 9) or data about criminal convictions and offences (Article 10);
• it is unlikely to result in a risk to people’s rights and freedoms, given its nature, context, scope and purposes.

The word doing the work is “occasional”. The European Data Protection Board (EDPB), which brings together the EU’s data protection authorities, reads it as processing that is not carried out regularly and falls outside the normal course of your business, and weighs risk by both its likelihood and its severity. Both points are in its Guidelines 3/2018 on territorial scope, which also cover representatives.

In practice, this rules out most businesses that target the EU on purpose. Weekly parcels to France, a subscription with EU users or ads aimed at EU countries are regular by design. The exemption is more plausible for a one-off, such as a single event in Lisbon with a simple registration form, run by a company whose business is elsewhere.

What the representative does day to day

The mandate comes with three duties:

1. Receiving contact. Regulators and people in the EU can write to the representative about anything related to your processing: a question, a complaint, an access or erasure request. The representative passes it on; you still answer, within the GDPR’s deadlines.
2. Keeping your record of processing. Article 30 asks each controller “and, where applicable, the controller’s representative” to maintain a record of processing activities, and the representative must make it available to a regulator on request.
3. Cooperating with regulators. Article 31 extends the duty to cooperate to representatives, and Article 58(1)(a) lets an authority order the representative to provide information.

Everything else stays with you: the decisions, the compliance work and the answers. A personal data breach is the clearest example. Notifying it remains your responsibility, and the EDPB’s guidelines on breach notification expect a company without an EU establishment to notify the authority of every EU country where affected people live, not only the country where its representative is based. My guide to the first 72 hours after a data breach covers the steps.

How to appoint an EU representative, step by step

1. Confirm that Article 27 applies. Check the two conditions and the exemption above.
2. Choose the country. The representative must be established in one of the EU countries where the people you serve or monitor are (Article 27(3)). The EDPB recommends, as good practice, the country where a significant share of them are: a Manchester shop whose EU customers are mostly in Ireland would pick Ireland. People in the other countries must still be able to reach it.
3. Choose who. Any person or company established in that country can take the role: a law firm, a consultancy or a specialised representative service. Pick someone who replies quickly, handles your customers’ languages and will still be there in a few years. Leave out the processors that work for you, such as your hosting or email provider: the EDPB considers the two roles incompatible.
4. Sign a written mandate. Article 27(1) requires the designation in writing, and Recital 80 speaks of a written mandate. It should say who represents whom, from which date, for which processing, which tasks the representative takes on, how fast it forwards messages and what happens when the contract ends. For the UK equivalent, the ICO says a simple service contract can be used.
5. Hand over your record of processing. Give the representative an up-to-date copy of your Article 30 record and the name of someone on your side who answers within days. If you have no record yet, now is the time to write one.
6. Update your privacy policy. Add the representative’s name and contact details next to yours, as Articles 13 and 14 require. My guide to what a privacy policy must say shows where they fit.
7. Run it and review it. Agree how requests reach you, keep a log of them, and check the mandate once a year or whenever you start selling in a new country.

The UK and Switzerland have their own rules

An EU representative covers the EU only. Two neighbours have their own version, and each needs its own appointment.

United Kingdom: a UK representative

UK GDPR keeps an Article 27 of its own. An organisation with no branch, office or other establishment in the UK that offers goods or services to people in the UK, or monitors their behaviour, must appoint a UK representative in writing, with the same exemptions. That catches EU businesses too: a French or Irish online shop that ships to Britain needs one.

The ICO explains the rule in its guidance on receiving personal information from the EEA, in the section on UK representatives. The ICO formally became the Information Commission on 30 September 2026 but keeps its familiar name. As of 19 October 2026, its guidance still describes the UK representative duty in these terms, although the Data (Use and Access) Act 2025 has changed several parts of UK data law, which I cover in what the Act changed.

Switzerland: a narrower rule

Switzerland’s revised Federal Act on Data Protection (nFADP), in force since 1 September 2023, requires a Swiss representative from private companies based abroad only when four conditions are all met (Article 14): the processing concerns people in Switzerland and is linked to offering them goods or services or monitoring their behaviour; it is extensive; it is regular; and it involves a high risk for the people concerned. If any one is missing, Article 14 does not apply to you.

If all four are met, the representative must be in Switzerland, since an EU representative does not count, and its name and address must be published. It is the contact point for individuals and for the Federal Data Protection and Information Commissioner (FDPIC).

What happens if you do not appoint one

A missing representative is a breach of Article 27, which sits in the lower tier of GDPR fines: up to 10 million euros or 2% of worldwide annual turnover, whichever is higher (Article 83(4)). That is a ceiling. Regulators set each amount using the factors listed in Article 83(2), and my article on what GDPR fines look like for small teams goes through real cases.

The case usually cited is Dutch. In May 2021 the Autoriteit Persoonsgegevens, the Netherlands’ regulator, announced a fine of 525,000 euros against Locatefamily.com, a website that published people’s contact details, had no establishment in the EU and had not appointed a representative since May 2018. People struggled to get their details removed, and the authority received 19 complaints. On top of the fine, it ordered the site to appoint a representative within 12 weeks, under a penalty of 20,000 euros per two weeks, capped at 120,000 euros.

Two lessons for a small team. The case started with complaints from people who had no one in the EU to turn to. And the fine did not replace the obligation: the site still had to appoint a representative.

Your checklist, and when to hand it over

• Check whether the GDPR applies to you (Article 3) and whether you have an establishment in the EU.
• Test the exemption honestly and write down your conclusion.
• Choose the country, ideally where a significant share of your EU customers or users are, then the representative.
• Sign the written mandate and hand over your record of processing.
• Add the representative’s name and contact details to your privacy policy.
• Check whether you also need a UK representative (UK GDPR) or a Swiss one (nFADP, Article 14).
• Put a yearly review in your calendar.

This guide explains the rules as they stand on 19 October 2026; it is not legal advice. A lawyer, or your DPO if you have one, is worth involving if you handle health or other sensitive data, track people on a large scale, sell into many EU countries at once or have received a letter from a regulator.

Privacy and legal pages are part of my website projects, so your representative’s details have a proper place on your site from day one.