Does a mobile app with EU users need a GDPR representative?

Does publishing in EU storefronts count as offering a service?

The GDPR reaches developers outside the EU through Article 3(2). It applies to a controller or processor not established in the EU when its processing relates to offering goods or services to people in the EU, or to monitoring their behaviour there.^[1] Free apps count: the offer is caught "irrespective of whether a payment of the data subject is required".^[1] Where Article 3(2) applies, Article 27 requires a representative in an EU country where your users are, designated in writing.^[1]

You choose where your app is available. In App Store Connect, the All Countries or Regions option makes an app available in all 175 App Store countries or regions, and in any added later.^[9] In Google Play Console, a country you select is included in every current and future production release.^[10]

The EDPB's guidelines never mention app stores. Their test looks for an intention to offer the service to people in the EU. Signs include naming an EU country, marketing aimed at an EU audience, or using a language or currency other than the one generally used in your own country. Mere accessibility from the EU is not enough.^[4] In our view, choosing EU storefronts is more than accessibility: it is a decision to offer the app there. In the EDPB's Example 9, a US start-up's city-mapping app available in Paris and Rome targets people in the EU.^[4]

The test has a limit. In Example 10, a US news app used by an American tourist in Europe is out of scope. Its terms and dollar-only pricing show it is aimed exclusively at the US market.^[4] In our view, if your app genuinely serves one non-EU market, removing the EU storefronts and noting why is the clearest way to show it. The EDPB's other signals still count.^[4]

Which SDKs count as monitoring behaviour?

Article 3(2)(b) is the second trigger: monitoring the behaviour of people in the EU, as far as that behaviour takes place in the EU.^[1] Recital 24, as the EDPB quotes it, asks whether people are "tracked on the internet including potential subsequent use" of profiling techniques.^[4]

The EDPB's list of monitoring activities includes behavioural advertising, geo-localisation (in particular for marketing), online tracking through cookies or other techniques, and behavioural studies based on individual profiles.^[4] Its Example 18 is a Canadian app developer with no EU establishment that monitors people in the EU. The GDPR applies to it under Article 3(2)(b).^[4]

There is a limit here too. Monitoring implies that the controller "has a specific purpose in mind" for the data about a person's behaviour. The EDPB "does not consider that any online collection or analysis of personal data of individuals in the EU would automatically count as 'monitoring'".^[4] So the question is your purpose as controller, in particular any later behavioural analysis or profiling.^[4]

The last two columns are our summary and assessment, not the EDPB's or the vendors' wording.

The French regulator, the CNIL, adopted a recommendation on mobile applications in July 2024.^[5] Its French-language guidance on SDKs warns that an SDK can collect more data than the developer and the app's users think.^[6]

Does a solo developer with no company count?

Yes. A controller is "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data".^[1] The definition does not require a company.^[1] The ICO puts it plainly to app developers: "If you are determining the purpose and means of processing data, you are the data controller."^[7]

The test is deciding the purposes and means. If you both publish and build the app, that usually makes you the controller. The CNIL's SDK guidance calls the publisher the controller, and notes that in practice the developer often decides which SDKs to use.^[6]

The CNIL adds that an SDK provider may itself be the controller of processing carried out through its SDK, or a processor if it only processes data on someone else's behalf.^[6] In our view, that does not remove your obligations for the processing you decide on. Article 27 applies to controllers and processors alike.^[1]

Does a small number of EU installs make the processing occasional?

Article 27(2)(a) exempts processing only if all three conditions are met. The other exemption, in Article 27(2)(b), is for public authorities and bodies.^[1]

1. The processing is occasional.
2. It does not include, on a large scale, special categories of data under Article 9(1) or data on criminal convictions and offences under Article 10.
3. It is unlikely to result in a risk to people's rights and freedoms, given the nature, context, scope and purposes of the processing.

The first condition is where apps fail. The EDPB considers processing occasional only if it "is not carried out regularly, and occurs outside the regular course of business or activity of the controller or processor".^[4] Three SDKs in the table collect identifiers without any step by you: AdMob "automatically", Firebase Analytics "by default" on Android, and Adjust "with every package" it sends.^[11][12][14] In our view, a live app with such SDKs processes EU users' data regularly and in the ordinary course of your business, whatever the install count.

The third condition is stricter than it looks: the test is whether processing is unlikely to result in a risk, not a high risk.^[4] In our view, an app that passes advertising IDs to several SDK providers will struggle to meet it.

Not sure whether this applies to you? Take the 3-minute check →

What happens if you do not appoint one?

Not designating a required representative breaches Article 27(1).^[1] Article 83(4)(a) caps fines for breaches of Articles 25 to 39 at EUR 10 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher.^[1]

In the LocateFamily.com case, Hunton Andrews Kurth reports that the Dutch Data Protection Authority imposed a EUR 525,000 fine for failure to comply with Article 27, plus an order to appoint a representative under penalty.^[16] The authority announced the fine on 12 May 2021.^[17] Arthur Cox reports that the company could not rely on the "occasional processing" exemption because its processing of personal data was regular.^[18]

The dates come from the EDPB guidelines,^[4] the UK GDPR text^[2] and Miller Thomson.^[17]

What does the representative do for an app developer?

Under Article 27(4), you mandate the representative to be addressed, in addition to or instead of you, by supervisory authorities and data subjects in particular, on all issues related to processing.^[1] For an app, that means:

• An EU address for your users. Access and deletion requests can go there. The representative helps pass them on; answering them stays your job.^[4]
• A contact point for any EU supervisory authority, as recital 80 provides.^[1]
• An addressee for enforcement. Corrective measures and fines imposed on you can be addressed to the representative.^[4]

None of this affects your own responsibility and liability.^[4] Article 27(5) keeps legal actions against you intact.^[1] The EDPB says the GDPR "does not establish a substitutive liability of the representative".^[4] See what Gabsor's GDPR representative service covers.

Do UK users need a separate representative?

Yes, if your app is also offered to, or used to monitor, people in the UK. The UK GDPR has its own Article 3(2), with the same "irrespective of whether a payment" wording.^[3] Its own Article 27 requires a representative "in the United Kingdom" and has the same exemption.^[2] The ICO's guidance applies the same test to anyone based outside the UK with no UK establishment.^[8]

We call the UK regulator the ICO, as its guidance (last updated 15 January 2026) does.^[8] From 30 September 2026, UK GDPR Article 27(4) says the representative is addressed by, in particular, "the Commission" and data subjects.^[2]

Two regimes mean two appointments: one representative in the EU and one in the UK.

How to appoint a representative for your app, in five steps

1. Check your scope. Note which EU and UK countries your app is available in, in App Store Connect and Play Console. Then work through Figure 1 or take the 3-minute self-assessment.
2. List your SDKs and what each collects. Start from each vendor's data-disclosure page. The CNIL expects publishers and developers to take the greatest care when selecting and configuring SDKs.^[6]
3. Sign a written mandate. Both texts require the designation in writing.^[1][2] The ICO says a simple service contract is an easy way to do it.^[8] Sign a separate one for the UK if you are in scope there.
4. Publish the details. Articles 13(1)(a) and 14(1)(a) require the information you give people to include your representative's identity and contact details.^[1] Add them to the privacy policy your store listings link to. For the UK, the ICO also asks you to make them easily accessible to it, for example on your website.^[8]
5. Name the representative in your record of processing. Article 30(1)(a) requires your record of processing activities (ROPA) to include your representative's name and contact details. Article 30(2)(a) does the same for processors.^[1] With the signed mandate and your privacy policy, the record evidences the appointment.^[1] Article 30(1) makes the representative maintain the record too, so share it.^[1]

What it costs

Gabsor's Essential plan, for companies under $500k annual revenue, starts from $79/month, billed annually.

Sign-up, onboarding and the digital Letter of Appointment take about five minutes. Annual plans are prepaid and non-refundable.