Do US companies need an EU GDPR representative?

Who is caught: the targeting test

The GDPR reaches companies outside the EU through Article 3(2).^[2] A company with no establishment in the EU is in scope if its processing relates to either of two activities:

• Offering goods or services to people in the EU, paid or free.
• Monitoring the behaviour of people in the EU, where that behaviour takes place in the EU.

If either applies, the whole regulation applies to that processing, and Article 27 requires the company to designate a representative in the EU.^[1]

The test is about intent and effect, not about where your servers are. The European Data Protection Board's guidelines list the signals that show a company is offering goods or services to the EU: an EU-language version of the site, prices in euros, shipping to EU countries, references to EU customers, or marketing campaigns aimed at EU audiences.^[3] None of these is decisive alone; together they describe almost every US company with international customers, which is why the GDPR representative for US companies is so often the first EU obligation a growing SaaS runs into.

"Monitoring" is broader than most founders expect. The EDPB gives examples that include behavioural advertising, geolocation for marketing, online tracking through cookies or fingerprinting. Its list also includes personalised diet and health analytics, CCTV, market surveys based on individual profiles, and monitoring of health status.^[3] Running a Meta pixel for retargeting on EU visitors is monitoring; plain visit counts are a weaker case.

Why having no EU office is the trigger, not the escape

Article 27 applies precisely because you have no establishment in the EU. The logic is simple: the GDPR gives people in the EU rights, and supervisory authorities powers, and both need somebody inside the EU to address. The representative is that somebody.

The GDPR says an establishment implies "the effective and real exercise of activity through stable arrangements".^[1] Three things US companies often assume count, and don't:

• EU hosting. AWS Frankfurt, Azure Dublin, Hetzner: renting infrastructure in the EU is not an establishment.
• EU contractors. A freelance developer in Portugal does not give the company an establishment unless they act as a stable, real presence of the business there.
• An EU Stripe entity or a Delaware-to-Ireland billing flip. Billing arrangements are not establishments either, unless there is an actual operating entity carrying on real activity there.

If you do have a genuine EU subsidiary, Article 27 falls away for the processing that subsidiary is responsible for, because the GDPR applies to you through Article 3(1) instead. You then deal with the supervisory authority where that subsidiary sits.

The exemption, and why it rarely applies

Article 27(2) exempts processing that meets all three of the following conditions:^[1]

1. It is occasional.
2. It does not include, on a large scale, special categories of data (health, biometrics, political opinions and the rest of Article 9) or data about criminal convictions.
3. It is unlikely to result in a risk to the rights and freedoms of individuals.

The first condition is the hurdle. The EDPB reads "occasional" the way it reads the same word in Article 30: processing is occasional only if it is not carried out regularly and happens outside the regular course of business.^[3] A product that EU users sign up for every week is, by definition, part of the regular course of business. Low volume does not make it occasional.

Where the exemption genuinely fits: a US company that once ran a one-off survey in the EU, or that received a handful of unsolicited EU sign-ups it does not serve or market to. Even then, the EDPB expects you to be able to justify the assessment, and the situation should be re-checked as the business changes.

Not sure whether this applies to you? Take the 3-minute check →

What a representative actually does

The representative is your official address in the EU for two audiences: supervisory authorities and the people whose data you process (what the service includes).^[1] In practice that means:

• Being named in your privacy policy as your EU representative, which Article 13 requires.^[7]
• Receiving letters from authorities such as the Irish DPC or the French CNIL, and relaying them to you with the deadline attached.
• Receiving access, erasure and other requests from individuals who prefer to write to an EU address.
• Holding your record of processing activities and making it available to authorities on request, a duty Article 30 shares between you and the representative.^[3]
• Being addressable by authorities for enforcement proceedings, though your own liability for compliance stays with you.^[1]

The appointment itself is a written mandate: a signed letter authorising the representative to act for you. There is no registration, licence or approval step; the appointment is evidenced by the mandate and published through your privacy policy.

Three things that do not substitute for a representative

US companies often have one of these and assume the box is ticked. None of them is Article 27.

Processors need one too

Article 27 applies to processors as well as controllers.^[1] This catches a lot of US B2B software. If your EU customers' users are in the data you process on their behalf, you are a processor whose processing relates to people in the EU, and you need your own representative, separately from whatever your customers have done.^[3]

In practice this surfaces during vendor reviews: EU customers' security questionnaires increasingly ask for the representative's details next to the DPA, and the absence is an easy reason to pick another vendor.

What happens if you don't appoint one

Failing to appoint a required representative is itself a breach, fined under the Article 83(4) tier: up to €10 million or 2% of worldwide annual turnover, whichever is higher.^[4]

In what was reported as the first fine of its kind, announced on 12 May 2021, the Dutch Data Protection Authority fined LocateFamily.com, a people-search site that appeared to have no EU presence, €525,000 for failing to appoint a representative, and ordered it to appoint one on pain of further penalties.^[5] The case is useful for one more reason: the "occasional" exemption did not apply, because the site's processing of personal data was regular.^[5] Since then, a missing Article 27 representative has appeared as one of the violations in larger enforcement actions, including the Dutch authority's 2024 decision against Clearview AI.

Two points about enforcement that get misreported:

• The fine is on you, not the representative. In Sanso Rondon v LexisNexis (2021) the English High Court held that a representative is not liable for the controller's breaches; Article 27(5) keeps the legal actions against the controller or processor.^[6] So a representative is not a liability shield for you, and a reputable representative is not taking on your risk.
• The practical costs arrive before the fines. EU enterprise customers run vendor checks. EU partners refuse to sign DPAs with a company that has no representative in its privacy policy. EU customers' security questionnaires and vendor reviews ask. The missing line in your privacy policy is visible to anyone who looks, which is why it tends to surface during a deal rather than during an audit.

EU and UK: you may need both

If you serve people in the UK as well as the EU, there are two separate obligations. The UK GDPR has its own Article 27, requires a representative established in the UK, and one representative cannot cover both regimes.^[1]

How to appoint one, in five steps

1. Confirm you're in scope. Work through the three questions in Figure 1, or take the 3-minute self-assessment. If you sell or market to the EU and have no EU entity, you are.
2. Choose a representative established in an EU member state where you have users. Ask who actually reads the authority correspondence, in which languages, and how deadlines are tracked. A forwarding mailbox satisfies the letter of Article 27 and nothing else.
3. Sign the written mandate. The letter of appointment is the appointment; keep a signed copy.
4. Update your privacy policy with the representative's name and contact details, as Article 13 requires.^[7] An appointment nobody can find does not serve its purpose.
5. Provide your records of processing, or create them, so the representative can hand them to an authority on request.

Add a sixth step if you have UK users: repeat the process with a UK representative.