What is a GDPR representative? Article 27 explained

If your business is outside the EU and has customers or tracked users there, you probably need to name a representative in the EU. It is a contact point for officials and for the people whose data you hold. You appoint it in writing and list it in your privacy policy. It does not do your compliance for you.

What is a GDPR representative?

A GDPR representative is a person or company established in the EU that you name in writing to act for you under the GDPR, the EU's data protection law.^[1] The people whose personal data you hold can contact it instead of you, or as well as you. So can data protection authorities, the public bodies that enforce the GDPR in each EU country.^[1] Personal data means information about a person who can be identified, such as a name or an email address.

Think of it as your business's address in the EU. Say a user in Lyon wants to know what data your app holds about her. She can write to your representative, which passes her request on to you.^[2]

The duty comes from Article 27 of the GDPR, which is why you will also see the term "Article 27 representative".^[1]

Why does the GDPR require one?

Because the GDPR also covers businesses that are not established in the EU. If you offer goods or services to people in the EU, or monitor them there, the law covers you even if you are based in Texas.^[1] Its stated aim is that people in the EU are not deprived of the protection the law gives them.^[1]

That leaves a practical gap. Without a representative, an authority in Madrid that receives a complaint about you would have to write to you in Texas. The representative gives it someone in the EU to deal with. The European Data Protection Board (EDPB), which issues official guidance on the GDPR, says an authority would contact the representative about any matter relating to your compliance duties.^[2] The representative then helps the exchange of information between the authority and you.^[2]

Who must appoint one?

You must appoint an EU representative if all three of these are true, unless an exemption applies:^[1]

1. You have no establishment in the EU. The GDPR says an establishment implies "the effective and real exercise of activity through stable arrangements".^[1] In plain words, you run part of your business from the EU on a lasting basis. The duty applies only where the GDPR reaches you from outside the EU.^[1]
2. You offer goods or services to people in the EU, or monitor their behaviour there. Free products count, because payment is not the test.^[1]
3. You are a controller or a processor. A controller decides why and how personal data is used.^[1] A processor handles personal data on a controller's behalf.^[1] The duty applies to both.^[1]

"Offering" asks whether you apparently intend to serve people in one or more EU countries.^[1] The EDPB weighs signals together. They include naming an EU country, marketing aimed at an EU audience, EU addresses or phone numbers, an EU domain and EU customers.^[2] Another is using "a language or a currency other than that generally used in the trader’s country, especially a language or currency of one or more EU Member states".^[2] A website that people in the EU can merely reach is not enough on its own.^[2]

For monitoring, the EDPB says the word implies a specific purpose for collecting and reusing data about people's behaviour in the EU.^[2] Its examples include behavioural advertising, meaning ads chosen from what someone did online, and tracking through cookies.^[2]

The test plays out differently by business. We work through it with examples for US companies, mobile apps, apps built with AI tools and online stores shipping to the EU.

What does not take you out of scope

The right column is Gabsor's reading: the test turns on where you are established and what you do, not on these.^[1]

Who is exempt?

Few businesses that are otherwise in scope, in our reading. The exemption has two parts.^[1]

The first covers processing, meaning anything you do with personal data, such as collecting or storing it. It applies only if your processing meets all three of these conditions:^[1]

1. It is occasional.
2. It does not include, on a large scale, the especially sensitive types of data the GDPR lists separately (it calls them special categories), or data about criminal convictions.
3. It is unlikely to result in a risk to people's rights and freedoms.

The EDPB says processing is occasional only if it is not carried out regularly and happens outside the regular course of your business.^[2] The risk test is strict too. It asks whether a risk is unlikely, not whether it is high.^[2]

A company that ran a one-off survey at a Berlin trade fair, and deleted the answers afterwards, could fit.

The second part covers public authorities and bodies, which do not need a representative.^[1]

Not sure whether this applies to you? Take the 3-minute check →

What happens if you do not appoint one?

In our view, the first cost is usually commercial, not a fine. Say an EU customer's procurement team sends you a vendor questionnaire. It asks for your EU representative, and your privacy policy names none. That can stall the deal.

Fines exist too. For failing to appoint a required representative, the cap is €10 million or, for a business, 2% of worldwide annual turnover if that is higher.^[1]

There is a published case. Hunton Andrews Kurth, a law firm, reports that the Dutch data protection authority, the Autoriteit Persoonsgegevens, fined LocateFamily.com €525,000 for failing to designate an EU representative.^[9] The fine was announced on 12 May 2021.^[9][11] Arthur Cox, another law firm, reports that the site could not rely on the "occasional" exemption, because its processing was regular.^[10] It also reports an extra €20,000 for every two weeks without a representative, up to €120,000.^[10]

What does a representative do, and not do?

A representative is your contact point and record-keeper in the EU.

Liability. In 2021 the High Court of England and Wales held in Sansó Rondón v LexisNexis that Article 27 "does not create 'representative liability'".^[3] In our view, EU authorities and courts are not bound by it, because it is an English judgment, not an EU one.

Enforcement. The representative can still be drawn in. Say an EU authority fines you. The EDPB says the authority may address that fine to your representative, and the same goes for corrective orders.^[2] The fine stays yours; the representative is only where it may be sent.^[2]

Not a DPO. A data protection officer (DPO) is a person some organisations must designate under the GDPR.^[7] Public authorities must have one, other than courts acting as courts.^[7] A company must appoint one when its core activities consist of large-scale, regular and systematic monitoring of people, or large-scale processing of special-category or criminal-conviction data.^[7] The EDPB says the representative role is not compatible with that of an external DPO established in the EU.^[2] The reason: a DPO must act independently, while a representative acts on your instructions.^[2]

See what Gabsor's GDPR representative service includes.

Where must the representative be established?

You need one representative, established in one of the EU countries where the people you serve or monitor are.^[1] The EDPB adds that it must remain easily accessible to people in the other EU countries you serve or monitor.^[2] It should in principle communicate in the languages that the authorities and people concerned use.^[2]

Say you sell to customers in France, Poland and Portugal. You need one EU representative, not three. If it is based in France, a customer in Portugal must still be able to reach it easily.

Do the UK and other laws need their own representative?

Yes. The UK has its own version of the GDPR, with its own Article 27. A business not established in the UK falls under it if it offers goods or services to people in the UK, or monitors them there.^[4] It must then name a representative in the United Kingdom in writing.^[5] Guidance from the ICO, the UK regulator, last updated 15 January 2026, says the same.^[6] It lists the same exemptions: public authorities, and occasional, low-risk processing without large-scale sensitive or criminal data.^[6] Since 30 September 2026, the UK GDPR's Article 27 refers to the regulator as "the Commission".^[5]

Because the UK rule asks for a representative "in the United Kingdom", our reading is that an EU representative cannot meet it.^[5] The EU rule asks for one established in the EU, so a UK representative cannot meet that either.^[1] Say the Singapore company above also has customers in Manchester and no base in the UK. It needs two appointments.

Other EU laws have their own representative rules. See our pages on the AI Act, the Digital Services Act and the Data Act.

How do you choose a representative?

The law sets a few fixed points: the appointment is in writing, and the representative is established in the right EU country.^[1] These questions are our practical advice, not legal requirements.

• Who reads the correspondence? Say the Italian authority writes about a complaint in Italian. A person should read it and tell you what it asks. A service that only forwards post leaves that work to you.
• How are deadlines tracked? If a letter sets a deadline, ask how and how fast you are alerted.
• How does it keep your record of processing? Agree how you send it updates.
• What happens when the appointment ends? If you switch, appoint the new representative before the old appointment ends. Update your privacy policy and record of processing the same day. There is no run-off period, meaning time in which the old representative still acts for you.

How do you appoint one? Five steps

The appointment is a written mandate, meaning a document in which you authorise the representative to act for you.^[1] The EDPB says the GDPR does not oblige you or the representative to tell a data protection authority about the appointment.^[2] You make the appointment visible through your privacy policy and your record of processing.

1. Check that you are in scope. Work through Figure 1, or take the 3-minute self-assessment. Note where your users are and which tools track them.
2. Choose a representative established in an EU country where your users are.^[1] Use the questions above.
3. Put the mandate in writing.^[1] In practice this is a signed letter of appointment. Keep a copy.
4. Name the representative in your privacy policy, with its contact details, next to your own.^[1] For example: "Our EU representative is [name], [postal address], [email]."
5. Add it to your record of processing activities. The record must include the representative's name and contact details.^[1]

Glossary: ten terms in plain words

What it costs

Gabsor's Essential plan, for companies under $500k in annual revenue, starts from $79/month, billed annually.