Representatives of controllers or processors not established in the Union

Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
The obligation laid down in paragraph 1 of this Article shall not apply to:
- (a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
- (b) a public authority or body.
The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.
The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

· GDPR Article 27 Compliance Guide

For businesses operating outside the EU but serving EU customers, Article 27 of the GDPR introduces a critical compliance requirement: appointing an EU representative. This article breaks down exactly what non-EU businesses need to know and do to comply with this often-overlooked provision.

Understanding Your Obligations

Article 27 applies to organizations that:

Are established outside the EU
Offer goods or services to EU residents or monitor their behavior
Have no establishment in the EU

Step-by-Step Implementation Guide

Step 1: Determine If You Need a Representative

First, assess whether you qualify for exemptions:

Is your processing only occasional?
Does it avoid large-scale processing of special categories of data or criminal data?
Is it unlikely to risk the rights and freedoms of EU individuals?
Are you a public authority?

If you can answer "yes" to all applicable questions above, you may be exempt. Otherwise, proceed to Step 2.

Step 2: Select an Appropriate Representative

Choose a representative who is:

Established in an EU member state where your data subjects are located
Knowledgeable about GDPR requirements
Able to communicate in relevant languages

Practical options include:

Specialized GDPR representative services
Law firms with EU offices
Existing business partners with EU establishments
Professional associations in your industry

Step 3: Create a Formal Designation

Draft a written agreement that:

Clearly outlines the representative's responsibilities
Authorizes them to communicate with supervisory authorities
Establishes communication protocols
Defines how they will maintain records of processing activities
Sets procedures for handling data subject requests

Step 4: Update Documentation and Notices

Ensure your representative is mentioned in:

Privacy policies
Website legal notices
Data processing agreements
Records of processing activities

Include their full contact details for transparency.

Step 5: Establish Working Procedures

Develop practical protocols for:

Keeping your representative informed about your processing activities
Handling inquiries from data subjects or authorities
Maintaining necessary documentation
Managing potential investigations or enforcement actions

Business Benefits Beyond Compliance

A well-implemented representative arrangement offers more than just legal compliance:

Local expertise for navigating EU privacy landscape
Early warning system for regulatory changes
Improved trust signals for EU customers
Potential competitive advantage over non-compliant competitors

Common Pitfalls to Avoid

Misconception: Believing a data protection officer (DPO) can automatically serve as your representative (they're different roles)
Error: Appointing a representative in any EU country instead of where your data subjects are
Oversight: Failing to give your representative access to necessary information about your processing activities