What the Article 27 EU representative requirement asks for
If your organization is not established in the Union but its processing falls under Article 3(2), you must designate a representative in the Union in writing, unless one of the Article 27(2) exemptions applies. The obligation sits with the controller or processor, not with the representative, and it applies whether you are a controller or a processor. The exemptions are narrow: processing that is occasional, does not include large-scale processing of special category or criminal offence data, and is unlikely to result in a risk to individuals, along with processing carried out by public authorities or bodies. Treat the exemption as a conclusion you must document, not an assumption, because the three conditions must all hold.
The requirement exists because supervisory authorities and data subjects need a reachable point of contact in the Union when they raise processing questions. A representative must be established in one of the Member States where the affected data subjects are, and it is mandated to be addressed on all processing issues (Article 27(3) and (4)). Confirm with your counsel which Member States your data subjects sit in, since that determines where the representative must be established. The EDPB's *Guidelines 3/2018 on the territorial scope of the GDPR* also state that the role is not compatible with that of an external DPO, so one provider should not be asked to fill both roles.
The requirement is easy to miss because it is a designation, not a technical control. No scanner, log or configuration setting shows that it is met, so it often falls outside the security program and into no one's review. Record the written designation, the representative's contact details, the Member State of establishment and the date of appointment, and make sure the privacy notice and breach procedures name the correct contact. Designation does not transfer liability: the EDPB guidance confirms that the controller or processor remains responsible. Your implementation team can help with the technical contact routing and documentation, but the designation decision and the signed mandate remain yours.
Which non-EU organizations need an Article 27 representative
Article 27 applies only after Article 3(2) has already pulled a non-EU organization into the GDPR. The cards below walk through the triggers, the processor case, and the four exemptions, and end with the record that proves the scoping decision was made.
Offering goods or services to people in the Union
Article 3(2)(a) applies when a non-EU organization offers goods or services to individuals who are in the Union, whether or not payment is taken. Look at signals of targeting, such as EU language or currency options, delivery to EU addresses, or EU-specific marketing. A single sale to an EU resident does not by itself show intent to target the Union. Record which signals you assessed and what you concluded.
Monitoring behavior of people in the Union
Article 3(2)(b) covers tracking individuals in the Union to analyze or predict their behavior, for example through cookies, device fingerprinting, profiling or behavioral analytics. Monitoring that reaches EU visitors or users triggers the rule even when no product is sold. Check your analytics, advertising pixels and profiling tools, since they often run on sites and apps that look purely non-EU.
Processors caught by the territorial rule
A non-EU processor is within Article 3(2) when its processing activities relate to the targeting or monitoring of EU data subjects on behalf of a controller. Hosting or support providers that only process for a controller established in the Union may fall under the controller's obligations instead. Confirm the role of each vendor with your counsel before assuming a processor must appoint a representative.
Occasional processing exemption
Article 27(2)(a) exempts processing that is occasional, does not include large-scale processing of special category or criminal offence data, and is unlikely to result in a risk to individuals' rights and freedoms. All three conditions must hold together. Frequent or recurring processing is not occasional, and the exemption does not cover a service that handles health or other special category data at scale.
Public authority exemption
Article 27(2)(b) excludes public authorities or bodies. This exemption is narrow and depends on the organization's status, not its sector. A non-EU government body or agency that is caught by Article 3(2) should confirm with counsel whether it fits this exemption before relying on it, and should not assume that a public mission alone qualifies.
Documenting the scoping decision
Regulators can ask why no representative was appointed, so the decision needs a written record. Keep a dated memo that names the Article 3(2) trigger analysis, each exemption tested, the evidence used (data flows, volumes, data categories, EU user counts) and the person who approved the conclusion. Revisit the memo when products, markets or data categories change.
Where the representative sits and what it does
Article 27(3) requires the representative to be established in one of the Member States where the affected data subjects are. The provision ties the location to the people whose data is processed, not to the place where the controller or processor chooses to register. A non-EU organization that offers goods or services to people in several Member States therefore needs to decide which Member State hosts its representative, and it should document that choice against the data subject locations it has identified.
- Anchor to data subject location: Map where the affected individuals are, using the processing activities in your record, not only where customers sign contracts.
- Choose one establishment: The representative is designated in writing for the controller or processor, so confirm which Member State the appointment names.
- Keep the designation current: A new market or a new group of data subjects can change where the representative must sit.
- Document the reasoning: Keep the written designation and the location analysis together so an assessor can follow it.
Before signing, ask the provider to state the Member State of establishment in the written designation and to explain how that location matches your data subject footprint.
Article 27(4) mandates the representative to be addressed by supervisory authorities and data subjects on all issues related to processing. The mandate makes the representative a channel for contact, so a letter or request sent to it must be able to reach the organization quickly. The mandate does not transfer the controller's or processor's legal obligations to the representative, and the designation remains a written appointment that the organization must be able to produce.
- Authority contact: Supervisory authorities may address the representative on any processing question, so the appointment must give it the authority to receive and route those communications.
- Data subject contact: Individuals may use the representative to raise processing matters, so the contact details must appear in your privacy information.
- Scope of issues: The mandate covers all processing issues, not only breaches or rights requests.
- Written appointment: Keep the signed designation available for inspection.
Confirm in the contract that the representative will forward inquiries to your team within a timeframe you agree, and that it will not answer substantive questions without your input.
In practice the representative acts as a contact point and coordinator. It receives correspondence, tells the organization what has been asked and when, and helps arrange cooperation with authorities under Article 31. Where the organization keeps its records of processing or security documentation in its own systems, the representative needs an agreed way to obtain copies when a request arrives. The organization still answers the substance, produces evidence and makes decisions.
- Contact point: Receive and log inbound letters, emails and requests from authorities and data subjects.
- Record access: Agree how the representative obtains copies of the record of processing and related documents on request, using a controlled channel.
- Cooperation: Coordinate scheduling and delivery of responses to supervisory authorities, while your staff provide the technical facts.
- Escalation: Define who in your organization receives each request and the timeframe for internal sign-off.
- Cost drivers: Fees depend on volume of correspondence, the number of authorities involved and the support level agreed.
Ask the provider for a written service description listing these tasks, the response times it commits to, and what it charges for each category of request.
EDPB Guidelines 3/2018 state that the representative role is not compatible with that of an external data protection officer. The two roles have different purposes. A DPO advises and monitors compliance within the organization, while the representative is a designated point of contact that authorities and individuals can address on processing issues. Using the same firm for both can create a conflict that the guidance does not allow. Designating a representative also does not reduce the controller's or processor's liability.
- Different functions: The DPO advises and monitors; the representative receives and routes contact.
- Guidance position: EDPB Guidelines 3/2018 treat the two roles as incompatible when held by the same external party.
- Liability unchanged: The organization remains responsible for compliance after appointing a representative.
- Separate contracts: Procure the representative and any outsourced DPO under distinct written terms.
Before appointing a provider, ask whether it also offers outsourced DPO services and how it will avoid that conflict.
What the representative does not change about liability
Designating an EU representative does not move responsibility or liability away from the controller or processor. The representative is a point of contact that supervisory authorities and data subjects can address on processing questions. It does not take over the controller's or processor's obligations, and the EDPB's Guidelines 3/2018 on territorial scope state that the appointment leaves the non-EU organization's responsibility and liability unchanged. The organization therefore still owns its security measures under Article 32, its breach handling, its records and its response to rights requests, whether or not a representative has been named.
The practical effect is most visible in breach notification. Under the EDPB's Guidelines 9/2022 on personal data breach notification, a representative does not trigger the one-stop-shop mechanism. A non-EU controller therefore has to notify a breach to every supervisory authority in whose Member State affected data subjects reside, and it cannot assume that one notification to the representative's authority covers the rest. Breach runbooks should list the countries where data subjects sit, map each to its authority, and name who sends each notice and within what timeframe.
Before relying on a representative, ask the representative and your counsel to confirm in writing which duties, if any, the representative will perform, how it will receive authority correspondence, and how fast it will forward it to your team. Confirm that the appointment is recorded in your privacy documentation and that your incident contacts reach the internal owner directly. This section explains the allocation of duties and is not legal advice. Your counsel should confirm how Article 27 applies to your specific processing.
How to appoint and operationalize an EU representative
This sequence takes a non-EU controller or processor from a documented view of Article 3(2) applicability to a representative that is named, reachable and tested against real supervisory authority contact. Each step ends with a record that an assessor or regulator could read.
Confirm Article 3(2) applicability in writing
Start by deciding whether the organization is caught by Article 3(2) at all. Map each processing activity to the offering of goods or services to people in the EU or the monitoring of their behavior within the EU, and record which activities fall inside. Your privacy or legal lead signs the analysis, and outside counsel can review it if the position is contested. The output is a dated applicability memo listing each activity, its trigger and its conclusion.
Document the Article 27(2) exemption analysis
Where Article 3(2) applies, test each activity against the exemption conditions in Article 27(2): occasional processing, no large-scale special category or criminal offence data, unlikely to result in risk, and whether the controller is a public authority or body. All conditions must be met for an exemption to apply, so record the reasoning for each one. Keep the file current, because a change in volume or data type can remove an exemption. The output is an exemption register that states whether a representative is required.
Select the Member State for the representative
If a representative is required, choose a Member State where the affected data subjects are located, as Article 27(3) requires. Base the choice on where your customers or users sit and on the languages and local legal context your support teams can handle. Confirm the chosen establishment with the appointed provider and with local counsel. The output is a written decision that names the Member State and the reasons for it.
Agree a written mandate with the representative
Execute a written mandate that authorizes the representative to be addressed by supervisory authorities and data subjects on all processing issues, as Article 27(4) describes. The mandate should set out who receives authority correspondence, how quickly the representative forwards matters to you, which languages are covered and how confidential information is handled. Confirm that the representative is not also acting as your external DPO, since EDPB Guidelines 3/2018 state the two roles are not compatible. The output is a signed mandate on file.
Register representative contact details in notices and records
Publish the representative's contact details where data subjects will find them, typically in the privacy notice, and record the same details in your record of processing activities. Check that the entries match the mandate exactly and that every privacy notice version, including those in the product and onboarding flows, carries them. The output is a notice and record extract showing the representative's details in each location.
Connect the representative to request and incident workflows
Route data subject requests and supervisory authority correspondence to the representative through a defined intake channel, with named internal owners and forwarding times set in your own procedures. For breaches, remember that EDPB Guidelines 9/2022 state a representative does not trigger the one-stop-shop, so a non-EU controller must notify every supervisory authority in whose Member State affected individuals reside. Build that notification path into your incident runbook. The output is a workflow diagram and runbook section approved by the incident owner.
Rehearse supervisory authority contact
Run a tabletop exercise in which a supervisory authority letter arrives addressed to the representative, and trace how it reaches your team, who drafts the response and how the cooperation duty under Article 31 is met within your own timelines. Record the gaps and fix them, then repeat the test after any change in representative or staff. The output is a dated exercise report with actions and owners. Because no deadlines are set here by the GDPR for this step, set your own internal targets and confirm any local procedural expectations with the representative.
How an assessor or supervisory authority tests the designation
A supervisory authority or independent assessor tests the Article 27 designation on paper first. The written mandate is the starting point: a signed document that names the representative, states that it is designated under Article 27(1), and confirms the representative may be addressed by supervisory authorities and data subjects on all processing issues. A mandate that is undated, unsigned, or limited to a narrow subject such as marketing emails fails the test, because Article 27(4) expects it to cover processing in general. Check that the entity named in the mandate is the same legal entity that appears in privacy notices and contracts.
The next check is the stated establishment. The representative must be established in one of the Member States where the affected data subjects are. An assessor will compare the address in the mandate with the Member State named in your records and notices, and will ask whether the data subjects in that state are the ones the processing actually targets. Confirm the representative's registration and contact details with its own records, and confirm them again whenever the representative changes. Also confirm that the representative is not also acting as your external DPO, since EDPB Guidelines 3/2018 treat those roles as incompatible.
Assessors then test whether the representative is reachable and empowered. Ask for evidence that a complaint or regulator letter sent to the published contact would reach a person who can answer it, and that the representative has a process for passing requests on to you. Record-level consistency matters here too: the record of processing, privacy notices and the representative's details should describe the same controller and the same contact route. Where no representative exists, the organization should hold a dated, documented exemption analysis that walks through each Article 27(2) condition. Confirm with counsel which facts support that analysis, because the GDPR requires no certificate and the evidence is reviewed only in an investigation or assessment.
Evidence that shows a compliant Article 27 designation
An Article 27 designation is only as good as the paperwork and operating records behind it. The artifacts below show that the designation was made in writing, that the scoping was reasoned, that data subjects can reach the representative, and that the representative has what it needs to act when a supervisory authority or data subject contacts it.
Signed written designation
This is the document that makes the appointment exist. Article 27(1) requires the designation to be made in writing, so the record should name the representative entity, state the Member State where it is established, and be signed by someone with authority to bind the controller or processor. Keep the executed copy with the contract file, not only as a draft in a shared drive. Check that the mandate covers being addressed by supervisory authorities and data subjects on all processing issues, as Article 27(4) describes, because a narrower mandate is a common gap.
Article 3(2) and 27(2) scoping memo
This memo records why the organization is caught by Article 3(2) and whether any Article 27(2) exemption applies. It should describe the processing activities, the categories of data subjects and the Member States they reside in, and test each exemption against the facts: whether processing is occasional, whether it includes large-scale special category or criminal offence data, and whether it is unlikely to result in risk. Date the memo and name the approver. Illustrative example: a non-EU SaaS company with regular EU customer sign-ups would usually find the occasional exemption unavailable.
Privacy notice contact details
Data subjects need to know how to reach the representative, so the privacy notice and any customer-facing contact points should name it. Compare the published details with the signed designation. A mismatch in entity name, address or contact channel is easy to miss and easy for an assessor to find. Confirm that the contact route reaches a monitored mailbox or team with a documented handover to the people who answer rights requests and regulator correspondence.
Representative access to records and breach procedures
The representative must be able to respond to supervisory authorities on processing questions, which requires current access to the record of processing, the relevant policies and the breach procedure. Set up read access for the representative to the record of processing and the incident register, and document the escalation path from the representative to the controller. EDPB Guidelines 9/2022 point out that a representative does not trigger the one-stop-shop, so the breach procedure should list each supervisory authority that may need notification. Test the path with a tabletop exercise and keep the outcome.
Dated review log
The designation should be re-checked whenever processing changes, for example a new product, a new country of customers or a new category of data. A review log records each check with a date, the reviewer, what changed and whether the designation or scoping memo was updated. It also shows that the organization has asked whether the Article 3(2) analysis still holds. Schedule a recurring review and trigger ad hoc reviews from change management, so the log reflects real decisions rather than a single annual sign-off.
What a compliant EU representative arrangement costs
This table breaks down what an Article 27 representative arrangement involves, who is paid for each part, and whether the cost is one-time or recurring. Use it to build a like-for-like comparison of written quotes, since no fee levels are published in the sources behind this page.
| Cost component | Who is paid or who bears the effort | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Representative service fee | The external provider that accepts the mandate and handles contacts from authorities and data subjects | Recurring, set by the provider | Number of Member States where affected data subjects are, and volume of cross-border contacts |
| Legal review of the written mandate | Outside counsel or the internal legal team | One-time, repeated only if the mandate changes | Complexity of the mandate, number of group entities, and whether the representative must act on several processing activities |
| Exemption analysis under Article 27(2) | Internal privacy lead, with counsel if needed | One-time, revisited when processing changes | Whether processing is occasional, whether it includes large-scale special category or criminal offence data, and whether a risk is likely |
| Establishing the Member State location | Internal team and provider, during onboarding | One-time, unless the representative's establishment changes | Choice of Member State, which affects contact arrangements and local language expectations |
| Internal records and contact handling | Internal privacy and operations staff | Recurring, as contacts and records accumulate | Volume of supervisory authority and data subject enquiries, and how quickly they must be routed |
| Updates when processing changes | Internal product, legal and privacy teams, with the provider informed | Recurring, triggered by new markets, new services or new sub-processors | Frequency of product launches, new EU customers and changes to hosting or transfers |
| Liability and enforcement planning | Internal legal and compliance teams | One-time planning, with periodic review | The representative does not transfer liability, so the organization must still cover its own accountability duties |
Questions buyers ask about EU representatives under Article 27
Does the Article 27 exemption apply to my company?
It applies only when every condition in Article 27(2) is met, so most organizations that process personal data of people in the EU should assume they need a representative until counsel confirms otherwise. The exemption covers processing that is occasional, does not include large-scale processing of special category or criminal offence data, and is unlikely to result in a risk to individuals. Public authorities and bodies are also excluded. The test looks at the processing itself, not the size of the company, so a small firm with regular customer accounts in the EU may still fall outside the exemption. Record your reasoning for each processing activity and confirm it with EU counsel before you rely on it.
Can our external DPO also act as our EU representative?
No. EDPB Guidelines 3/2018 state that the representative role is not compatible with that of an external DPO, so the two should be separate appointments. The representative is the party that supervisory authorities and data subjects address on processing issues, and it must be established in a Member State where affected data subjects are. A DPO advises the controller and must act independently, which can conflict with serving as the contact for enforcement matters. If your DPO service provider also offers representative services, ask whether it will sign separate mandates and how each role is documented in your privacy notices.
Does a breach notice to our EU representative count as notification?
No. EDPB Guidelines 9/2022 state that a representative does not trigger the one-stop-shop, so a non-EU controller must notify a breach to every supervisory authority in whose Member State affected data subjects reside. Keeping the representative informed is good practice, but it does not replace those notifications. Your breach response plan should list the authorities by country, based on where affected people live, and name who sends each notice. Designating a representative also does not change your liability, so the plan must work even if the representative is slow to respond.
How long does it take to appoint an EU representative?
The GDPR sets no deadline for the appointment. The timeline depends on how quickly you can complete three steps: confirm that the exemption does not apply, select a representative established in a suitable Member State, and sign a written designation. Provider onboarding, due diligence on how the provider will handle authority and data subject requests, and agreeing the mandate often take longer than the signature itself. Ask any provider for its onboarding steps and expected turnaround in writing, and request a sample mandate before you commit. Your own pace also depends on how fast you can supply accurate contact details and an up-to-date record of processing.
What does an EU representative need from our team?
The representative needs accurate facts, a named contact and a fast way to receive regulator and data subject correspondence. Typical internal inputs are:
- The representative's contact details, which must appear in your privacy notices and records of processing
- A current inventory of processing that affects people in the EU, with the Member States involved
- An internal owner who can answer regulator questions and approve responses
- A written escalation path for breaches and data subject requests so the representative can act on time
Engineering input is needed for logging, data location and retrieving evidence on request. DeployOpen can help prepare those systems and evidence. The organization still owns the controls, the designation and the decisions.
Can we appoint an EU representative ourselves without a provider?
The GDPR does not say who the representative must be. It must be established in the Union in one of the Member States where affected data subjects are, and it must be mandated in writing. Whether an EU affiliate, a staff member or an outside firm qualifies depends on your corporate structure and on whether that party can meet the mandate in practice. The representative must be reachable by regulators and data subjects and able to respond on processing issues, which requires a dependable function behind the name. Before choosing an internal option, confirm with EU counsel that it meets Article 27 and the EDPB guidance, and check for conflicts with roles such as an internal DPO.
What should we ask for in an EU representative quote?
Ask for a written scope that covers the designation mandate, the Member State of establishment and how correspondence from authorities and data subjects will be received and routed. Also ask:
- How the provider handles breach communications, given that each relevant authority must still receive its own notice
- Whether the role is held separately from any DPO service, in line with EDPB guidance
- Who is paid for what, whether fees recur each year and what triggers extra charges
- How records of correspondence are kept and made available to you
- What happens to the mandate on termination and how your notices are updated
A quote built from a written scope lets you compare providers on the same basis.
Where to confirm the Article 27 text and EDPB guidance
Start with the primary text. The Article 27 wording in Regulation (EU) 2016/679 is available on EUR-Lex, the GDPR consolidated text. Read Article 27(1) to (4) alongside Article 3(2), because the representative duty only arises where Article 3(2) applies. Check the exemptions in Article 27(2) against your own processing inventory, and record who decided each exemption applied and on what date. Confirm the text you rely on is the current consolidated version when you file your assessment, since the GDPR itself has not been amended as of October 2026.
Next, read *EDPB Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)*, version 2.1 dated 12 November 2019, available from the EDPB guidelines page. It sets out that appointing a representative does not change the controller's or processor's liability and that the role cannot be combined with an external DPO. Ask your legal counsel to confirm how those points affect your contract with any representative provider before you sign.
Then read *EDPB Guidelines 9/2022 on personal data breach notification under GDPR*, version 2.0, from the EDPB breach guidelines page. Because a representative does not trigger the one-stop-shop, a non-EU controller must plan to notify each supervisory authority where affected data subjects reside. Finally, confirm national supervisory authority expectations in every Member State where your data subjects are located, including any local language, portal or registration practice. Those expectations are set nationally and are not captured in the EU texts.
How DeployOpen prepares systems and evidence for Article 27
DeployOpen works on the technical side of Article 27: the systems, access paths, records and evidence that show how a non-EU controller or processor handles contact with supervisory authorities and data subjects. The organization keeps the legal designation, the mandate and the decisions, while DeployOpen prepares the environment and documentation those responsibilities depend on.
How we scope
- Each engagement starts with a written scope that names the processing activities, systems and Member States in question.
- Scope documents which contact channels, mailboxes and records the representative function will rely on.
- Scope states who owns the designation, the written mandate and any external representative service.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.
How we build
- We configure the systems that route supervisory authority and data subject correspondence to the designated representative.
- We set up logging and access controls so that requests and responses can be traced to named people and dates.
- We document the processing records and data locations the representative would need to answer authorities quickly.
- We test the routing and escalation path with the client before the function is treated as operational.
How we hand over
- Handover includes written runbooks for receiving, logging, escalating and answering inbound regulator and data subject contact.
- Evidence packs list the configuration, access records and test results that show the function works as described.
- We document the boundaries of the role, including that the representative does not take on the controller's liability.
- Clients receive the documentation in their own repositories and environments, with no dependency on DeployOpen to read it.
How we support
- Ongoing support, upgrades and continuous testing of the routing and logging setup are available as a retainer.
- Changes to processing activities, Member States or contact channels can be scoped as new written work.
- Confirm with your legal counsel or the representative provider who holds the designation and the mandate before go-live.
- DeployOpen prepares systems and evidence only. Audit reports and certificates come from independent assessors.
