GDPR Article 27 representative
Acting as the EU representative that non-EU controllers and processors are required to appoint.
- What it is
- A representative established in the EU, acting as contact point for data subjects and regulators.
- Who needs it
- Non-EU controllers and processors offering goods or services to, or monitoring, people in the EU.
- Statutory basis
- Regulation (EU) 2016/679, Article 27
- Annual fee
- SEK 12,000
If your organisation is established outside the EU and offers goods or services to people in the EU, or monitors their behaviour, Article 27 requires you to designate a representative established in a member state. The representative is the address at which data subjects and supervisory authorities can reach you, and their details have to appear in your privacy notice.
Failing to appoint one is an infringement in its own right, independent of any underlying data protection failure, and supervisory authorities have fined organisations on that basis alone. It is also easily detected: the absence of a representative in a published privacy notice is visible to anyone looking.
What we do
- Accept designation as your EU representative
- Provide the contact details and the wording for your privacy notice
- Receive and forward enquiries from data subjects and supervisory authorities
- Maintain a copy of your record of processing activities
What an EU representative is not
A representative is not a data protection officer. The DPO is an internal compliance role; the representative is an external point of contact. Nor does having a sales office somewhere in the EU satisfy Article 27 unless that entity is itself the controller or processor. The two are regularly confused, usually in the direction of assuming you are covered when you are not.
Where the representative's post turns into something substantive — a regulator's enquiry, a complaint, a data subject access request you need help answering — the lawyers at Ascend Law can take it on directly.