Do non-EU companies need a GDPR Article 27 representative?
The GDPR applies to many businesses that have no office in the EU. Some of them must also appoint a representative in the EU. Here is how to tell whether that includes you.
Does the GDPR apply to you?
A business outside the EU is covered by the GDPR when it processes personal data of people in the EU and that processing relates to:
offering them goods or services, paid or free; or
monitoring their behaviour in the EU, for example through tracking or profiling.¹
An online shop shipping to EU customers, or an app with EU users, will often fall within this.
When a representative is required
If the GDPR applies to you on that basis, you must designate an EU representative in writing.² The representative must be established in one of the Member States where the people whose data you process are located.³
The exemption
You do not need a representative if your processing is all three of the following:
occasional;
does not include large-scale processing of special categories of data, such as health data, or data about criminal convictions; and
unlikely to result in a risk to people’s rights and freedoms.⁴
Public authorities are also exempt.⁴ Regular processing, such as running an online shop, will usually not count as occasional.
What the representative does
The representative is the point of contact in the EU. Supervisory authorities and individuals can address it on any issue about your processing, in addition to or instead of you.⁵ It also keeps your record of processing activities.⁶
Appointing a representative does not move responsibility away from you. You remain liable, and legal action can still be taken against you directly.⁷
What happens if you do not appoint one
Failure to designate a representative breaches the GDPR. Infringements of this obligation can lead to fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher.⁸
What to do
Check whether you offer goods or services to people in the EU, or monitor their behaviour.
If you do, check honestly whether the exemption applies.
If it does not, appoint a representative in writing and name them in your privacy notice.
This article is general information, not legal advice. Unsure whether the GDPR applies to you? Write to hello@lunelegal.com. See also our Areas of Practice.
Sources
Ibid., Art. 27(1)
Ibid., Art. 27(3)
Ibid., Art. 27(2)
Ibid., Art. 27(4)
Ibid., Art. 30(1)
Ibid., Art. 27(5) and Recital 80
Ibid., Art. 83(4)(a)