Contact us
Contact us

EU Representative for Australian Companies under GDPR Article 27

An Australian company with no EU establishment that offers goods or services to people in the EU, or monitors their behavior, is caught by GDPR Article 3(2) and has to appoint an EU representative under Article 27. Australia's Privacy Act reaches overseas conduct directly and never asks for a local proxy, which is the opposite of how Article 27 works.

By Julian Gage Last reviewed: 28 August 2026

Key takeaways

  • GDPR Article 27 applies to Australian companies with no EU establishment that offer goods or services to, or monitor the behavior of, people in the EU. The exemption is narrow and a store or app that runs on EU users rarely qualifies.
  • The Privacy Act 1988 uses pure extraterritorial reach through the section 5B Australian link. It binds overseas organizations directly and appoints no local representative, the opposite design to Article 27.
  • The section 6D small-business exemption can put a smaller Australian company outside its own Privacy Act, but it has no effect on the EU obligation, which carries no turnover threshold.
  • Most Australian companies caught by the EU obligation are also caught by the separate UK one, and the two are appointed independently.
  • We act as your EU representative directly from Amsterdam, and the outsourced DPO is a separate product we scope together where you also need it.

How does an Australian company get caught by GDPR?

GDPR reaches beyond the EU through Article 3(2). A company with no EU establishment is inside the Regulation when its processing relates to either offering goods or services to people who are in the EU, whether or not payment is required, or monitoring their behavior as far as that behavior happens in the EU.

An Australian online retailer or exporter shipping to EU customers, a travel or tourism operator taking bookings from people in the EU, or a SaaS and app business running analytics on EU users all fit the test. These are the ordinary shape of an Australian business that has grown into the EU market without opening an EU office, and each one triggers Article 27.

Does Australian privacy law require an EU representative?

No, and the reason is worth spelling out because Australia’s design is the reverse of the EU’s. The Privacy Act 1988 (Cth) and its 13 Australian Privacy Principles bind “APP entities”. Section 5B, the “Australian link” provision, extends the Act to acts done outside Australia by an organization with an Australian link, such as being incorporated or formed in Australia, or carrying on business in Australia. Since the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 came into force on 13 December 2022, carrying on business in Australia is enough on its own to create that link. The effect is that a foreign organization with an Australian link is bound directly, wherever it is located. There is no Article 27 equivalent and no appointed local representative in the mechanism at all.

Section 6D adds a small-business exemption: organizations with annual turnover of AUD 3,000,000 or less are generally outside the Australian Privacy Principles even where they have an Australian link. So the Privacy Act can reach a large overseas business directly and leave a small one out entirely, and in neither case does it create the kind of appointed EU contact point that GDPR Article 27 requires, because that appointment is an EU obligation and sits outside the reach of any Australian statute.

Who regulates this?

In the EU, the supervisory authority in the member state where your representative sits, and the wider network of authorities coordinated through the European Data Protection Board. In Australia, the Office of the Australian Information Commissioner regulates the Privacy Act and the Australian Privacy Principles. The OAIC does not administer Article 27, which is the point: your Australian regulator does not stand in for an EU representative.

Do Australian companies also need a UK representative?

In most cases, yes. The UK runs its own UK GDPR with its own Article 27, enforced by the Information Commissioner’s Office, and an Australian company selling online into the EU is usually reaching the UK as well. The two obligations are separate appointments in separate territories, and an EU representative does not cover the UK. We can take both, as two mandates.

What does Engage do?

Engage Compliance acts as your EU representative under Article 27, established in the EU, named in your privacy notice, and reachable by supervisory authorities and by people in the EU on your behalf. This is a service we deliver directly from Amsterdam, with the same expert on your account rather than a junior handoff. There is no separate Australian representative obligation to satisfy, so nothing here runs through a local partner in Australia.

Sign-up takes minutes. After payment you answer a short form about your company and who we should send correspondence to, about three minutes of typing, and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment.

Where you also need a named DPO, that is a separate product, and we scope the two together.

Experience across 100+ startups and enterprises, including Amazon, Coinbase, Robinhood, Fanatics, Medtronic, AbbVie, IKEA, Nestle and Hopin.

What to do next

If you are an Australian company selling to or tracking people in the EU and you have not appointed an EU representative, that is an open GDPR Article 27 obligation. Read do I need an EU representative to check whether the narrow exemption could apply to you, see how the EU representative service works, or contact us and we will tell you plainly whether you are caught and what the appointment involves.

Sources and references

Representative mandates

These mandates stack rather than replace each other. One company selling into Europe can be caught by several at once, each is a separate appointment with its own published contact point, and an EU representative does not cover the UK. Engage Compliance holds them together so you have one point of contact across the set.

Contact us Start representative sign-up

FAQ

Frequently asked questions

Does an Australian company need an EU representative?

If your company is based in Australia, has no establishment in the EU, and either offers goods or services to people in the EU or monitors their behavior, then GDPR Article 27 requires you to appoint a representative established in an EU member state. The narrow exemption in Article 27(2) is for occasional, low-risk processing that does not involve large-scale special category or criminal data, and a retailer shipping to the EU or an app tracking EU users rarely qualifies for it.

Doesn't the Australian Privacy Act cover this?

No. Australia's Privacy Act 1988 applies directly to overseas organizations with an Australian link under section 5B, but it does not require them to appoint a local representative or agent in Australia. Its whole mechanism is extraterritorial reach: a foreign organization with an Australian link is bound wherever it sits, with no appointed proxy in the middle. That is the opposite design to GDPR Article 27, so nothing in the Privacy Act stands in for the EU appointment.

We are under the AUD 3 million turnover threshold. Does that change the EU position?

It changes your Australian position, not your EU one. Section 6D of the Privacy Act generally exempts organizations with annual turnover of AUD 3,000,000 or less, so many smaller Australian businesses sit outside the Australian Privacy Principles even where they have an Australian link. GDPR Article 27 has no such turnover threshold. If you offer goods or services to people in the EU or monitor their behavior, the EU obligation still applies regardless of your Australian turnover.

Do Australian companies also need a UK representative?

Usually, yes. The UK runs its own UK GDPR with its own Article 27, and an Australian company selling online into the EU is in most cases also reaching people in the UK. The two obligations are separate appointments in separate territories, so meeting the EU requirement does nothing for the UK one. A company reaching both markets appoints a representative in each.

Can the same provider be our EU representative and our DPO?

The EU Representative and the outsourced DPO are two separate products. If you need both, tell us and we will scope them together.

Can Engage also act as our DPO?

Yes. Engage supports both Data Protection Officer work and Article 27 representative work, as two separate products scoped to what you need. See DPO Services.

Does an Australian app with EU users need to appoint an EU GDPR representative?

In most cases, yes. An app or SaaS business running analytics on EU users is monitoring their behavior under GDPR Article 3(2), and with no EU establishment that brings the Article 27 duty with it. The Article 27(2) exemption is narrow, and an app that runs on EU users rarely qualifies.

We take bookings from European travelers. Is that enough to need one?

It can be. A travel or tourism operator taking bookings from people in the EU is offering services to them, which is one of the two Article 3(2) triggers, and payment does not have to be involved. With no EU office, that is the ordinary shape of an Australian business that owes an EU representative.

As an Australian SaaS company, do we also need a NIS2 representative?

Only if your service is on the NIS2 Article 26(1)(b) list, which covers providers such as cloud computing services, managed service providers and online marketplaces. The GDPR representative and the NIS2 representative are separate appointments. Our NIS2 representative page sets out who is caught.

Does the OAIC deal with our EU obligations?

No. The Office of the Australian Information Commissioner regulates the Privacy Act and the Australian Privacy Principles at home. EU obligations sit with the supervisory authority in the member state where your representative is established, and the wider network coordinated through the European Data Protection Board.

Do we need a partner in Australia as well?

No. Australian law has no separate representative obligation to satisfy, so nothing here runs through a local partner in Australia. We act as your EU representative directly from Amsterdam, named in your privacy notice and reachable by EU authorities and by people in the EU.

What happens once we sign up?

After payment you answer a short form about your company and who should receive correspondence, which takes about three minutes, and the appointment document, the certificate, the public verification link and the privacy notice wording issue automatically at that moment. The EU representative service page shows how it works.

How is the EU representative priced for an Australian company?

By company size band. Every band's price is published on the EU representative service page and on pricing, so there is no quote to wait for.

Related

Service Appoint an EU Representative Guide Do I need an EU Representative? Service EU Representative for US companies Service EU Representative for Canadian companies Service EU Representative for Indian companies Law GDPR Article 27, full text Service DPO Services