Contact us
Contact us

EU Representative for Israeli Companies under GDPR Article 27

An Israeli company that offers goods or services to people in the EU, or monitors their behavior, is caught by GDPR Article 3(2) and has to appoint an EU representative under Article 27. Israel's EU adequacy decision does not change this, and treating it as though it does is a common and expensive mistake.

By Julian Gage Last reviewed: 28 August 2026

Key takeaways

  • GDPR Article 27 applies to Israeli companies with no EU establishment that offer goods or services to, or monitor the behavior of, people in the EU. The exemption is narrow.
  • Israel’s EU adequacy decision does not remove this. Adequacy is about data flowing into Israel; Article 27 is about the Israeli company’s own obligations when it targets the EU. They are different questions.
  • Israel’s own Protection of Privacy Law is a separate regime, overseen by the Privacy Protection Authority, and on the primary text it does not require foreign companies to appoint a local Israeli representative.
  • Most Israeli companies caught by the EU obligation are also caught by the separate UK one, and each is appointed independently.
  • We act as your EU representative directly from Amsterdam, with the same expert on your account.

How does an Israeli company get caught by GDPR?

GDPR reaches beyond the EU through Article 3(2): a company with no EU establishment is inside the Regulation when its processing relates to offering goods or services to people in the EU, whether or not payment is required, or monitoring their behavior as far as it happens in the EU.

Israel has an unusually large technology sector, so the common case is an Israeli SaaS, adtech, cybersecurity, or mobile-app company whose product serves or tracks EU users. Selling subscriptions to EU customers is offering services; running analytics, profiling, or ad targeting on EU users is monitoring behavior. Both trigger Article 27, whatever the company’s own privacy standards look like at home.

Why does adequacy not remove the Article 27 obligation?

This is the point Israeli companies get wrong most often, so it is worth being precise.

Israel holds an EU adequacy decision, Commission Decision 2011/61/EU, which the European Commission reaffirmed in its January 2024 review of the older adequacy decisions. Adequacy sits in Chapter V of the GDPR, the chapter on international transfers, and it answers one question: can an EU business send personal data to a recipient in Israel without extra safeguards such as standard contractual clauses? Because of the adequacy decision, the answer is yes. That is a benefit to the EU data exporter.

Article 27 answers a completely different question, and it lives in a different part of the GDPR. It follows from Article 3(2): if your Israeli company itself targets or monitors people in the EU, GDPR applies to you directly, and you must appoint an EU representative. Adequacy does nothing to switch that off. In plain terms, adequacy answers “can EU data be sent to Israel?” while Article 27 answers “does this Israeli company, because it sells to or tracks EU users, need an EU representative?” The answer to the second is yes, independently of the first. Treating the adequacy decision as an Article 27 exemption is the common and expensive mistake.

What does Israel’s own privacy law require?

Israel’s Protection of Privacy Law, 5741-1981, as significantly amended by Amendment 13, came into force on 14 August 2025 and is overseen by the Privacy Protection Authority. Amendment 13 moves the law toward GDPR, with a data protection officer duty, broader definitions, and stronger enforcement. On the primary text, it does not impose a GDPR Article 27 style requirement for foreign companies to appoint a local Israeli representative, so this is a separate domestic regime rather than a second representative obligation.

Who regulates this?

In the EU, the supervisory authority in the member state where your representative sits, coordinated through the European Data Protection Board. In Israel, the Privacy Protection Authority oversees the Protection of Privacy Law. Separate regimes.

Do Israeli companies also need a UK representative?

Usually, where the company also offers goods or services to, or monitors, people in the UK. The UK GDPR carries its own separate Article 27, enforced by the Information Commissioner’s Office, and an EU representative does not cover the UK. The same adequacy point applies on the UK side: an adequacy finding covers data sent to Israel and does not remove an Israeli company’s own UK Article 27 duty. We can take both as separate mandates.

What does Engage do?

Engage Compliance acts as your EU representative under Article 27, established in the EU, named in your privacy notice, and reachable by supervisory authorities and by people in the EU on your behalf. This is a service we deliver directly from Amsterdam, with the same expert on your account rather than a junior handoff.

Sign-up takes minutes. After payment you answer a short form about your company and who we should send correspondence to, about three minutes of typing, and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment.

Where you also need a named DPO, that is a separate product, and we scope the two together.

Experience across 100+ startups and enterprises, including Amazon, Coinbase, Robinhood, Fanatics, Medtronic, AbbVie, IKEA, Nestle and Hopin.

What to do next

If you are an Israeli company selling to or tracking people in the EU and you have not appointed an EU representative, that is an open GDPR Article 27 obligation, and your adequacy status does not close it. Read do I need an EU representative, see how the EU representative service works, or contact us and we will tell you plainly whether you are caught and what the appointment involves.

Sources and references

Representative mandates

These mandates stack rather than replace each other. One company selling into Europe can be caught by several at once, each is a separate appointment with its own published contact point, and an EU representative does not cover the UK. Engage Compliance holds them together so you have one point of contact across the set.

Contact us Start representative sign-up

FAQ

Frequently asked questions

Does an Israeli company need an EU representative?

If your company is based in Israel, has no establishment in the EU, and either offers goods or services to people in the EU or monitors their behavior, then GDPR Article 27 requires you to appoint a representative established in an EU member state. Israel's large tech sector means this catches a lot of companies. The narrow exemption in Article 27(2) is for occasional, low-risk processing and most products that run on EU users do not qualify.

Doesn't Israel's EU adequacy decision mean GDPR does not apply to us?

No, and this is the mistake we correct most often. Adequacy and Article 27 answer different questions. Israel's adequacy decision is about data flowing into Israel: it lets an EU business transfer personal data to an Israeli recipient without extra safeguards, because the Commission judged Israel's protection adequate. Article 27 is about your own company's direct obligations: if you target or monitor people in the EU, GDPR applies to you and you must appoint an EU representative. Adequacy does not switch that off. The two sit in different chapters of the GDPR and do different jobs.

What does Israel's own privacy law require?

Israel's Protection of Privacy Law, 5741-1981, as significantly amended by Amendment 13, which came into force on 14 August 2025, is overseen by the Privacy Protection Authority. Amendment 13 modernizes the law toward GDPR, including a data protection officer duty and stronger enforcement. It is not the same as the EU representative obligation, and on the primary text it does not impose a GDPR Article 27 style requirement for foreign companies to appoint a local Israeli representative.

Do Israeli companies also need a UK representative?

Usually, where the company also offers goods or services to, or monitors, people in the UK. The UK GDPR carries its own separate Article 27, enforced by the Information Commissioner's Office. The same adequacy point applies on the UK side: an adequacy finding covers data sent to Israel, and does not remove an Israeli company's own UK Article 27 duty when it is directly caught.

Can the same provider be our EU representative and our DPO?

The EU Representative and the outsourced DPO are two separate products. If you need both, tell us and we will scope them together.

Can Engage also act as our DPO?

Yes. Engage supports both Data Protection Officer work and Article 27 representative work, as two separate products scoped to what you need. See DPO Services.

Our Israeli cybersecurity or SaaS company sells subscriptions to EU customers. Do we need an EU representative?

Usually, yes. Selling subscriptions to EU customers is offering services to people in the EU under GDPR Article 3(2), and with no EU establishment that triggers Article 27. It applies whatever your privacy standards look like at home.

Does ad targeting or profiling of EU users trigger Article 27?

Yes. Running analytics, profiling or ad targeting on EU users is monitoring their behavior, the second Article 3(2) trigger. An Israeli adtech or mobile-app company doing this is caught even if the EU users never pay.

Can an EU business still send us data without extra safeguards?

Yes, that is what adequacy does. Under Commission Decision 2011/61/EU, reaffirmed in the January 2024 review, an EU business can send personal data to a recipient in Israel without safeguards such as standard contractual clauses. It answers a transfer question only, not whether your company needs an EU representative.

Does Amendment 13 make us appoint a representative in Israel?

On the primary text, no. Amendment 13, in force since 14 August 2025, moves Israel's Protection of Privacy Law toward GDPR, including a data protection officer duty and stronger enforcement, but it does not impose a GDPR Article 27 style requirement for foreign companies to appoint a local Israeli representative.

How do we appoint an EU representative?

We act as your representative directly from Amsterdam. Sign up on the EU representative service page, answer a short form about your company after payment (about three minutes), and the appointment document, the certificate, the public verification link and the privacy notice wording issue automatically.

What does an EU representative cost for an Israeli company?

It is priced by company size band. The price for every band is published on the EU representative service page and on pricing.

Related

Service EU Representative for Saudi companies Service Appoint an EU Representative Guide Do I need an EU Representative? Guide EU Representative vs DPO Service EU Representative for US companies Service EU Representative for UAE companies Law GDPR Article 27, full text Law GDPR Article 3, territorial scope Service DPO Services