Contact us
Contact us

EU Representative for US Companies under GDPR Article 27

A US company with no EU establishment that offers goods or services to people in the EU, or monitors their behavior, is caught by GDPR Article 3(2) and has to appoint an EU representative under Article 27. Nothing in US privacy law does this for you.

By Julian Gage Last reviewed: 28 August 2026

To appoint us, see our EU representative services.

Key takeaways

  • GDPR Article 27 applies to US companies with no EU establishment that offer goods or services to, or monitor the behavior of, people in the EU. The exemption is narrow and most products that run on EU users do not qualify.
  • No US privacy law removes this. The CCPA and the other state laws are threshold-based and impose duties on the business directly. None of them appoints an EU representative for you.
  • The EU representative is not your US registered agent for service of process. One is corporate law, the other is GDPR.
  • Most US companies caught by the EU obligation are also caught by the separate UK one, and the two are appointed independently.
  • We act as your EU representative directly, and the outsourced DPO is a separate product we scope together where you also need it.

How does a US company get caught by GDPR?

GDPR reaches beyond the EU through Article 3(2). A company with no EU establishment is inside the Regulation when its processing relates to either offering goods or services to people who are in the EU, whether or not payment is required, or monitoring their behavior as far as that behavior happens in the EU.

A US direct-to-consumer brand running a Shopify store that ships to and prices for customers in Germany or France is offering goods to people in the EU. A US SaaS or mobile-app company that runs analytics, advertising pixels, or session recording on EU visitors is monitoring behavior. Both are the ordinary shape of a US business that has grown into the EU market without opening an EU office, and both trigger Article 27.

Does US privacy law require an EU representative?

No. The US has no single federal privacy statute. It has a growing patchwork of state laws, and each of them is triggered by doing business with or targeting the residents of that state plus revenue or data-volume thresholds, not by where a company is established, and none of them creates a GDPR Article 27 style local representative.

The California Consumer Privacy Act, as amended by the CPRA, applies above set revenue and data thresholds. Virginia’s Consumer Data Protection Act and the Colorado Privacy Act work the same way, and the rest of the 2023 to 2026 wave follows the same model. All of them impose obligations on the business itself. None appoints an EU contact point, because that is a requirement of EU law and sits outside the reach of any US statute.

One point worth clearing up: a company that registers to do business in a US state has to keep a registered agent for service of process under that state’s corporations code. That is corporate-law housekeeping and it is not a data protection representative. It does not satisfy Article 27, and Article 27 does not satisfy it.

Who regulates this?

In the EU, the supervisory authority in the member state where your representative sits, and the wider network of authorities coordinated through the European Data Protection Board. In the US, there is no single privacy regulator: the California Privacy Protection Agency is the one dedicated state body, most states enforce through the state attorney general, and the Federal Trade Commission acts at the federal level under Section 5 of the FTC Act. None of them administers Article 27, which is the point.

Do US companies also need a UK representative?

In most cases, yes. After Brexit the UK runs its own UK GDPR with its own Article 27, enforced by the Information Commissioner’s Office, and a US company selling online into the EU is usually reaching the UK as well. The two obligations are separate appointments in separate territories, and an EU representative does not cover the UK. We can take both, as two mandates.

What does Engage do?

Engage Compliance acts as your EU representative under Article 27, established in the EU, named in your privacy notice, and reachable by supervisory authorities and by people in the EU on your behalf. This is a service we deliver directly from Amsterdam, with the same expert on your account rather than a junior handoff.

Sign-up takes minutes. After payment you answer a short form about your company and who we should send correspondence to, about three minutes of typing, and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment.

Where you also need a named DPO, that is a separate product, and we scope the two together.

Experience across 100+ startups and enterprises, including Amazon, Coinbase, Robinhood, Fanatics, Medtronic, AbbVie, IKEA, Nestle and Hopin.

What to do next

If you are a US company selling to or tracking people in the EU and you have not appointed an EU representative, that is an open GDPR Article 27 obligation. Read do I need an EU representative to check whether the narrow exemption could apply to you, see how the EU representative service works, or contact us and we will tell you plainly whether you are caught and what the appointment involves.

US companies that also sell into Switzerland need to check the Swiss representative service.

Sources and references

Representative mandates

These mandates stack rather than replace each other. One company selling into Europe can be caught by several at once, each is a separate appointment with its own published contact point, and an EU representative does not cover the UK. Engage Compliance holds them together so you have one point of contact across the set.

Contact us Start representative sign-up

FAQ

Frequently asked questions

Does a US company need an EU representative?

If your company is based in the US, has no establishment in the EU, and either offers goods or services to people in the EU or monitors their behavior, then yes, GDPR Article 27 requires you to appoint a representative established in an EU member state. The narrow exemption in Article 27(2) is for occasional, low-risk processing that does not involve large-scale special category or criminal data, and most products that run on EU users do not qualify for it.

Doesn't the CCPA or another US law cover this?

No. US privacy law is a state patchwork, and it is triggered by revenue and data-volume thresholds and by targeting a state's residents, not by where your company is established. No US state comprehensive privacy law imposes a GDPR Article 27 style local representative. The CCPA, Virginia's VCDPA, the Colorado Privacy Act, and the rest impose duties directly on the business. None of them appoints an EU contact point for you, because that is an EU obligation, not a US one.

Is an EU representative the same as our registered agent for service of process?

No, and the two are easy to confuse. A registered agent is a corporate-law requirement you meet when you register to do business in a US state. The EU representative is a data protection role under GDPR Article 27, sitting inside the EU, named in your privacy notice, and reachable by EU supervisory authorities and by people in the EU. Neither one substitutes for the other.

Do US companies also need a UK representative?

Usually, yes. The UK has its own separate Article 27 obligation under the UK GDPR, and a US company selling online into the EU is in most cases also selling into the UK. Meeting the EU requirement does nothing for the UK one, so a company reaching both markets appoints a representative in each.

Can the same provider be our EU representative and our DPO?

The EU Representative and the outsourced DPO are two separate products. If you need both, tell us and we will scope them together.

Can Engage also act as our DPO?

Yes. Engage supports both Data Protection Officer work and Article 27 representative work, as two separate products scoped to what you need. See DPO Services.

What does an EU representative actually do for a US company?

It is your contact point inside the EU. The representative is established in an EU member state, named in your privacy notice, and reachable by EU supervisory authorities and by people in the EU on your behalf. Engage Compliance acts in that role directly, from Amsterdam.

Does running analytics or ad pixels on EU visitors trigger Article 27?

It can. GDPR Article 3(2) covers monitoring the behavior of people in the EU, and a US SaaS or app company running analytics, advertising pixels or session recording on EU visitors is doing exactly that. Monitoring is enough on its own to bring you inside the Regulation, and with it the Article 27 duty to appoint a representative.

We only ship products to EU customers from the US. Do we still need one?

In most cases, yes. A US direct-to-consumer brand whose store ships to and prices for customers in Germany or France is offering goods to people in the EU under Article 3(2), with or without an EU office. Payment is not the test either, since Article 3(2) applies whether or not payment is required.

Which EU regulator would we deal with?

The supervisory authority in the member state where your representative sits, plus the wider network of authorities coordinated through the European Data Protection Board. No US regulator administers Article 27, so this sits entirely on the EU side.

How do we appoint Engage as our EU representative?

Sign-up takes minutes. After payment you answer a short form about your company and who we should send correspondence to (about three minutes of typing), and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment. Start from the EU representative service.

Does an EU representative cover Switzerland too?

No. The appointment covers the EU only. If you also sell into Switzerland, check the Swiss representative service, which is a separate mandate.

How much does an EU representative cost for a US company?

The price depends on your company's size band, and every band is published on the EU representative service page and on our pricing page, so you can see the figure before you buy.

Related

Service Appoint an EU Representative Guide Do I need an EU Representative? Guide EU privacy compliance for US companies Service EU Representative for Canadian companies Service EU Representative for UK companies Law GDPR Article 27, full text Law GDPR Article 3, territorial scope Service DPO Services