GDPR Article 27: Representatives of controllers or processors not established in the Union

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

If Article 3(2) catches you, meaning you have no EU establishment but you offer goods or services to people in the EU or monitor their behavior, Article 27 makes you designate a representative in the Union in writing. The representative is a point of contact for supervisory authorities and for data subjects, and it holds a copy of your Article 30 record.

Who it binds

• Controllers and processors with no establishment in the Union whose processing falls under Article 3(2).
• It does not bind a public authority or body (Article 27(2)(b)).
• It does not bind you where the processing is occasional, does not include large-scale processing of special category data or criminal conviction data, and is unlikely to result in a risk to rights and freedoms (Article 27(2)(a)). All three limbs have to hold, so the exemption is narrower than it first reads.

What it makes somebody do

• You, the controller or processor. Designate the representative in writing (Article 27(1)).
• You, the controller or processor. Place them in a Member State where the data subjects you serve or monitor actually are (Article 27(3)). Where you serve several, the choice is yours among them.
• You, the controller or processor. Mandate them to be addressed in addition to or instead of you by supervisory authorities and by data subjects, on all issues related to processing (Article 27(4)).
• The representative. Maintain a record of processing activities under Article 30(1), which for a representative is its own obligation and not merely a copy it holds as a favor.
• The representative. Make that record available to a supervisory authority on request (Article 30(4)).

What it does not say

• It does not make the representative your Data Protection Officer. Article 37 is a different appointment with different tasks, a different independence requirement, and a different test for who needs one.
• It does not make the representative a controller or a processor of your data. The role is addressability and record custody, not decision-making about the processing.
• It does not stop anything being brought against you. Article 27(5) says the designation is without prejudice to legal actions that could be initiated against the controller or processor themselves.
• It is not satisfied by a mailbox or a forwarding address. Article 27(4) requires a mandate to be addressed on all issues related to processing, which is a person who answers rather than a line in a privacy notice.
• The Article 27(2) exemption is not a size test. It turns on occasional processing, special category data and risk, so a small company that monitors behavior regularly is caught and a large one that processes occasionally may not be.

How it sits beside the other mandates

• Article 27 and Article 37 are frequently confused because both are appointments and both get published. A company can need one, the other, both, or neither. The Article 27 test is about where you are established; the Article 37 test is about what your core activities consist of.
• The UK runs its own Article 27 under the UK GDPR. Serving both the EU and the UK from outside both means two appointments, in two jurisdictions, with two records.
• Article 30 is what makes this appointment operational. The record is yours to write and keep current; the representative holds a copy and is the one an authority can ask for it.