Do you need an EU Data Representative?
Quickly assess whether your organisation needs an EU Representative under GDPR Article 27.
EU Representative Checker
Check your status
We map your answers to GDPR Article 27's territorial scope, exemption analysis, and a risk score to give you a clear verdict.
What is an EU Representative?
An EU Representative under GDPR Article 27 is a natural person or legal entity established in the EU that acts as the local contact point for data protection authorities and data subjects on behalf of a non-EU controller or processor.
They must be established in an EU Member State where your data subjects are located.
Non-EU organisations under Art. 3(2)
Any controller or processor not established in the EU but offering goods or services to, or monitoring, EU data subjects.
Contact point for authorities
Acts as the local point of contact for supervisory authorities and data subjects exercising their rights.
Must be in an EU Member State
The Representative must be established where your data subjects are located (Art. 27(3)).
When Article 27 applies.
The obligation applies when GDPR's territorial scope reaches your organisation under Article 3(2).
Offering goods or services to the EU
If your organisation deliberately targets EU data subjects with goods or services, even free ones, GDPR applies and you likely need a Representative.
Monitoring EU behaviour
Cookie tracking, behavioural profiling, or location monitoring of EU individuals triggers Art. 3(2)(b) and the Representative obligation.
Narrow exemption (Art. 27(2)(a))
Exempt only if processing is truly occasional, includes no large-scale special or criminal data, and is unlikely to risk individuals' rights.
Public authorities exempt
Public authorities and public bodies are explicitly exempt from the EU Representative requirement under Article 27(2)(b) GDPR.
Both controllers and processors
Article 27 applies independently to both data controllers and processors not established in the EU.
Representative location matters
The Representative must be established in an EU Member State where your data subjects are located (Art. 27(3)).
What does an EU Representative do?
The Representative acts as the primary contact point in the EU for data subjects, supervisory authorities, and regulators.
Contact point for authorities
Receives and handles communications from DPAs on behalf of the non-EU controller or processor.
Contact point for data subjects
EU residents can exercise their GDPR rights, access, erasure, rectification, portability, by contacting the Representative.
Maintain the RoPA
Must be provided with and maintain a copy of the organisation's Records of Processing Activities under Article 30(1).
Listed in privacy notices
Name and contact details must be included in all privacy notices directed at EU data subjects (Articles 13 and 14).
Designated in writing
The appointment must be made in writing; a verbal appointment is not sufficient.
No diminished liability
Appointing a Representative does not transfer or reduce the liability of the non-EU controller or processor.
Do you qualify for the Article 27 exemption?
The exemption under Article 27(2)(a) is deliberately narrow. All three conditions must be satisfied simultaneously.
You may qualify for the exemption if
- Processing is truly occasional and irregular
- No large-scale processing of special category data
- No large-scale processing of criminal conviction data
- Processing is unlikely to result in risk to individuals' rights
- You are a public authority (separate exemption under Art. 27(2)(b))
You do not qualify if
- You run a SaaS platform, e-commerce store, or app with EU users
- You use cookies or tracking pixels on a website accessible to EU visitors
- You have EU employees, contractors, or regularly process EU HR data
- You handle health, biometric, or other special category data of EU residents
- You run targeted marketing aimed at EU audiences
EU Representative vs. Data Protection Officer.
These are two entirely separate GDPR obligations. Your organisation may need one, both, or neither.
EU Representative
Art. 27Data Protection Officer
Art. 37Need a Representative? We can help.
Whisperly partners with qualified EU Representative service providers established across EU Member States.
Not a commitment. We'll match you with the right provider based on your sector, size, and the EU Member States where your data subjects are located.