Do you need an EU representative under the GDPR?
When Article 27 requires a company outside the EU to appoint a representative, and the two exceptions.
This is a summary of what the GDPR says, not legal advice about your business. For a quick check, try the GDPR representative checker.
When the GDPR reaches you
Article 3(2) applies the GDPR to a controller or processor that isn't established in the Union when it processes personal data of people who are in the Union, and the processing relates to either:
- offering them goods or services, whether or not they pay; or
- monitoring their behaviour, as far as that behaviour takes place in the Union.
What Article 27 asks
Where Article 3(2) applies, Article 27(1) requires you to designate a representative in the Union in writing. The representative is established in one of the Member States where the people whose data you process are (Article 27(3)), and is mandated to be addressed, in addition to or instead of you, by supervisory authorities and data subjects on all issues related to processing (Article 27(4)). Designating one is without prejudice to legal actions against you (Article 27(5)).
The two exceptions
Article 27(2) lifts the obligation for:
- processing that is occasional, doesn't include large-scale processing of special categories of data (Article 9(1)) or of data about criminal convictions and offences (Article 10), and is unlikely to result in a risk to people's rights and freedoms, taking into account its nature, context, scope and purposes; or
- a public authority or body.
Appointing EU Presence
Opening the Privacy register appoints us: you subscribe, then sign the Article 27 mandate. See Open a register and Sign the representation mandate. Your privacy notice then has to name the representative, under Articles 13(1)(a) and 14(1)(a); see Publish your representative's details.