Do you need an EU representative under GDPR Article 27?

Of all the GDPR duties that catch non-EU companies off guard, appointing an EU representative is the most common. It is easy to miss because it has nothing to do with the size of your company and everything to do with whether the regulation reaches you at all. Once it does, the representative is one of the first concrete things you owe.

Who has to appoint an EU representative?

Article 27(1) is direct: where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union. Article 3(2) is the territorial-scope test, so if the GDPR reaches you because you offer goods or services to, or monitor, people in the EU, the default is that you need a representative. This is separate from any question of headcount or revenue; a two-person company can owe a representative while a large EU-based firm does not, because the firm has an establishment in the Union instead.

When are you exempt?

Article 27(2) provides one narrow way out. The obligation does not apply where the processing is occasional, does not include large-scale processing of special categories of data under Article 9(1) or criminal-conviction data under Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account its nature, context, scope and purposes. It also does not apply to a public authority or body. The word doing the work is "occasional". Running a live customer base or ongoing analytics is not occasional, so most SaaS businesses in scope cannot rely on this exemption.

Where must the representative be, and what do they do?

Under Article 27(3) the representative must be established in one of the Member States where the people whose data you process, in connection with offering them goods or services or monitoring them, are located. The representative is mandated to be addressed, in addition to or instead of you, by supervisory authorities and by data subjects on all issues related to your processing. Practically, that means naming them and giving contact details where people can reach them, typically in your privacy notice.

Is a representative the same as a data protection officer?

No, and conflating the two is a frequent mistake. An Article 27 representative is a local contact point in the EU for a company that has no establishment there. A data protection officer under Article 37 is an internal advisory and oversight role with its own separate triggers. Depending on your processing you might need one, both, or neither, so treat them as distinct questions rather than a single box to tick.

Next step

The representative question turns entirely on whether Article 3(2) applies and whether your processing is genuinely occasional, and that is exactly where teams talk themselves into the wrong answer. The free 2-minute Obligation Scan checks your territorial-scope position and tells you whether Article 27 applies, alongside the record of processing, the 72-hour breach notification duty, and other obligations that come with being in scope. The GDPR compliance hub puts them in order, and GDPR fines and penalties shows the cost of getting them wrong.