Article 27: Representatives of controllers or processors not established in the Union - GDPR

1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.

2. The obligation laid down in paragraph 1 of this Article shall not apply to: (a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or (b) a public authority or body.

3. The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.

4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.

5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

Understanding This Article

Article 27 extends GDPR's enforcement reach to non-EU organizations. Under Article 3(2), GDPR applies extraterritorially to organizations not established in the EU when they offer goods/services to EU data subjects or monitor their behavior. Article 27 ensures these organizations can be effectively regulated by requiring an EU-based representative.

The representative serves as a local point of contact, making enforcement practical. Rather than supervisory authorities navigating foreign jurisdictions or data subjects dealing with overseas entities, they can contact the EU representative. This representative must be mandated to address all processing-related issues, ensuring GDPR compliance can be discussed and enforced locally.

However, paragraph 5 clarifies the representative doesn't shield the non-EU organization. Authorities and data subjects can still pursue direct legal action against the foreign controller/processor. The representative facilitates enforcement but doesn't replace the organization's direct GDPR obligations or liability.

Key Points

Non-EU controllers/processors subject to GDPR must designate EU representative

Exception for occasional, low-risk processing and public authorities

Representative must be in Member State where data subjects are located

Serves as contact point for supervisory authorities and data subjects

Doesn't shield non-EU entity from direct legal action

Ensures GDPR enforcement accessibility

Understanding This Article

Key Points

Related Recitals

Related Articles in Chapter 4

Popular Articles