As a Ukrainian company that offers services or goods in the European Union (EU) or processes personal data of persons from the EU, the General Data Protection Regulation (GDPR) also applies to you. Particularly relevant: the appointment of an EU representative in accordance with Art. 27 GDPR — an obligation as soon as your company does not have a branch in the EU. Find out how you can ensure compliance as a non-EU company with a professional EU representative and gain the trust of your European partners.
What is an EU representative according to Art. 27 GDPR?
The EU representative is your official point of contact within the European Union for data protection issues. They represent Ukrainian companies that do not have an office or subsidiary within the EU, but offer goods or services in the EU or process data of individuals in the EU.
Art. 27 GDPR obliges non-EU companies to appoint a representative if they process personal data of individuals in the EU. Typical examples are IT service providers, e-commerce shops, outsourcing agencies, or SaaS providers from Ukraine.
When is an EU representative mandatory for Ukrainian companies?
Use the following checklist to check whether your company is affected:
- You have no registered office or branch in the EU.
- You offer goods or services to people in the EU (e.g. via online shops, apps, or platforms).
- You monitor or analyse the behaviour of individuals in the EU (e.g. through tracking, web analytics, or targeted marketing).
Smaller companies and start-ups from Ukraine are also often affected by this obligation!
Tasks and advantages of an EU representative
- Communication with supervisory authorities: the representative is the first point of contact for enquiries and audits.
- Contact point for data subjects: individuals in the EU can contact the representative directly to request information or deletion of their data.
- Maintenance of the record of processing activities: the representative manages the relevant documentation vis-à-vis authorities.
- Support in implementing GDPR compliance: professional advice helps to avoid fines and ensure that processes are legally compliant. Learn more: GDPR compliance system for Ukrainian companies.
Your advantage: with GDPR representation, you show your European partners that data protection and compliance are important to you — this creates trust and competitive advantages.
This is how the cooperation works
- Initial discussion: clarify whether your company is obliged to appoint an EU representative.
- Conclusion of contract: define tasks, responsibilities, and information flows together.
- Communication: the EU representative will be named on your website and in your privacy policy.
- Ongoing support: you receive support with enquiries and audits, and with setting up and maintaining the record of processing activities.
FAQ on the EU representative for Ukrainian companies
Does every Ukrainian IT company have to appoint an EU representative?
Only if you process personal data of individuals in the EU or offer services there.
What happens if no representative is appointed?
There is a risk of heavy fines and a loss of trust from European customers and partners.
Does the obligation also apply to occasional business activities in the EU?
Not necessarily. Under Art. 27(2)(a) GDPR, the obligation does not apply if the processing is occasional, does not include large-scale processing of special categories of data (Art. 9) or of data relating to criminal convictions and offences (Art. 10), and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account its nature, context, scope and purposes. The exemption is interpreted narrowly: if you regularly target your offer at the EU market, your processing is usually not merely occasional.
How quickly must an EU representative be appointed?
Immediately, as soon as you fall under the requirements of the GDPR.
Is the EU representative the same as a data protection officer?
No, an EU representative is a different role to the Data Protection Officer.
How do you choose an EU representative?
The representative must be established in one of the Member States where the data subjects whose data you process are located (Art. 27(3) GDPR). Also look for experience in data protection law, availability in the languages of your customers and the supervisory authorities, and a clear contractual arrangement of tasks and information flows.
Still have questions?
In a free initial consultation we’ll clarify which obligations apply to your company — no strings attached, in German, English or Ukrainian.