EU representatives become an important issue for companies without their own establishment in the European Union as soon as they process personal data of individuals in the EU or offer services on the European market. Small and medium-sized companies outside the EU in particular are faced with the question of when the appointment of an EU representative is necessary, what tasks and responsibilities are involved and what differences there are to the data protection officer. The appointment of an EU representative under the GDPR is mandatory if data processing activities are aimed at the EU market – and also applies to providers based outside Europe. Who acts as the controller, what legal risks exist and how third country transfers are organised in compliance with data protection regulations is particularly relevant for companies without an EU presence. The following information will help you to understand the legal requirements and implement your compliance in accordance with Art. 27 GDPR in a practical manner.
Obligations under Art. 27 GDPR: requirements for international companies
Companies outside the EU face the challenge of complying with the requirements of the GDPR as soon as they process the personal data of individuals in the EU. Art. 27 GDPR obliges these companies to appoint an EU representative if they specifically offer their goods or services in the EU or monitor the behaviour of individuals in the EU. The practical consequence: even without their own branch in the EU, companies must fulfil the European data protection requirements and provide a suitable contact person within the EU. The aim of this regulation is to ensure effective enforcement of the GDPR and to protect the rights of data subjects. There are only isolated exceptions to this obligation if the processing of personal data is occasional or only minor. The appointment of an EU representative in accordance with Art. 27 GDPR helps to create transparency and enable direct communication with data protection authorities and data subjects at all times.
Tasks of the EU representative and difference from the data protection officer
An EU representative under the GDPR is not the same as a data protection officer. Both functions have different legal backgrounds and focal points, which are particularly relevant for companies without an EU branch.
Important facts at a glance:
- The EU representative must be based in the EU and be appointed in writing by the company.
- The main task is to liaise between the responsible company and data protection authorities or data subjects.
- Liability for data protection violations remains with the company itself in all cases.
- The data protection officer, on the other hand, is responsible for internal monitoring and control tasks and advises the company on all matters relating to GDPR compliance.
Function EU Representative Data Protection Officer Appointment obligation For companies without an EU branch (Art. 27 GDPR) Depending on the scope & type of data processing Tasks Contact person for authorities and data subjects Monitoring, counselling and training in the company Liability No representative liability, but intermediary No own liability, internal role
Illustrative example (fictitious, not a client case)
A US online company sells software to customers in Germany. As personal data is regularly processed and a targeted offer is made to individuals in the EU, the appointment of an EU representative is mandatory. If complex data processing is also involved, it may also be necessary to appoint a data protection officer.
Relevance for third country transfers
As soon as personal data is transferred from the EU to a third country, such as the USA (third country transfers), careful protection is required. Art. 44 et seq. GDPR apply here (e.g. adequacy decision, standard contractual clauses, binding corporate rules); the EU representative is not an instrument for this. A clear contractual separation of responsibilities – especially vis-à-vis supervisory authorities – remains essential.
Third country transfers: successfully implementing data protection obligations
The transfer of personal data from the EU to third countries, so-called third country transfers, is subject to the strict requirements of the GDPR. Companies outside Europe that offer services or products for the EU market must take special technical and organisational measures in addition to appointing an EU representative in accordance with Art. 27 GDPR.
Recommended solution steps:
- Appointment of an EU representative: The EU representative must be appointed unless one of the exceptions under Art. 27 GDPR applies. The appointment must be clear and in writing. The representative acts as a central point of contact for supervisory authorities and data subjects within the EU. Important: The actual responsibility and liability remains entirely with the company.
- Differentiation from the data protection officer: In contrast to the data protection officer, the EU representative has no supervisory or advisory function within the company. The tasks are limited to communication and the provision of relevant information within the meaning of the GDPR. The involvement of a data protection officer may be necessary regardless of this, especially in the case of high-risk processing.
- Record of processing activities: The EU representative supports the company in maintaining a record of all processing activities, as required by Art. 30 GDPR. This document must be presented to a European supervisory authority at any time upon request. Learn more about how to maintain your record of processing activities (Art. 30 GDPR).
- Third country transfers as a separate obligation: The company itself must fulfil the conditions of Art. 44 et seq. GDPR for third country transfers and establish appropriate safeguards; the EU representative does not take on this task. These include standard data protection clauses, binding corporate rules and, if necessary, additional technical measures.
- Documentation and accessibility: The contact details of the EU representative must be easy to find and published in the privacy policy. Continuous availability for enquiries from authorities and data subjects must be ensured.
- Regular compliance monitoring: The EU representative accompanies the company to monitor changes in data protection requirements. This allows the company to react promptly to new requirements if data processing is expanded or legal requirements are changed.
The appointment of an experienced EU representative and compliance with the relevant GDPR provisions help companies from third countries to operate on the European market in a sustainable and legally compliant manner.
Summary
An EU representative is essential for companies without an EU branch to reliably fulfil the requirements of the GDPR and Art. 27 GDPR. He assumes a central mediating role between companies, data protection authorities and the data subjects, but remains limited to the communication and documentation obligation. Responsibility and liability remain with the company. The involvement of a data protection officer is particularly advisable for third country transfers and complex data processing. Use our advice now to appoint a suitable EU representative and position your company on the EU market in compliance with data protection regulations. We also support you in setting up a Structured GDPR compliance system for your Ukrainian company.
Useful Links
See also: GDPR compliance system for Ukrainian companies
- Full GDPR text (Art. 27 & 30)
- European Data Protection Board (EDPB) – guidance and opinions
- EDPB-EDPS Joint Opinion 2/2021 on SCCs
Frequently asked questions (FAQ)
What is an EU representative under the GDPR?
An EU representative under the GDPR is a natural or legal person appointed by a company outside the EU to act as a central point of contact within the European Union. The EU representative serves as an interface between the company, European data protection supervisory authorities, and data subjects whose personal data is processed. Companies that have no establishment in the EU but offer services to individuals in the EU or monitor their behavior must generally appoint an EU representative.
What tasks does an EU representative fulfill?
The EU representative handles communication with data protection supervisory authorities and data subjects regarding data processing. They ensure that required documents such as the record of processing activities are maintained, provide information on the company’s data protection measures, and receive requests under Art. 15 GDPR. They also support the company in complying with GDPR requirements and report on relevant matters to the respective authorities.
How many EU representatives does a company need?
Generally, each company that offers services in the EU or processes personal data of individuals in the EU and has no establishment in the EU needs only one EU representative. A single representative is sufficient if they are adequately authorized and can act as a central contact person for all competent data protection supervisory authorities of the affected EU member states.
Which companies need a representative in the EU?
The obligation to appoint an EU representative applies to companies without a seat in the EU that specifically offer goods or services to persons in the EU or monitor the behavior of individuals in the EU. This applies to online shop providers, digital services, as well as analytics platforms and advertising networks, when personal data of persons in the EU is processed.
Exceptions to the obligation to appoint an EU representative
The appointment obligation does not apply if the processing of personal data is only occasional, not extensive, and does not involve processing of sensitive data under Art. 9 or data on criminal offenses under Art. 10 GDPR. Likewise, authorities and public bodies are generally exempt from the obligation to appoint an EU representative.
Who may be appointed as a representative under the GDPR?
Any natural or legal person with residence or seat in an EU member state where the data subjects are located may be appointed as an EU representative. They must be legally mandated by the company to handle communication with authorities and data subjects in connection with the GDPR. Own employees or external service providers can act as representatives, provided there are no conflicts of interest.
Liability of the EU representative for GDPR violations
The EU representative is generally not liable for data protection violations by the company itself. Responsibility for GDPR compliance and correct data processing remains entirely with the non-European company. The representative acts exclusively as a contact person and communication interface for authorities and data subjects.
Difference between the data protection officer and an EU representative
The data protection officer advises the company on all data protection matters, monitors GDPR compliance, and serves as a contact person internally and externally. An EU representative, on the other hand, primarily handles external communication with supervisory authorities and data subjects for companies without an EU establishment. The functions are clearly separated; however, one person can assume both roles if the requirements are met.
When is the appointment of a data protection officer required?
The GDPR requires the appointment of a data protection officer when a company extensively processes personal data, when special categories of data under Art. 9 GDPR are involved, or when regular and systematic monitoring occurs. This obligation also applies to non-European companies insofar as they fall within the scope of the GDPR.
What rights do data subjects have under the GDPR?
Data subjects have comprehensive rights under the GDPR. These include the right to access stored personal data, rectification of inaccurate information, erasure, restriction of processing, objection to data processing, and the right to data portability. If any of these rights is exercised, the company must respond promptly and provide transparent information about the data processing that has taken place.
On our central FAQ page you will find a comprehensive FAQ list on all topics related to data protection in trade with EU countries.
Contact & advice Ensure compliance with the GDPR for your company! Call us now Arrange a free consulting See all FAQs → Recent Articles → Glossary (German)
Still have questions?
In a free initial consultation we’ll clarify which obligations apply to your company — no strings attached, in German, English or Ukrainian.