How to Appoint an EU Representative under GDPR Article 27

If your company has no establishment in the EU but offers goods or services to people there, or monitors their behaviour, GDPR Article 27 usually requires you to appoint a representative in the EU. The appointment itself takes days, not months. It has three parts: a written mandate, a representative established in the EU, and your privacy notice naming that representative.

The short answer:

1. Confirm that Article 27 applies to you.
2. Choose a representative established in an EU member state where people you serve are located.
3. Appoint it in writing.
4. Receive the signed designation letter.
5. Name the representative in your privacy notice.
6. Set up who on your side handles what the representative forwards.

Step 1 — Confirm that Article 27 applies

Article 27 applies when your company is not established in the EU and the GDPR still covers your processing under Article 3(2). That happens when you:

• offer goods or services to people in the EU, paid or free; or
• monitor their behaviour in the EU, for example through analytics, tracking or profiling.

Signs that you target the EU include prices in euros, shipping to EU countries, marketing aimed at EU markets or in EU languages, EU customer accounts and behavioural advertising. A website that can merely be viewed from Europe is not enough on its own.

The exemption in Article 27(2) is narrow. It covers only processing that is occasional, does not include large-scale processing of special-category or criminal-offence data, and is unlikely to result in a risk to individuals. All three conditions must be met. Recurring sales, subscriptions, customer support or ongoing tracking rarely qualify. Public authorities are also exempt.

Settle at this point whether you act as a controller, a processor or both. It changes what reaches your representative and what goes in the designation.

Not sure? Run the free Article 27 check

Step 2 — Choose who can act as your representative

A representative can be a natural person or a legal entity. It must be established in one of the EU member states where the people whose data you process are located (Article 27(3)). One representative covers the whole EU; you do not need one per country.

An EU address alone does not make someone a good choice. A distributor, sales agent, employee or friend in Europe may have an address, but that creates problems when the person changes role, the relationship ends, or a formal letter from an authority arrives and nobody recognises it.

Before you sign, check:

• Who you are appointing. The legal entity, its registration and where it operates. A registered company is easier to verify than a virtual office.
• Who signs the designation, and when you receive it.
• What happens when something arrives. Ask: "A data protection authority writes to you on a Friday afternoon. What happens next?" Look for receipt, logging, prompt forwarding and a named contact, not just "we forward the email".
• What is included and what is extra. Know where representation ends and legal advice begins.

Step 3 — Appoint the representative in writing

Article 27(1) requires the designation to be in writing. The representative must be mandated to be addressed, in addition to or instead of your company, by supervisory authorities and data subjects on all issues related to your processing (Article 27(4)).

The appointment does not move your GDPR responsibility to the representative. Your company stays accountable, and authorities can still take action against it directly (Article 27(5)).

Step 4 — Get the designation letter

The designation letter is your evidence that the appointment exists. It is what you show when a customer's procurement team, an auditor or an authority asks who represents you in the EU. The GDPR prescribes no template, but a credible letter includes:

• the legal name, legal form and registered details of your company;
• the legal name and address of the representative;
• a statement appointing the representative under Article 27 GDPR;
• whether you act as controller, processor or both;
• the effective date, and how changes and termination are handled;
• the representative's authority to receive communications from supervisory authorities and data subjects;
• confirmation that your own GDPR responsibilities remain with you;
• signatures and dates, or equivalent evidence of electronic signing.

Keep the signed letter with your GDPR records. In a corporate group, check which entity actually collects the data: a letter signed by a US parent does not cover an operating subsidiary unless it names it.

Step 5 — Name the representative in your privacy notice

Where you give people the information required by Articles 13 and 14, include your representative's identity and contact details. Procurement teams check this, and a notice that lists only a non-EU contact invites questions. Make sure the notice matches the designation letter.

A typical entry looks like this:

EU Representative (Article 27 GDPR)
[Your company] has appointed the following representative in the European Union:
Cloudkasten GmbH, Seestr. 20 G, 50374 Erftstadt, Germany
Email: [your forwarding address]@rep4.eu
Verify this appointment with rep4eu: [your verification link]

Only add the representative to your notice once you have the signed designation letter.

Step 6 — Set up your side

Your representative can only move as fast as the people it hands things to. Before you call the job done:

• name an owner and a backup for privacy, legal and security matters;
• tell support and sales that messages from your representative are urgent compliance matters, not vendor email;
• run one drill: an authority letter arrives on a Friday — who picks it up, and what happens next?

Remember that data subject requests have deadlines. Your representative forwards them; answering on time remains your responsibility.

What you usually need to provide

• Legal entity name, registered address and registration details
• A privacy contact on your side
• A short description of your products or services
• The EU countries you sell to or monitor
• Your current privacy notice
• Whether you act as controller, processor or both

You do not need a complete GDPR programme before you appoint a representative. Put the representative in place, then keep working on the rest.

How long it takes and what it costs

With your company details ready, appointing a representative usually takes days. Delays come from uncertainty about whether Article 27 applies, or from trying to fix every GDPR gap first.

Prices vary with what is included. Some services rent you an address; some charge per forwarded message; others include a signed designation, logged forwarding and support for a fixed fee. Compare what each fee covers, and where representation ends and legal advice begins.

With rep4eu, the representative is Cloudkasten GmbH, a registered German company (Amtsgericht Köln, HRB 92697) with two German-admitted lawyers on the team. Plans start at €348 per year, cover all 27 member states, and include the signed designation letter, privacy-notice wording, and forwarding of authority and data subject messages with no per-request charges. Verification typically takes 24–48 hours (business days). Legal advice is available separately.

Common mistakes

• Treating an EU address as the whole job. Article 27 is about representation, not location.
• Signing nothing in writing. A privacy-notice entry without a written designation does not meet Article 27(1).
• Naming the wrong entity. The letter must name the company that actually processes the data.
• Hiding the appointment. A representative missing from your privacy notice is incomplete in practice.
• Waiting for a complaint. Appointing only after an authority writes raises the question of whether you were compliant before.
• Letting it go stale. Update the designation and your notice when your company name, structure or EU activity changes.

What an appointment does not do

It closes one specific, visible gap: the missing EU contact point. It does not replace a lawful basis, compliant notices, processor agreements, transfer safeguards, security measures or request handling. It does not create an EU establishment, and it is not a data protection officer. Article 27 representative vs DPO

Frequently asked questions