Do You Need an EU Representative?
Answer 4 quick questions to assess your GDPR Article 27 exposure and see the fastest path to compliance.
How the assessment scores your answers
Four questions, each answer worth 0 to 3 points, 12 points in total. The result is an indication of Article 27 exposure, not a legal determination (Terms, Section 13.1).
1. Does your company sell products or services to customers in the European Union?
- Yes, we do (we actively sell to or have customers in the EU): 3 points
- We're planning to (EU expansion is on the roadmap): 2 points
- Possibly / not sure (our website is accessible in the EU): 1 point
- No, outside the EU only: 0 points
2. Does your company collect or process personal data from EU residents?
- Yes, extensively (detailed user data, analytics and accounts): 3 points
- Yes, basic data (email addresses, contact forms, basic analytics): 2 points
- Cookies or analytics only: 1 point
- No personal data from EU residents: 0 points
3. Do you monitor the behaviour of EU visitors or users?
- Yes, extensively (detailed behaviour and profiles): 3 points
- Yes, basic analytics and conversion tracking: 2 points
- Very limited (basic logs, operational monitoring): 1 point
- No: 0 points
4. How regularly do you process personal data from EU residents?
- Continuously (daily, from active EU users or customers): 3 points
- Regularly (weekly or monthly): 2 points
- Occasionally (infrequent, non-systematic): 1 point
- Rare to none: 0 points
The result
6 points or more (half the maximum): "Action Required". Your answers point to clear EU-facing data processing, and Article 27 most likely applies. The tool recommends the Business plan.
Fewer than 6 points: "Action Recommended". Your answers show risk signals associated with Article 27, such as basic analytics on EU users. The tool recommends the Essential plan.
Article 27(2) GDPR exempts processing that is occasional, does not include special categories or criminal data on a large scale, and is unlikely to result in a risk to individuals, and it exempts public authorities. Whether that exemption covers your company is a legal question the four questions cannot settle; a low score with "occasional" processing is where it is worth checking. Our guide to Article 27 explains the duty, and contact us for anything specific to your case.
Verified by licensed EU attorneys — not a mailbox
Your designation is held and signed by Cloudkasten GmbH, a real German legal entity with licensed Rechtsanwälte on the team. Here's how to verify it.
Christos Paloubis
Rechtsanwalt
Licensed German Attorney since 2000
Verify in the official German attorney register ↗
Felix Gebhard
Rechtsanwalt
Licensed German Attorney · Certified DPO (TÜV SÜD)
Verify in the official German attorney register ↗- Registered EU entity — Cloudkasten GmbH
- SSL secured
The Law Is Clear: You Need an EU Representative
Up to €20 Million in Fines
GDPR penalties can reach €20 million or 4% of global annual revenue. These are enforceable penalties, not hypothetical warnings.
Enforcement Is Active
GDPR has been enforced since 2018. Regulators and data subjects can initiate actions when companies serving the EU have obvious compliance gaps.
It's the Law, Not a Suggestion
GDPR Article 27 requires many non-EU companies to designate an EU representative. Exemptions are narrow and must be carefully justified.