A US company can appoint a privacy officer, publish a privacy policy, and still be visibly noncompliant in Europe. The reason is simple: in the article 27 vs dpo question, these roles solve different legal problems. One gives EU regulators and individuals a local point of contact for a non-EU business. The other oversees privacy compliance inside the organization.
Confusing the two can create a gap that regulators, enterprise customers, and procurement teams will spot quickly. A Data Protection Officer does not automatically satisfy Article 27. An EU Representative does not become your DPO simply because it receives privacy requests.
For businesses outside the EU, the right answer depends on how and why they process EU personal data. In many cases, the answer is not Article 27 or DPO. It is Article 27 first, then a separate assessment of whether a DPO is required.
Article 27 vs DPO: the core distinction
GDPR Article 27 requires certain controllers and processors with no EU establishment to designate a representative in the Union. This applies where the company is subject to the GDPR because it offers goods or services to people in the EU or monitors their behavior.
The representative is the business's EU-facing legal contact point. Supervisory authorities and data subjects must be able to contact that representative regarding GDPR compliance. The appointment must be made in writing, and the representative's details should be available in the company's privacy information.
A DPO, by contrast, is an independent privacy advisory and oversight role under GDPR Articles 37 through 39. The DPO informs and advises the organization, monitors compliance, supports data protection impact assessments, trains relevant teams, cooperates with supervisory authorities, and acts as a contact point on DPO-related matters.
Put plainly, an Article 27 Representative stands where regulators and individuals can reach a non-EU company. A DPO helps the company meet its privacy obligations from within its governance structure. Neither role is a substitute for the other.
The confusion is understandable. Both roles appear in GDPR guidance, both are usually named in the privacy notice, and both deal with supervisory authorities and data subjects. From a distance they look like two versions of the same job. Operationally they are not: many non-EU businesses that clearly need an EU Representative do not need a DPO at all, while others need both.
At a glance, the two roles compare like this:
- Legal basis: the representative comes from Article 27; the DPO from Articles 37 to 39.
- Trigger: the representative is triggered by where you are (no EU establishment) combined with what you do (targeting or monitoring people in the EU). The DPO is triggered by the nature, scale and sensitivity of your core processing.
- Purpose: EU-based contact and representation, versus independent privacy advice and compliance oversight.
- Location: the representative must be established in the EU. The DPO must be accessible and sits within your governance structure, whether as an employee or an external service.
- Replaces the other role? No, in either direction.
When a non-EU company needs an Article 27 Representative
Article 27 is triggered by territorial scope, not by company size. If your business has no establishment in the EU but targets EU residents or monitors their behavior, you should assess whether you fall under GDPR Article 3(2).
Common examples include a US SaaS company selling subscriptions to EU customers, an ecommerce brand shipping to France and Germany, a mobile app tracking EU user behavior, or an ad-tech vendor profiling users in multiple EU countries. Localizing ads for EU markets or pricing and accepting payment in euros are typical signs of targeting. If the GDPR applies on that basis, an EU Representative is often required.
There is a narrow exemption. A representative may not be required where processing is occasional, does not include large-scale processing of special-category data or criminal-offense data, and is unlikely to create a risk to individuals' rights and freedoms. This is not a broad startup exemption, and modest EU revenue does not create one. Businesses conducting ongoing customer acquisition, analytics, user account management, customer support, or product delivery in Europe often struggle to fit comfortably within it.
The practical test is whether EU data processing is part of how your business operates, rather than a rare and low-risk event. If it is, relying on the exemption without a documented analysis is a weak position.
One appointment covers the whole Union. The representative must be established in one of the member states where the individuals whose data you process are located, and a single representative can act for you across all EU member states. You do not need a separate contact for each country you sell into.
What an Article 27 Representative actually does
A legitimate representative is more than an address printed in a privacy notice. In practice the role means a written designation, an entry in your privacy notice, receiving communications from regulators and data subjects, and routing them quickly to the people in your company who can act on them.
That matters when a supervisory authority sends an inquiry with a short deadline, a customer submits an access or deletion request, or a security incident raises questions across multiple EU markets. A mailbox provider may forward the message days later, from an address with no one accountable behind it. A functioning representative logs it, gets it to a named contact in your company promptly, and coordinates with the authority on the process, so a manageable inquiry does not escalate because a notice sat unread or a deadline slipped.
The representative does not take over the controller's or processor's obligations, and it does not write your answers for you. Your company remains responsible for GDPR compliance and for the substance of every response, and can still face enforcement action. But a credible EU-facing contact reduces the risk of missed notices, unmanaged requests, and the appearance that your company is inaccessible to European authorities.
When a DPO is required
A DPO is mandatory only in specific circumstances. You do not need one just because the GDPR applies to you. The most common triggers are where core activities involve large-scale, regular, and systematic monitoring of individuals, or large-scale processing of special-category data or criminal-offense data. Public authorities and public bodies also generally require a DPO, though that trigger is rarely relevant for US commercial operators.
“Core activities” is doing real work here. Payroll or basic HR administration may involve personal data, but it is usually not the central activity that defines a typical company's commercial operations. A company whose product depends on behavioral tracking, location analytics, health-data services such as telehealth, or extensive profiling faces a much stronger case for appointing a DPO. A typical B2B software company handling ordinary employee and customer contact data may not need one.
There is no fixed user count that automatically makes processing “large scale.” Regulators look at factors such as the number of people affected, the volume and range of data, how long processing continues, and the geographic scope. A business that tracks EU users continuously across devices has a far stronger DPO case than one holding a limited set of customer contacts for contract administration, and a small but rapidly scaling platform can cross the line faster than its leadership expects.
Even when a DPO is not legally required, voluntary appointment may be sensible for organizations with complex privacy operations, sensitive data, or enterprise customers demanding mature governance. The trade-off is that calling someone a DPO carries expectations of expertise, resources, independence, access to senior management, and freedom from conflicts of interest. Do not give the title to a senior executive whose commercial role creates conflicting incentives, then assume the box is checked. A role that looks credible on paper can fail under scrutiny.
Representative, DPO, or both: three common profiles
Facts decide the answer, not job titles. Three typical cases show how the two questions separate:
- A B2B software company with a modest EU customer base. It targets EU customers and has no EU establishment, so Article 27 likely applies. Its processing is ordinary customer and contact data, so a DPO is usually not mandatory.
- A digital health platform serving EU patients at scale. Without an EU establishment it needs an EU Representative, and large-scale processing of health data as a core activity points directly to a DPO. It may well need both.
- A small business with occasional EU orders and limited data. It should document whether the narrow Article 27 exemption genuinely fits, and it will often conclude that a DPO is not required.
Can one provider handle both roles?
Sometimes an external provider can support both functions, but the roles must remain clearly separated. The Article 27 Representative needs an EU establishment and must be formally designated to represent the non-EU controller or processor. A DPO must be able to act independently and cannot be placed in a position that determines the purposes and means of processing.
The GDPR does not contain a blanket rule that the same organization can never perform both functions, but combining them needs care. Where one person or provider is expected to advise, monitor, represent, and respond, you have to assess whether that mix compromises the DPO's independence. Combining the roles also does not relax either set of requirements: you still need a proper Article 27 designation and a DPO structured to meet Articles 37 to 39.
For a company that needs both, the documentation, public contact details, and operational workflows should make the distinction clear. Authorities should know where to direct Article 27 communications. Employees should know when to escalate a matter to the DPO. Data subjects should not be left guessing whether they are contacting a representative, privacy team, or support inbox.
This is also why a generic “EU privacy contact” is often inadequate. It can conceal role confusion rather than resolve it. For many non-EU companies the cleaner approach is to keep the appointments separate: designate a representative to satisfy Article 27, then decide the DPO question on its own facts, instead of asking one appointment letter to solve two different problems.
What each role changes in daily operations
An EU Representative has to be ready for the moments that create exposure: an authority inquiry, a data subject access request, a deletion request, a complaint, or a security incident involving EU personal data. That only works if the representative holds accurate contact details for the right internal owners and there is a defined escalation path on your side.
A DPO should influence decisions before those moments occur. That includes reviewing high-risk processing, advising on privacy notices and retention practices, challenging weak data governance, and taking part in impact assessments. The DPO is not there to rubber-stamp product launches. A credible DPO spots risk early, while a contract change or product design decision is still inexpensive to fix.
A simple way to remember it: the representative is built for the day a message arrives from Europe; the DPO is built for the months before it, when the decisions that message will ask about are made.
A practical decision path for US businesses
Start with your EU footprint. Ask whether you have an office, branch, employees, or another stable establishment in the EU. If you do, Article 27 may not apply, though other GDPR obligations still do. If you do not, determine whether you offer goods or services to EU individuals or monitor their behavior. Do not wait for an authority letter or a stalled enterprise deal to ask.
If the answer is yes, assess the narrow Article 27 exemption carefully. Look at the frequency of processing, data categories, scale, and likely risk to individuals. For most businesses with recurring EU customers or users, appointing an EU Representative is the safer operational choice.
Then assess DPO triggers separately. Does your core business regularly monitor people at scale? Do you process health, biometric, political, religious, or other sensitive data at scale? Are you operating in a regulated sector where customer contracts or risk profiles make independent privacy oversight commercially necessary? Those facts may point to a DPO requirement or a prudent voluntary appointment. Answer them from your actual operations, not a generic online checklist.
Next, build the operating model. On the Article 27 side that means a signed designation letter, a published contact channel, and direct access to people in your company who can gather facts and authorize action. On the privacy side, whoever leads the function, whether a required DPO, a voluntary DPO, or another qualified privacy lead, needs clear ownership of policies, vendor controls, retention, incident response, and high-risk processing decisions.
Finally, test the process under pressure. If a German authority contacts your company tomorrow, who receives the notice? Who decides what must be produced? Who manages the response deadline? If an EU user sends a deletion request, does it reach a team that can verify identity, locate data, preserve necessary records, and respond lawfully? The formal appointment is necessary, but response capability is what protects the business when the message arrives.
Why the distinction matters in procurement and enforcement
Article 27 failures are easy to see. A buyer reviewing your privacy notice can see whether you have identified an EU Representative. A regulator can see whether the named contact is real, reachable, and authorized. A DPO designation does not cure a missing Article 27 appointment when Article 27 applies.
Due diligence questionnaires often ask both questions side by side, for different reasons. An EU customer asks who your Article 27 representative is because it wants proof that EU individuals and regulators can reach you locally. It asks whether you have a DPO because it is assessing your privacy governance. Answering the first question with your DPO's email address, or publishing a privacy notice that names a DPO but says nothing about Article 27, signals the gap rather than closing it. Buyers do not want to educate vendors on their own GDPR gaps.
Likewise, an Article 27 Representative cannot paper over an organization that needs a DPO but has no independent privacy oversight. The risk is not only a fine. It can mean delayed enterprise deals, difficult security reviews, poor incident handling, and a record that suggests privacy governance was treated as a formality.
For non-EU companies, Article 27 is often the first visible proof that the business is prepared to operate under the GDPR. Services such as rep4eu are built for that role: EU representation held by a registered German company with German-admitted lawyers on the team, forwarding inquiries promptly to a named contact and with legal support available separately, rather than an anonymous overseas inbox.
The right move is to separate the questions before a customer, regulator, or incident forces the issue: establish whether you need an EU Representative, assess whether your processing requires a DPO, and make sure both roles can function when the stakes are no longer theoretical.
Frequently asked questions
Our company is incorporated in Delaware and hosts its data in the US. Can Article 27 still apply?
Yes. Article 3(2) looks at whether you offer goods or services to people in the EU or monitor their behavior, not at where you are incorporated, where your servers are, or whether you have European employees.
Is our CTO, general counsel, or privacy lead automatically our DPO?
No. Having a privacy lead, a security leader, or outside counsel is not the same as having a DPO. Someone who determines the purposes and means of processing, such as a CTO or head of marketing, is usually poorly placed to hold the title because of the conflict of interest.
Does the DPO have to be based in the EU?
The establishment requirement in Article 27 applies to the representative, not the DPO. What matters for a DPO is that it is easily accessible to individuals, authorities, and your own teams, and has the expertise and independence the role requires. Check current supervisory authority guidance before appointing a DPO outside the EU.
Should both roles appear in our privacy notice?
If you have both, list each one separately, with its own contact details and a clear label. That way authorities and individuals know which channel handles what, and Article 27 correspondence does not land in the DPO's inbox by default.
Does the EU Representative answer the regulator or draft our responses?
The representative receives authority and data subject communications, logs them, forwards them promptly to your named contact, and coordinates with the authority on the process. The substantive response stays with your company. With rep4eu, legal advice and drafting are not part of the subscription; legal support is available as a separate engagement.