If you're a US company collecting signups from Germany, running retargeting ads in France, or analyzing app behavior from users in Spain, the question is not academic. Do I need an EU representative is a live compliance issue under GDPR Article 27, and the wrong answer can leave your business visibly out of step with EU law.
Many companies assume this only applies to large multinationals with offices overseas. It doesn't. Article 27 is aimed squarely at non-EU businesses that process personal data of people in the EU while lacking an establishment there. That includes SaaS companies, ecommerce brands, app businesses, agencies, and B2B vendors serving EU customers from the US.
When do I need an EU representative under GDPR?
The short answer is this: you may need an EU representative if your business is outside the EU, you do not have an EU establishment, and your processing falls within the territorial scope of the GDPR under Article 3(2).
That scope is broader than many founders expect. If you offer goods or services to people in the EU, or monitor their behavior, GDPR can apply even if your company is based entirely in the US. Article 27 does not create that reach on its own. It sits directly behind Article 3(2): once that provision catches your processing, the representative requirement follows unless a narrow exemption applies.
Both triggers turn on where people are, not on their nationality. The GDPR looks at people who are in the EU when the offering or monitoring takes place. A French citizen using your product from New York is not the same case as a US citizen using it while in France.
Offering goods or services to people in the EU
Offering goods or services does not require a warehouse in Europe or a local subsidiary, and it does not require payment. A free app, trial account, waitlist, newsletter, marketplace account, or ad-supported platform can all count as a service.
What matters is whether you intentionally direct the offering at people in one or more EU member states. Typical signals include EU countries in your checkout, prices in euros, local payment methods, delivery to EU addresses, local-language landing pages, EU customer support, contracts written for EU customers, and campaigns aimed at European audiences. None of these facts is necessarily decisive alone. Together, they can show that your business is not merely accessible from Europe but actively pursuing users there.
A website that can be reached worldwide is not enough by itself. A US-only business that receives an isolated, unsolicited signup from France sits in a different position from a software provider running paid campaigns in Germany and Spain. The reverse also holds: an English-only site is not automatically out of scope if you ship to the EU, sign EU customers, or otherwise welcome them.
Monitoring the behavior of people in the EU
Monitoring behavior can be just as common, and it often applies before a person ever becomes a customer. Behavioral advertising, cross-site tracking, retargeting, location-based profiling, device fingerprinting, and analytics that build profiles of individual users can all bring you into scope.
Calling a tool "analytics" does not end the inquiry. Basic aggregate traffic counts present a different picture from technology that follows an identifiable user's preferences, movements, or purchases over time. Look at what data is collected, whether users can be singled out, how long identifiers persist, whether the data is combined with other records, and whether the output influences advertising, pricing, or other decisions.
If either trigger describes your business and you have no EU office or branch that qualifies as an establishment, Article 27 is the next question.
The three-part test most US companies should use
A practical way to assess this is to work through three issues.
First, are you established outside the EU? If your legal entity, operations, and management are in the US and you do not have a genuine EU establishment, this part is usually straightforward. Be precise about what counts. A stable and effective arrangement in the EU, such as a staffed office, a branch, or a long-term sales operation, can qualify even if it is small. In that case your processing may fall under Article 3(1) instead, and the establishment question replaces the representative question, while the rest of the GDPR still applies. EU customers, remote sales, or a contractor in Europe do not create an establishment by themselves.
Second, are you processing personal data of individuals in the EU in a way covered by GDPR Article 3(2)? If you are selling to EU customers, onboarding EU employees or contractors through a platform, running marketing campaigns toward EU audiences, or tracking user behavior inside the EU, the answer may be yes. Remember that personal data is broader than names and email addresses. Account identifiers, IP addresses, cookie and device IDs, location data, support tickets, and billing records all count. Your role matters too: Article 27 can apply whether you decide why data is used as a controller or handle it for clients as a processor, so a non-EU vendor serving EU-facing customers should check whether it needs its own representative rather than assume the customer carries the whole burden.
Third, do any narrow exemptions apply? This is where some businesses overestimate their safety.
The exemption is narrower than it looks
You may not need an EU representative if your processing is occasional, does not include large-scale processing of special category data or criminal offense data, and is unlikely to result in a risk to the rights and freedoms of individuals.
That is a stacked test, not a menu. Failing any one condition defeats the exemption. You do not get it because your business is small or because your EU revenue is limited. If you regularly collect lead data, run analytics, maintain customer accounts, or support recurring subscriptions for EU users, calling that processing occasional is often a stretch. "Occasional" is about how regularly processing happens, not how many EU users you have: a recurring subscription service with a small EU base still processes their data every day.
Special category data raises the stakes further. Health information, biometric data used for identification, political opinions, religious beliefs, and data about sex life or sexual orientation are examples, and criminal offense data is protected separately. Wellness apps, HR tools, identity products, insurance-related services, and screening providers can encounter these categories sooner than they expect and should not rely on the exemption without a fact-specific assessment.
The risk condition is broader than breach risk as well. Profiling, tracking, large volumes, vulnerable users such as children, and decisions with real effects on people all push the risk level up.
For many growth-stage companies, the reality is simple. If EU personal data touches your normal operations, the exemption becomes hard to defend.
One separate carve-out exists: Article 27 does not apply to public authorities or bodies. For commercial US companies, that exclusion is rarely relevant.
Common scenarios where the answer is yes
A US SaaS company with EU trial users often needs an EU representative. So does a Shopify store shipping to several EU countries. A mobile app that tracks usage, crash reports, location, or ad performance for EU users may need one as well, especially if it relies on SDKs, advertising identifiers, or behavioral analytics for growth and retention. A recruiting platform screening EU candidates belongs on the same list. B2B businesses are not exempt just because they sell to companies rather than consumers. If they process contact details, user accounts, or usage data tied to individuals in the EU, GDPR can still apply.
The same goes for companies that say, "We don't actively market in Europe, but EU users sign up anyway." That may still create GDPR exposure, depending on the facts. If your site is clearly accessible in the EU and your business accepts those customers on an ongoing basis, regulators may look beyond your intent statement and focus on your actual conduct.
Common scenarios where the answer may be no
Some businesses truly sit outside Article 27. If you do not target the EU, do not monitor individuals there, and occasionally receive an unsolicited inquiry from an EU resident without pursuing that market, you may not be in scope.
There are also businesses with an actual EU establishment that may not need a separate Article 27 representative because they already have a real presence in the Union. But this is a legal and factual question, not a branding question. A contractor, reseller, or virtual office in Europe does not automatically count as an establishment.
This is where companies get into trouble by relying on informal assumptions. "We have a partner in Amsterdam" is not the same as having an EU establishment for GDPR purposes.
Mistakes that lead to the wrong answer
Most wrong conclusions come from looking at the wrong facts rather than misreading the law.
- Looking only at signed customers. Your pre-sales stack may be the bigger source of exposure. Advertising pixels, product analytics, demo requests, webinar registrations, downloadable content, and recruitment portals can all involve personal data from people in the EU.
- Reasoning from incorporation. Being a Delaware or California company says nothing about whether your website, app, ads, and customer journeys are aimed at the EU. The analysis follows what your business does, not where it is registered.
- Treating it as a privacy policy edit. Adding a name and address to your notice is not the same as appointing a representative. Article 27 requires a written designation, and disclosure without one leaves a visible gap.
- Stretching the exemption. Teams describe their EU processing as occasional while running analytics, CRM workflows, onboarding, and retention campaigns that touch EU individuals every week.
- Deciding inside one team. Legal, product, marketing, sales, security, and data teams each hold part of the answer. An assessment made by one of them alone tends to miss tracking tools, campaigns, or data flows the others know about.
Why Article 27 matters more than many teams think
Some privacy obligations sit quietly in the background until a deal desk or regulator surfaces them. Article 27 is different because the gap is easy to spot.
Your privacy notice is supposed to identify your EU representative where required. Procurement teams notice when that information is missing. Privacy-conscious customers notice. Supervisory authorities can notice too.
In practice, the requirement often surfaces in a sales cycle rather than a legal review. A European prospect sends a vendor questionnaire, procurement asks for the name and address of your EU representative, and the team discovers that a designation has to be signed, a privacy notice updated, and an owner found for regulator communications, all while the deal waits. Even when a buyer accepts a remediation plan, you are negotiating from a weaker position.
That makes Article 27 a visible compliance issue, not just a theoretical one. It can slow enterprise sales, create friction in diligence reviews, and raise uncomfortable questions during incident response or data subject requests. Failing to appoint a representative where one is required can also lead to administrative fines under the GDPR; for certain Article 27 failures they can reach up to €10 million or 2% of worldwide annual turnover, whichever is higher, depending on the circumstances. If your company is in scope and has no representative, you are signaling that a basic GDPR requirement has been ignored.
What an EU representative actually does
An EU representative is not just a postal address. Under Article 27, the representative is designated in writing, acts on your behalf regarding your GDPR obligations, and serves as a point of contact for supervisory authorities and data subjects on issues related to processing. It must be established in an EU member state where the individuals whose data you process are located, and its details belong in your privacy notice.
That distinction matters. A bare address may receive notices, but receiving a notice is not the same as logging it, recognizing deadlines, routing it to the right owner on your team, and keeping the authority or data subject informed while you respond. Access and deletion requests, authority inquiries, and incident-related contact all depend on that handling.
For a US company without in-house EU privacy infrastructure, that difference is operationally significant. If an authority inquiry arrives, or a data subject complaint escalates, you want a reliable process in place, not passive forwarding into a crowded inbox. Your own team or counsel still decides and drafts the substance of the response.
What the representative does not do is take over your compliance. Your company remains responsible for meeting the GDPR, and appointing a representative does not turn a noncompliant data practice into a compliant one or remove the possibility of action against you. It gives the EU a practical route to reach you.
What else applies once you are in scope
Article 27 is often the first visible requirement, but once Article 3(2) catches your processing, the core GDPR obligations apply as well, scaled to the nature and risk of what you do. The representative covers none of them:
- Privacy notice. It must explain who the controller is, how to reach the EU representative where required, which data you collect, why, on what legal basis, for how long, who receives it, where it is transferred, and which rights people have. It should describe your real data flows, not a template copied from a competitor.
- Lawful basis. Every processing purpose needs one. Contract may support account administration, legitimate interests may support certain security or fraud-prevention uses, and consent may be required for non-essential cookies or certain direct marketing. A broad consent checkbox is not a substitute for analyzing each purpose.
- Rights requests. Controllers generally must respond to access, correction, deletion, restriction, portability, and objection requests within one month, which takes a documented way to verify identity and locate data across systems. The data subject request guide covers the workflow.
- Retention. Keep personal data for a defined period tied to a real purpose. Keeping it "just in case" is difficult to justify.
- Vendors. Cloud hosts, CRM platforms, payment providers, analytics vendors, and support tools that process data for you need written processor terms under Article 28.
- International transfers. Data moving from the EU to the US or another third country needs a valid transfer mechanism. An Article 27 representative is not a transfer mechanism, and one does not replace the other.
- Security incidents. If a personal data breach is likely to create risk to individuals, the controller may need to notify the competent supervisory authority within 72 hours of becoming aware of it, and affected individuals as well where the risk is high.
Higher-risk processing may also require a data protection impact assessment before it begins. A strong US privacy program helps, but it is not a substitute: state privacy laws and the GDPR differ in scope, legal bases, individual rights, international transfers, and enforcement structure.
Do I need an EU representative if I already have a DPO?
Possibly, yes. A Data Protection Officer and an EU representative are different roles.
A DPO has a defined oversight function under GDPR and is required only in certain cases. An EU representative is required under Article 27 for many non-EU organizations in scope, even when a DPO is not required. Having outside counsel, privacy software, or a US-based compliance lead does not replace the representative requirement either.
This is a common point of confusion because companies treat every GDPR role as interchangeable. Regulators do not.
How to make the decision without overcomplicating it
If your business is outside the EU, has no real EU establishment, and knowingly sells to, markets to, or tracks people in the EU, your default assumption should be that Article 27 deserves immediate review. If your processing is ongoing rather than rare, and if it supports revenue, product analytics, advertising, or customer operations, the exemption may be weak.
A defensible assessment rests on how the business actually operates. A workable sequence looks like this:
- Document where your users are and which products, campaigns, and channels reach the EU, including free users, trial accounts, leads, and website visitors.
- Map the personal data involved: website tracking, customer accounts, support requests, billing records, and app telemetry.
- Identify whether you act as controller, processor, or both for each activity.
- Test each activity against Article 3(2): is it a directed offer to people in the EU, or monitoring of their behavior there?
- Apply the exemption as a strict legal test, not a business preference, and get advice where the facts are close.
- Keep a written record of the result. It helps you explain your position to customers, auditors, and supervisory authorities.
At that point, the practical question is not whether you can argue your way out of the requirement. It is whether that argument would survive scrutiny from procurement, privacy counsel, or an authority.
If the answer points to Article 27, appoint a representative before your next EU launch, campaign, or customer questionnaire, and before you publish the updated privacy notice. Make sure the representative's details are correct and that sales, support, security, and legal know the escalation path when a request arrives. Test that path with a mock access request and a mock authority inquiry: if it depends on one employee recognizing a legal issue in a crowded inbox, it is not ready.
A credible EU representative closes that gap quickly. More importantly, it gives your business an accountable point of contact inside the EU rather than a placeholder address. That is why many companies look for a provider such as rep4eu, a registered German GmbH with German-admitted lawyers on the team, that holds and signs the designation and forwards, logs, and coordinates incoming GDPR communications, once they realize Article 27 is not just a paperwork issue.
If you're asking do I need an EU representative, you are already close to the line where waiting becomes its own risk. The smart move is to assess the facts honestly and fix the exposure before someone else spots it for you.
Frequently asked questions
Is there a minimum number of EU customers or amount of revenue before Article 27 applies?
No. The GDPR sets no revenue threshold or minimum user count for this requirement. A modest but deliberate EU customer base, or ongoing tracking of EU visitors, can be enough.
Does an English-only website or pricing in US dollars keep us outside the GDPR?
Not on its own. Language is one signal among many, and shipping to the EU, contracting with EU customers, or running campaigns aimed at EU audiences can still show that you target the EU market. Charging in US dollars does not remove the risk either. The practical test is whether a reasonable observer can see that the business intends to serve people in the EU.
Do we need a representative in every EU country where we have users?
No. The representative must be established in one of the member states where the people whose data you process are located, and a representative established in one EU state can generally serve as the required contact point across the Union.
Does an EU representative also cover the UK?
No. The UK has its own GDPR framework and may require a separate UK representative for organizations without a UK establishment. An EU representative does not satisfy the UK requirement, and a UK representative does not satisfy Article 27.
Can a cookie banner or privacy policy replace the appointment?
No. Both are separate obligations. Article 27 is met only by designating a representative in writing and naming it in your privacy notice.
Does the representative become liable for our GDPR compliance?
No. Article 27 does not transfer your obligations or make the representative your controller or processor. Your company stays responsible for its processing, and authorities can still act against it directly.