A US company can have no office, employees, or legal entity in Europe and still face a direct GDPR compliance obligation. That is the central issue in US to EU compliance: if your business targets or monitors people in the EU, the absence of an EU location does not remove your regulatory exposure.
For many US SaaS companies, ecommerce brands, app developers, adtech vendors, and online platforms, the missing requirement is GDPR Article 27. It requires certain non-EU organizations to appoint an EU Representative. This is not a decorative mailing address for a privacy policy. It is a formal legal role intended to give EU data subjects and supervisory authorities a reachable, accountable contact within the Union.
When a regulator, customer procurement team, or privacy-conscious buyer sees that role is absent, the problem becomes visible quickly. Deals slow down. Data subject requests risk being mishandled. An authority inquiry lands with a US team that may not understand the procedural expectations or response deadlines. The right response is not to add an address and hope for the best. It is to establish a representation arrangement that can function under pressure.
When US to EU Compliance Triggers Article 27
Article 27 applies when a company without an establishment in the EU falls within the GDPR's territorial scope under Article 3(2). In practical terms, this commonly happens in two situations: your company offers goods or services to individuals in the EU, or it monitors their behavior.
Offering services does not require charging in euros or translating your website into every EU language. The analysis looks at your conduct. Are you shipping products to EU countries? Advertising to customers in France, Germany, or Spain? Letting EU users create accounts and subscribe? Accepting EU addresses, pricing for EU markets, or maintaining country-specific marketing campaigns? Those facts can show that your business is targeting the EU rather than merely being accessible from it.
Monitoring is equally broad. Behavioral advertising, analytics tied to identifiable users, location tracking, profiling, device fingerprinting, and activity-based personalization can all raise the issue. A US business that uses EU user data to predict preferences or deliver targeted advertising should not assume it is outside the GDPR simply because its servers are in the United States.
There is a narrow Article 27 exception for processing that is occasional, unlikely to create a risk to individuals' rights and freedoms, and does not involve large-scale processing of sensitive data or criminal-offense data. Every part of that test matters. A growing SaaS platform with recurring EU users, a consumer app with ongoing analytics, or an ecommerce business processing EU customer orders will often struggle to call its processing occasional.
The exception is not a shortcut for businesses that would prefer not to appoint a representative. It is a fact-specific legal assessment. If your company relies on it, it should be able to explain exactly why.
What an EU Representative Actually Does
A valid EU Representative is appointed in writing and acts on behalf of the non-EU controller or processor for GDPR compliance purposes. The representative must be established in an EU member state where the relevant data subjects are located. In most cases, a single representative can cover activity across all 27 EU member states.
The representative's contact details must be made available to EU data subjects and supervisory authorities, typically through the privacy notice. That visibility is deliberate. The EU wants a practical point of contact that is within its jurisdiction and can receive communications without delay.
A serious Article 27 service should do more than receive mail. It should be prepared to assess what has arrived, identify the legal and operational deadline, route the issue to the correct client contact, and coordinate an appropriate response. That matters because the communications that arrive are rarely routine when they matter most.
For example, a data subject may request access, deletion, or a copy of their personal data. A supervisory authority may ask for information about a complaint. A customer may flag a security incident involving EU user data. Each issue creates different obligations, evidence requirements, and timing risks. Forwarding an email without context is not legal readiness.
An EU Representative is not the same as a data protection officer. A DPO has a distinct statutory function and independence requirements. It is also not a substitute for a GDPR program. Your business still needs a lawful basis for processing, appropriate vendor arrangements, security measures, privacy disclosures, data transfer safeguards, and a process for handling individual rights. The representative fills a specific gap: EU-facing legal representation for an organization that has no EU establishment.
The Cost of Treating Representation as a Mailbox
Commodity providers often sell an EU address at a low price and position it as complete compliance. That approach may be sufficient only until someone actually uses the address. At that point, the difference between a mailbox and a legal representative becomes obvious.
A passive forwarding service may not recognize whether an authority letter requires urgent action. It may not know how to distinguish a valid access request from a request that needs identity verification. It may not help coordinate communications after an incident or explain what information a regulator is asking for. The risk does not disappear because an email was forwarded to a shared inbox.
For US companies, this is also a commercial issue. Enterprise procurement teams increasingly ask who serves as the EU Representative, where that representative is established, and whether the arrangement is documented. A vague answer creates doubt about the rest of the privacy program. A credible answer demonstrates that the company has addressed a known cross-border requirement with a service built to respond.
The goal is not to manufacture a paper trail. It is to create a reliable response path before an inquiry, complaint, or deal-blocking questionnaire arrives.
A Practical Article 27 Readiness Process
The fastest way to resolve uncertainty is to review the actual data flows and market activity, not just the company headquarters. Start by identifying whether EU individuals can use your product, buy from you, receive your marketing, or be tracked through your website or app. Then identify whether the business acts as a controller, a processor, or both. Many B2B vendors are processors for customer data but controllers for their own sales, marketing, billing, support, and website analytics data.
Next, document the decision. If Article 27 applies, appoint an EU Representative through a signed written designation. Update the privacy notice with the representative's details and make sure internal teams know where to send incoming EU requests. Your support, security, legal, and privacy teams should not be discovering the process after a complaint arrives.
A workable onboarding process should cover four operational points:
- Confirm the relevant legal entities, processing roles, and EU-facing products.
- Execute the representative designation and retain it with your privacy documentation.
- Add the representative's contact details to the appropriate privacy notices.
- Establish escalation contacts for data subject requests, authority inquiries, and security incidents.
The exact scope depends on your business. A startup selling a simple software product may need a lean implementation. A platform processing employee data, health-related information, financial data, or behavioral profiles needs greater scrutiny. If your organization has multiple brands or entities, do not assume one appointment automatically covers all of them. The legal entity collecting or processing the data matters.
Representation Should Be Ready for Enforcement, Not Just Onboarding
A useful EU Representative relationship is defined by what happens after the designation is signed. Can the representative receive and triage a request in a way that preserves deadlines? Can it communicate substantively with an authority? Does it understand the distinction between a customer contract issue and a GDPR rights request? Can it coordinate with US counsel, security teams, and decision-makers when a potential breach requires a rapid assessment?
Those questions separate legal representation from administrative forwarding. They also explain why lawyer-led coverage is valuable. A representative does not take over your legal obligations, and Article 27 does not erase your company's exposure. But an experienced representative gives your business an informed EU-side response channel when the stakes are highest.
rep4eu provides Article 27 representation through licensed German attorneys, with formal designation documentation and support for authority inquiries, data subject requests, incident coordination, and ongoing readiness. For a US company without an EU establishment, that is the difference between listing a contact and having someone prepared to act.
One final point deserves attention: EU GDPR coverage and UK GDPR coverage are not interchangeable. The United Kingdom is no longer an EU member state and has its own representative requirement for qualifying non-UK organizations. If you target users in both markets, assess both obligations rather than assuming one appointment solves everything.
The best time to establish EU representation is before an EU prospect asks for it, before a data subject tests your response process, and before a regulator needs an answer. Article 27 is a manageable requirement when treated as an operational legal function. It becomes expensive when it is treated as an address field.