EU representative for Canadian companies.
All 27 states.

Who in Canada is in scope of GDPR Article 27

A company established only in Canada falls under the EU GDPR through Article 3(2) when its processing relates to one of two activities:

• Offering goods or services to people in the EU, whether or not they pay. Recital 23 asks whether you envisage offering goods or services to people in one or more member states. It names two signals: using a language or currency of a member state with the possibility of ordering in that language, and mentioning customers or users in the EU. A website or email address that people in Europe can reach is not enough on its own. The EDPB’s Guidelines 3/2018 on territorial scope add further factors, such as offering delivery of goods to EU member states and marketing campaigns aimed at an EU audience.
• Monitoring the behaviour of people in the EU, as far as that behaviour takes place in the Union. Recital 24 refers to tracking people on the internet, including profiling to analyse or predict their preferences. The EDPB’s guidelines give behavioural advertising, geo-localisation for marketing purposes and online tracking through cookies or similar techniques as examples; whether analytics counts as monitoring depends on its purpose, in particular any later profiling.

The test looks at where the people are, not at their nationality. A Canadian company that serves a French-speaking market in Quebec is not targeting the EU just because France and Belgium also speak French. If the same company prices in euros, ships to France or markets to European users, the picture changes.

A Canadian company within Article 3(2) must designate, in writing, a representative established in the EU under Article 27(1). For a private company, the exemption in Article 27(2)(a) covers only processing that is occasional, does not include large-scale processing of special-category or criminal-offence data, and is unlikely to result in a risk to people’s rights and freedoms. Article 27(2)(b) separately exempts public authorities and bodies. A company that serves EU customers as a normal part of its business rarely meets the “occasional” condition.

Typical Canadian companies that need an EU representative

• A Toronto SaaS company that sells self-serve subscriptions directly to people in Germany and the Netherlands, priced in euros, and handles their account and billing data itself.
• A Vancouver ecommerce brand that ships to EU addresses and runs advertising campaigns aimed at European shoppers.
• A Montreal mobile game studio whose games are offered to players in EU countries in their own languages and use advertising identifiers to profile them for targeted ads.
• An online education platform that markets its courses to students in EU countries, for example in their languages or with prices in euros, and enrols them.

Selling only to businesses does not by itself take a company outside the GDPR: the contacts and users at those businesses are individuals whose data the GDPR protects. Neither the GDPR nor the EDPB expressly settles whether a B2B offer counts as offering services to people in the EU under Article 3(2)(a), so the cautious approach is to treat it as in scope; monitoring of EU users under Article 3(2)(b) applies regardless. Where the company is the controller, Articles 13(1)(a) and 14(1)(a) require the representative’s identity and contact details in its privacy notice.

PIPEDA, Quebec Law 25 and the EU GDPR

Canadian privacy law and the EU GDPR apply side by side; compliance with one does not discharge the other.

• PIPEDA governs how private-sector organisations collect, use and disclose personal information in the course of commercial activities in most of Canada. Alberta, British Columbia and Quebec have private-sector laws deemed substantially similar, which generally apply instead of PIPEDA to activity within those provinces. PIPEDA still applies to personal information that crosses provincial or national borders.
• Quebec’s Law 25, adopted in 2021, amended Quebec’s Act respecting the protection of personal information in the private sector in stages, on 22 September 2022, 2023 and 2024. Among other things, section 3.1 of that Act makes the person with the highest authority in the business responsible for the protection of personal information; that function can be delegated in writing.

None of these laws contains an EU representative duty, and none of their roles can fill it. Article 27(3) requires the representative to be established in an EU member state where the affected individuals are. A privacy officer in Canada, including Quebec’s person in charge, does not meet that condition.

Canada also has an EU adequacy decision, Commission Decision 2002/2/EC of 20 December 2001, covering recipients subject to PIPEDA. The European Commission’s report of 15 January 2024 on its review of existing adequacy decisions (COM(2024) 7) concluded that Canada continues to provide an adequate level of protection. Adequacy allows personal data to be transferred from the EU to those organisations without additional safeguards. It is about transfers, so it does not exempt a Canadian company that targets or monitors people in the EU from Article 27.