Article 27 Is a Revenue Risk If Ignored
If you sell into the EU while processing EU personal data, Article 27 is not optional.
Missing representation can escalate from a compliance gap to a public enforcement event
that creates legal, procurement, and trust risk at the same time.
🎯 Common Triggers
- SaaS products used by EU customers
- Ecommerce businesses shipping to the EU
- Lead-gen websites with EU traffic analytics
- Any recurring processing of EU personal data
⚡ Representative Duties
- Be reachable by supervisory authorities
- Be reachable by EU data subjects
- Coordinate formal GDPR communications
- Support production of required records
- Route requests to your internal privacy team
📋 Article 27: EU Representative
"Controllers or processors not established in the Union shall designate in writing
a representative in the Union."
This is a mandatory requirement, not optional. The representative serves as your point of contact
for supervisory authorities and data subjects.
💰 Enforcement Risk
- Fines up to €20M or 4% of global annual turnover
- Regulatory inquiries and remediation orders
- Operational delays in EU go-to-market
- Commercial trust risk with enterprise buyers
Why this matters for revenue and trust
Buyers, partners, and legal teams increasingly check GDPR posture during procurement. Enforcement outcomes are often public,
and GDPR Article 83 allows fines up to EUR 20 million or 4% of global annual turnover for serious infringements.
Delay can become a legal, brand, and revenue event — not just a legal memo.
Why US Companies Move Fast
EUR 20M / 4% GDPR Article 83 maximum exposure for serious violations
EUR 525K Dutch DPA fine linked to missing EU representative (Locatefamily.com)
EUR 225M Irish DPC WhatsApp decision demonstrating large-scale GDPR enforcement
Trustworthy Sources (Primary Law, Regulators, and .gov)
Sources below prioritize official legal text, data protection authorities, and US government publications.
Recent Enforcement Signals
Who Falls Under the GDPR From Outside the EU
Article 27 only matters once the GDPR applies to you. For a company without an establishment in the EU,
that happens under Article 3(2) in two situations: it offers goods or services to individuals in the EU,
or it monitors their behavior. Physical presence is not the test; what you actually do is.
Offering goods or services
Payment is not required. A free app, free trial, newsletter, waitlist, webinar, marketplace account or
ad-supported service can still count if it is directed at people in the EU. Nor do you have to charge in
euros or translate your website into every EU language. The question is whether your conduct shows that
you are targeting the EU rather than merely being accessible from it.
Facts that can show targeting include shipping products to EU countries, pricing for EU markets, accepting
EU addresses, letting EU users create accounts and subscribe, running country-specific marketing campaigns
and offering country-specific customer support.
Monitoring behavior
Monitoring is equally broad. Behavioral advertising, tracking across sites or devices, profiling, location
tracking, device fingerprinting, activity-based personalization and analytics tied to identifiable users can
all raise the issue, in particular where the data is used to evaluate or predict individual preferences and
behavior.
Controller, processor, or both
Article 27 can catch controllers, which decide why and how personal data is used, and processors, which
handle it on behalf of someone else. Many B2B vendors are both: a processor for the data customers put into
the product, and a controller for their own sales, marketing, billing, support and website analytics data.
Either role can trigger the requirement depending on the facts. More on the processor side in
Does Article 27 cover processors?
A quick first check
Three questions get most companies to a first answer:
- Are you based outside the EU, with no establishment there?
- Do you sell to, market to, or support people in the EU, even indirectly?
- Do you monitor their behavior through cookies, pixels, device identifiers, product analytics or similar tracking?
If the answer to the first question is yes and to either of the others is yes, Article 27 needs a serious
review. The full walk-through is in Do I need an EU representative?,
and the difference between falling under the GDPR and being established in the EU is explained in
GDPR coverage versus establishment.
What Article 27 Requires
Once the GDPR applies to a controller or processor that is not established in the EU, Article 27 adds a
structural requirement: a named representative inside the Union.
- A written designation. The representative must be designated in writing. Keep the signed
document with your compliance records, and do not rely on an informal email exchange or an invoice as
proof of appointment.
- Established in the Union. The representative must be established in one of the member
states where the individuals whose data you process are located.
- A mandate on your behalf. The representative acts on your behalf with regard to your GDPR
obligations and can be addressed by supervisory authorities and data subjects on all issues related to
the processing.
- Visible contact details. Your privacy notice should identify the representative and give
their contact details, so individuals and authorities can reach them.
The privacy notice is often where a missing appointment first shows. A customer, procurement reviewer or
authority who reads it can see at once whether a representative is named.
The Narrow Exemption
Article 27 does not apply to processing that is occasional, does not include large-scale processing of
special categories of data or criminal offense data, and is unlikely to result in a risk to the rights and
freedoms of individuals. These conditions work together. Public authorities and bodies are also outside the
requirement.
The word "occasional" does most of the work. Routine sales to EU customers, user accounts for EU residents,
recurring campaigns into EU markets, a subscription service or continuous analysis of user behavior are hard
to describe as occasional, especially when the processing is tied to revenue, product analytics or ongoing
customer support.
Relying on the exemption is a fact-specific assessment, not a default. If your company relies on it, it
should be able to explain exactly why.
What the Representative Does, and What It Does Not
The representative exists so that there is a reachable, documented contact for GDPR matters inside the EU:
it receives inquiries from supervisory authorities and requests from data subjects and routes them to the
right people in your company. Just as important is what the role does not do.
Your company stays responsible
The representative does not replace the controller or processor and does not absorb your GDPR liability.
Your company remains accountable for lawful processing, transparency, security, vendor management and the
decisions behind every response. A representative cannot supply records your company does not keep or
vouch for practices it cannot support.
Not an establishment, not a DPO
Appointing a representative is not the same as opening an office in Europe; it does not create an EU
establishment. Nor is the representative a Data Protection Officer: a DPO has a separate role, separate
triggers and its own independence requirements. See
Article 27 vs DPO for how the two roles differ.
Not a substitute for the rest of the GDPR
An EU representative does not cure weak consent practices, unlawful transfers, poor retention controls or a
broken data subject rights process. You still need a lawful basis for processing, accurate privacy
disclosures, appropriate vendor arrangements, transfer safeguards, security measures and a working process
for individual rights. Naming a representative makes your compliance posture more visible, so the
documentation around it has to stand up to scrutiny too.
Article 27 Implementation Checklist
Use this practical sequence to reduce legal exposure and establish a defensible GDPR posture.
1) Validate Scope
- Map EU data flows and processing purposes
- Confirm there is no EU establishment acting as controller/processor
- Document why Article 27 applies (or why an exemption applies)
- Record the markets, user locations, campaigns and tracking that bring you into scope
- Identify the legal entity that actually acts as controller or processor
2) Appoint Representative
- Sign a written mandate
- Define authority and escalation process
- Set response SLAs for regulator and data-subject communications
3) Update Public Notices
- Add representative details to privacy notice
- Ensure contact channels are monitored
- Align DSR workflow with representative routing
- Show the representative's details in a clear, accessible place, not buried in a separate legal document
4) Stay Audit-Ready
- Maintain records of processing activities
- Keep incident response contacts current
- Review designation details at least annually
- Test how a data subject request, an authority inquiry and a security incident would be handled
What the written designation should contain
The designation should identify the represented entity, the one actually acting as controller or
processor, and clearly state the representative's authority to receive communications from data subjects
and supervisory authorities on its behalf. It should also define the covered processing, give effective
contact details and set out how urgent notices are escalated. A privacy notice that lists one company while
the designation covers another creates avoidable confusion. More detail:
the Article 27 designation letter.
Give the role an owner inside your company
Gather the inputs early: your legal entity details, a description of your processing, the EU countries where
affected individuals are located, and the privacy notice that will name the representative. Then name an
internal owner for the relationship, usually legal, privacy, compliance or a senior operations lead.
A designation is only credible if the representative can reach someone empowered to act. Give it named
contacts in privacy, legal, security and leadership rather than a generic inbox that goes unanswered over a
holiday weekend, and set internal service levels for acknowledging requests, collecting information,
approving responses and escalating material risks.
Requests, Authority Inquiries and Incidents
The appointment is tested when something arrives. Incoming communications need quick triage: telling a
routine request apart from regulator contact and sending the matter to the right internal owner. The
response decisions stay with your company.
Data subject requests
Set up a process for verifying identity, locating the relevant data, reviewing exceptions and responding
within the applicable time frame. GDPR requests generally require action without undue delay and, in many
cases, within one month. Complex requests can take longer, but the extension itself must be communicated
properly. For the full workflow, see the
data subject request guide.
Supervisory authority inquiries
A request for information from an authority may contain a deadline, demand documents or ask for a clear
explanation of your processing. Preserve the original request, identify the deadline, assign a response
lead and avoid improvising from incomplete facts. More in the
regulator inquiry response guide.
Security incidents
Article 27 does not create the 72-hour personal data breach notification rule, but an EU representative may
be central to coordinating communications when a breach affects people in the EU. Your incident plan should
say who decides whether notification is required, who communicates with affected individuals and how the
representative is involved.
Common Article 27 Mistakes
- Assuming the GDPR only applies once you open an EU office. The test is what you do with the
data of people in the EU, not where your company is based.
- Treating Article 27 as optional because EU revenue is small. Article 27 is not triggered by
revenue size alone, and small and midsize companies fall within it too.
- Assuming existing paperwork answers the question. A privacy policy, standard contractual
clauses or a compliance program built for another market help, but they do not tell you whether the GDPR
applies, whether Article 27 is triggered, or whether anyone can respond when the first EU request lands.
- Treating the appointment as the end of the work. The representative needs current contact
details, alignment with your privacy operations and a reliable path for requests and incidents. If no one
internally owns notices, records and escalation paths, the appointment stays on paper.
- Documents that do not match. If your privacy notice, records, internal response workflow and
representative details tell different stories, the gaps show quickly under scrutiny.
- Waiting for someone else to find the gap. Companies often act only when an EU prospect asks
in procurement or outside counsel spots the omission in due diligence. By then the gap can be holding up
revenue or increasing legal exposure.
For the wider list of compliance blockers, see
top GDPR compliance blockers.
