Who needs an EU representative under GDPR Article 27?

A controller or processor with no establishment in the EU that falls under Article 3(2) GDPR, because it offers goods or services to people in the EU (paid or free) or monitors their behaviour in the EU, must designate a representative in the EU in writing (Article 27(1)). Public authorities are exempt, and so is processing that meets all three parts of the Article 27(2)(a) exemption.

What is the exemption for occasional processing?

Article 27(2)(a) exempts processing that is occasional, does not include large-scale processing of special category data (Article 9(1)) or criminal offence data (Article 10), and is unlikely to result in a risk to people's rights and freedoms. The EDPB says processing is occasional only if it is not carried out regularly and occurs outside the regular course of business. All three parts must be met.

Does having a website that people in the EU can open mean GDPR applies?

No, not by itself. Recital 23 GDPR says the mere accessibility of a website, an email address or other contact details, or a language generally used in your own country, is not enough. Signs such as a language or currency of an EU Member State with the option to order in it, or mentioning customers in the EU, can show you are offering services to people in the EU.

Can our external DPO also be our EU representative?

The EDPB says no. In Guidelines 3/2018 on territorial scope it does not consider the function of EU representative compatible with the role of an external data protection officer established in the EU, because the representative acts under the instructions of the business it represents while a DPO must act independently.

Where must the representative be based?

In one of the Member States where the people whose data you process are (Article 27(3)). Where a significant share of them are in one Member State, the EDPB recommends, as good practice, choosing that Member State, while the representative stays easy to reach for people elsewhere in the EU.

Selling to EU customers from outside the EU? A GDPR Article 27 check sheet: do you need an EU representative?

Updated 24 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished EU representative check sheet for businesses based outside the EU: an eight-signal targeting test, the three-part exemption test, a 10-column sheet with one row per service and a result formula, three filled example rows, a written mandate checklist and the privacy notice line to add.

Short answer: if you have no office in the EU but offer goods or services to people in the EU, or track their behaviour there, GDPR applies to that processing (Article 3(2)) and you must name an EU representative in writing (Article 27(1)), unless your processing is occasional, involves no large-scale health or criminal data, and is unlikely to create a risk. A website people in the EU can open is not enough on its own.

Step 1: are you offering services to people in the EU?

Recital 23 and the EDPB guidelines list signs of intent. One sign alone may not be enough; weigh them together. Mere accessibility of your site, an email address, or a language generally used in your own country does not count.

Signal	Source	Answer
Prices or checkout in euro or another EU currency, with the option to order	Recital 23; EDPB 3/2018 section 2	Y / N
Website or app in a language of an EU Member State that is not generally used in your own country, with the option to order in it	Recital 23; EDPB 3/2018 section 2	Y / N
Customers or users in the EU mentioned on your site, case studies or testimonials	Recital 23; EDPB 3/2018 section 2	Y / N
Ads, search ads or campaigns aimed at an EU country audience	EDPB 3/2018 section 2	Y / N
An EU country domain (.de, .fr) or neutral domain such as .eu	EDPB 3/2018 section 2	Y / N
EU phone numbers or addresses given for customers to reach you	EDPB 3/2018 section 2	Y / N
Delivery of goods to EU Member States	EDPB 3/2018 section 2	Y / N
Tracking, profiling or behavioural advertising of people while they are in the EU (monitoring)	Art. 3(2)(b); Recital 24	Y / N

Read it this way: no Y at all means Article 3(2) is probably not met; write down why. Several Y, or signal 8 Y, means GDPR applies to that service and you go to Step 2.

Step 2: the exemption test (all three must be yes)

Occasional: not carried out regularly and outside the regular course of your business (EDPB). A live SaaS product or a monthly retainer for EU clients is regular.
No large-scale special category or criminal data: no large-scale health, biometric or other Article 9(1) data and no Article 10 data
Unlikely to result in a risk to people's rights and freedoms, given the nature, context, scope and purposes

Public authorities and bodies are also exempt (Article 27(2)(b)).

Step 3: the check sheet (one row per service)

Column	What to write	Why
A. Service or AI tool, and who uses it	[product] · [consumers / business users / staff of client firms]	One row per service
B. Established in the EU?	Y / N · [branch, office or staff in the EU that runs this service]	Art. 3(1): if Y, Article 27 does not apply; GDPR applies through the establishment
C. Targeting signals	Count of Y from the eight signals · which ones	Art. 3(2)(a); Recital 23
D. Monitoring in the EU?	Y / N · [tracking, profiling, behavioural ads]	Art. 3(2)(b); Recital 24
E. Occasional?	Y only if not regular and outside the normal course of business	Art. 27(2)(a); EDPB 3/2018 section 4
F. Large-scale special category or criminal data?	Y / N · [health, biometric, convictions]	Art. 27(2)(a); Arts. 9(1), 10
G. Unlikely to result in a risk?	Y / N / Unsure · one line why	Art. 27(2)(a)
H. Where are most EU people?	[Member State] · [share, from your own customer list]	Art. 27(3); EDPB good practice
I. Result	`=IF(B2="Y","Art. 27 n/a: EU establishment",IF(AND(C2=0,D2="N"),"Art. 3(2) not met: record why",IF(AND(E2="Y",F2="N",G2="Y"),"Exempt: record why","Representative needed in "&H2)))`	Arts. 3(2), 27(1)–(3)
J. Decided by, date, review	[role] · [dd/mm/yyyy] · review when you add a currency, language, market or tracking	Art. 5(2) accountability

Three filled example rows (made-up businesses)

Row 2, an AI writing-tool SaaS based in Bengaluru: A. AI writing tool, consumers and freelancers · B. N · C. 4: euro pricing with checkout, German and French site versions, EU testimonials, ads aimed at Germany · D. Y, product analytics on user behaviour · E. N, the product runs every day · F. N · G. Unsure · H. Germany, about half of EU users · I. Representative needed in Germany.

Row 3, a marketing agency in Pune with one Irish client: A. Monthly ad campaigns for the client's customers, as processor · B. N · C. 0 for the agency's own offer, but D. Y, it runs behavioural ad targeting of people in Ireland for the client · E. N, monthly · F. N · G. N · H. Ireland · I. Representative needed in Ireland. Processors are covered by Article 27 too.

Row 4, a Hyderabad tour desk that answered two emails from EU travellers this year: A. Email enquiries · B. N · C. 0: rupee prices only, Indian domain, no EU ads · D. N · E. Y · F. N · G. Y · H. n/a · I. Art. 3(2) not met: record why.

Step 4: if you need one, the written mandate checklist

Designate the representative in writing (Article 27(1); Recital 80 calls it a written mandate) and keep the signed copy
Pick a person or company established in a Member State where your EU users are (Article 27(3)); where many are in one country, the EDPB recommends that country
Mandate them to be addressed in addition to or instead of you by supervisory authorities and data subjects on all processing issues (Article 27(4))
Give them your records of processing and keep them updated; they must keep and produce the record (Article 30; EDPB section 4)
Make sure they can communicate in the languages of the authorities and people concerned (EDPB section 4)
Do not use your external EU DPO as representative; the EDPB sees the roles as incompatible
Remember it does not shift liability: legal actions can still be brought against you (Article 27(5))

Step 5: the privacy notice line

Our representative in the European Union under Article 27 GDPR is [name], [postal address in Member State], [email]. You and supervisory authorities can contact them, in addition to or instead of us, on any question about how we process personal data.

Articles 13(1)(a) and 14(1)(a) require the representative's identity and contact details in your notice, and Article 30(1)(a) and 30(2)(a) put them in your records. See the Article 13 AI wording sheet and Article 30 records sheet.

Do this week

List every service once and fill columns A to H
Check your pricing page, language switcher, ad targeting and analytics; they decide columns C and D
If a row says a representative is needed, shortlist providers in that Member State and draft the mandate
If you also sell an AI system into the EU as a provider, check the separate AI Act duty in the Article 22 authorised representative guide; it is a different role

This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 3, 5(2), 9(1), 10, 13, 14, 27, 30; Recitals 23, 24, 80) and EDPB Guidelines 3/2018 on the territorial scope of the GDPR (version 2.0), sections 2 and 4. The example rows are invented.

For accountants and advisers with export clients

Indian and other non-EU software, AI and agency clients often ask whether EU sales bring GDPR duties. Hand them this sheet with the client AI inventory so the answer is written down, and refer legal questions on.

Keep the answer next to your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI service there and attach this sheet as evidence.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

Regulation (EU) 2016/679 (GDPR): Articles 3, 13, 14, 27, 30; Recitals 23, 24, 80
EDPB Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.0, sections 2 and 4

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.