1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
Article 27 GDPR - Representatives of controllers or processors not established in the Union
2. The obligation laid down in paragraph 1 of this Article shall not apply to:
(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
(b) a public authority or body.
3. The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.
4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.
Relevant Recitals
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Controllers and processors to whom Article 3(2) applies, that is, those not established in the Union but offering goods or services to data subjects in the Union or monitoring their behaviour there. Article 27(1) requires the designation to be made in writing.
Yes. Under paragraph 2 the duty does not apply to public authorities or bodies, nor to processing which is occasional, does not include large-scale processing of special categories of data under Article 9(1) or of data relating to criminal convictions and offences under Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons. The conditions of the processing-based exemption are cumulative, so a single large-scale or risky element defeats it.
Article 27(3) requires establishment in one of the Member States where the data subjects whose data are processed in relation to the offering of goods or services, or whose behaviour is monitored, are located. Where data subjects are spread across several Member States, the controller or processor may choose among them.
Under paragraph 4 the representative is mandated to be addressed, in addition to or instead of the controller or processor, by supervisory authorities and data subjects in particular, on all issues related to the processing, for the purposes of ensuring compliance with the Regulation. The representative also maintains the record of processing activities where applicable under Article 30(1) and (2).
No. Article 27(5) states that the designation is without prejudice to legal actions which could be initiated against the controller or the processor themselves. The representative is a point of contact within the Union, not a substitute defendant that absorbs the appointing party's responsibility.