Skip to content
RGPD

Article 27

Representatives of controllers or processors not established in the Union

1.   Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.

2.   The obligation laid down in paragraph 1 of this Article shall not apply to:

(a)

processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or

(b)

a public authority or body.

3.   The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.

4.   The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.

5.   The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

Common Questions

Frequently Asked Questions

When does a controller or processor have to designate a representative in the Union?
The duty is triggered where Article 3(2) applies, that is, when the Regulation covers processing by a controller or processor not established in the Union. In that case the controller or the processor must designate a representative in the Union, and the designation must be made in writing.
Which organisations are exempt from the obligation to designate a representative?
Article 27(2) exempts two cases:
  • processing which is occasional, does not include large-scale processing of the special categories of data referred to in Article 9(1) or of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing;
  • a public authority or body.
In which Member State must the representative be established?
The representative must be established in one of the Member States where the relevant data subjects are: those whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored. The location is therefore tied to where those data subjects are, not chosen freely.
What is the representative mandated to do, and does the appointment reduce the controller's or processor's own liability?

The representative is mandated to be addressed, in addition to or instead of the controller or the processor, in particular by supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with the Regulation.

Appointing a representative does not shield the organisation: the designation is without prejudice to legal actions which could be initiated against the controller or the processor themselves.

← Article 26 Article 28 →