GDPR Article 27:
The Complete Guide for Non-EU Businesses

1. What is GDPR Article 27?

Article 27 of the EU General Data Protection Regulation (GDPR) requires organizations established outside the European Union to designate a representative in the EU if they process personal data of individuals located in the EU.

EU Shield services: GDPR Article 27 EU Representative · GPSR Responsible Person for product sellers — each €490/year flat, all 27 EU states.

This representative acts as a local point of contact for both:

• Data subjects (EU residents whose data you process) — they can contact your representative with questions or complaints
• Supervisory authorities (EU data protection regulators) — they can contact your representative instead of trying to reach you abroad

The representative doesn’t need to be a lawyer or compliance expert. They can be an individual or a specialized service. The key requirement is they are physically located in an EU member state where at least some of your data subjects are.

The full text of Article 27 states (paraphrased):

“Where Article 3(2) applies, the controller or processor shall designate in writing a representative in the EU. The representative shall be established in one of the member states where the data subjects whose personal data are processed in relation to the offering of goods or services, or whose behavior is monitored, are located.”

The representative mandate applies to both controllers and processors. Whether you own the data or process it for someone else — if you’re non-EU and handle EU personal data, you need a representative.

2. Who Needs an EU Representative?

You need an EU Representative under Article 27 if:

• You are established outside the European Union
• AND you process personal data of individuals located in the EU
• AND your processing relates to either:
  • Offering goods or services to EU residents (even if free), OR
  • Monitoring their behavior (e.g., tracking, analytics, profiling)

This includes:

3. Who is Exempt?

The only exemption from Article 27 is under Article 27(2)(a):

“This obligation shall not apply to processing which is occasional, does not include large scale processing of special categories of data or personal data relating to criminal convictions and offenses, and is unlikely to result in a risk to the rights and freedoms of natural persons.”

In practice, very few businesses qualify for this exemption. The three conditions must all be met simultaneously:

1. Occasional processing — not regular or systematic
2. No large-scale special data — no health data, biometrics, criminal records, etc.
3. Low risk — unlikely to harm data subjects’ rights

Even the European Data Protection Board (EDPB) has stated that the exemption should be interpreted narrowly. If in doubt, you likely need a representative.

4. What Are the Representative’s Obligations?

Your EU Representative must be:

• Designated in writing — a formal written agreement appointing them
• Named in your privacy policy — data subjects must know who to contact
• Physially established in the EU — they need an EU address
• Available and responsive — they must handle communications from data subjects and regulators
• Maintaining records — they hold copies of your processing records under Article 30

What your EU Representative actually does:

Important: The representative is NOT liable for your GDPR compliance. Liability stays with you (the controller or processor). However, they must be reachable — an unresponsive representative defeats the purpose and could worsen your regulatory risk.

5. What Are the Fines for Non-Compliance?

GDPR fines are structured in two tiers:

• Tier 1: Up to €10 million or 2% of global annual turnover — for violations including lack of Article 27 representative
• Tier 2: Up to €20 million or 4% of global annual turnover (whichever is higher) — for core data processing violations

But the REAL risk isn’t just the fine. The practical consequences of non-compliance include:

• Regulatory investigation — which costs time, legal fees, and management attention
• Reputational damage — being publicly named as non-compliant by an EU regulator
• Data processing bans — regulators can order you to stop processing EU residents’ data entirely
• Loss of EU business — EU partners and customers increasingly check for GDPR compliance before doing business

Having an EU Representative is the single cheapest and easiest way to demonstrate good faith compliance. It doesn’t solve all GDPR obligations, but it’s the minimum viable requirement every non-EU business must meet.

→ Read our full GDPR fines analysis (2025-2026) →

6. How Much Does an EU Representative Cost?

The cost of an EU Representative varies significantly by provider and complexity:

What affects the price:

• Complexity of your data processing
• Number of EU member states where your data subjects are located
• Volume of data subject requests you typically receive
• Whether you need additional services (DPO, legal review, breach notification)

For most non-EU SaaS companies, e-commerce stores, and small manufacturers, €490/year covers everything you need.

→ Detailed cost breakdown with all service comparisons →

7. How to Appoint an EU Representative

Appointing an EU Representative is straightforward. Here’s the step-by-step process:

1. Choose a provider — select an EU-based service like EU Shield that specializes in Article 27 representation
2. Sign the designation agreement — a formal written contract appointing them as your representative (required by law)
3. Provide processing details — share your Article 30 records so the representative can hold them as required
4. Update your privacy policy — add your representative’s name, address, email, and phone under a dedicated “EU Representative” section
5. Notify your EU stakeholders — if relevant, inform EU partners or customers of your compliance status
6. Keep it current — update your representative if your processing changes or if the provider changes

What to include in your privacy policy:

Under Article 27, your privacy policy must include a section like this:

EU Representative
Pursuant to Article 27 of the GDPR, [Company Name] has appointed an EU Representative:

EU Shield
[Address]
Email: compliance@eushield.eu
Phone: [phone number]

EU residents may contact our representative regarding data protection matters.

→ Step-by-step guide with templates →

8. EU Representative vs DPO vs Law Firm

Many businesses confuse the EU Representative with other roles. Here’s the difference:

Key distinction: An EU Representative is a mandatory compliance role. A DPO is an advisory role. A law firm provides legal services. You might need all three — but most non-EU businesses only need the Representative.

→ Full comparison: EU Representative vs DPO →
→ EU Representative vs Law Firm: what you actually need →

9. Country-Specific Requirements

While Article 27 is EU-wide, some countries have additional nuances:

Where should your Representative be located? Choose an EU member state where a significant number of your data subjects are. Ireland, Netherlands, and Germany are popular choices due to their cost-effective compliance ecosystems. EU Shield operates from our EU office covering all member states.

10. Frequently Asked Questions

Ready to Get Compliant?

Appointing an EU Representative is the single most important compliance step for non-EU businesses selling into Europe. It’s affordable, straightforward, and protects you from escalating regulatory risk.

With EU Shield, you get:

• ✅ EU Representative designation — active by next business day
• ✅ 24-hour correspondence forwarding from data subjects and regulators
• ✅ Article 30 record keeping at our EU office
• ✅ Privacy policy support and template updates
• ✅ Annual compliance check-in
• ✅ 30-day money-back guarantee
• ✅ €490/year — flat fee, no hidden costs

Disclaimer: This guide provides general information about GDPR Article 27 requirements. It does not constitute legal advice. For specific legal questions, consult a qualified data protection attorney. EU Shield provides EU Representative services, not legal representation.