How to Appoint a GDPR Article 27 EU Representative — Step-by-Step

Step 1: Determine If You Need One

Under Article 27, any non-EU data controller or processor that processes EU personal data under Article 3(2) must appoint an EU Representative. If your business: offers goods or services to EU residents; monitors the behaviour of EU individuals; or processes any EU personal data — you need an EU Representative. There is no minimum threshold or company size exemption. Full guide →

Step 2: Choose Your Representative

Your EU Representative must be: (a) established in an EU member state where the data subjects whose data you process are located; (b) designated in writing (Article 27(3)); (c) mandated to be addressed by DPAs and data subjects on your behalf; (d) capable of forwarding correspondence promptly. Selection guide →

Step 3: Complete the Designation Agreement

The written mandate must include: your company details (full legal name, registration number, address), your representative’s EU-established address and contact, the scope of representation (all GDPR matters), the representative’s acceptance of the mandate, and signature from both parties. With EU Shield, this takes 15 minutes online.

Step 4: Update Your Privacy Policy

Your Privacy Policy must now include the EU Representative section. This should list: the identity and contact details of your EU Representative, their address in the EU, their role (receiving correspondence from DPAs and data subjects), and the legal basis for representation (Article 27). Template →

Step 5: Maintain Your ROPA

Your Record of Processing Activities (Article 30) must include your EU Representative’s contact and the fact that you have designated one. Your Representative may store your ROPA as part of their service. ROPA template →

Step 6: Keep Your Representative Informed

You must notify your EU Representative of any changes to: your company structure, data processing activities, EU products/services offered, or contact details. Failure to maintain accurate records creates regulatory risk — your representative cannot forward correspondence they never receive.

Step 1 (Again): Don’t Wait

Appointing an EU Representative takes 15 minutes with EU Shield. The EUR 490/year cost is negligible compared to the upper-tier fine for non-compliance (up to EUR 20 million or 4% of global turnover). Get started →