Overview

This article requires non-EU controllers or processors that fall within GDPR’s territorial scope to appoint a representative in an EU Member State where the data subjects reside. The representative acts as a point of contact for data subjects and supervisory authorities to address GDPR compliance issues. Exemptions apply if processing is occasional, low-risk, and excludes large-scale processing of special category or criminal data.


Key Principles

  • EU Representation: Non-EU organizations must have a representative in the EU to ensure GDPR accountability.

  • Point of Contact: The representative serves as the liaison with supervisory authorities and data subjects.

  • Exemptions: Occasional or low-risk processing with no large-scale special category or criminal data may be exempt.

  • Written Designation: Appointment of the representative must be formalized in writing.

Organizational Applicability

This article applies to non-EU controllers or processors whose processing activities fall within GDPR’s scope:

  • Non-EU organizations targeting or monitoring data subjects in the EU.

  • Public and private sector entities processing personal data of EU/EEA residents.

  • Teams responsible for compliance, legal, and data protection operations for non-EU entities.

Implementation Requirements

  • Appoint a written-designated representative in an EU Member State where data subjects reside.

  • Ensure the representative is accessible to data subjects and supervisory authorities.

  • Document the representative appointment and contact details.

  • Evaluate whether exemptions apply based on the nature, scope, and type of processing.

Implementation Guidance

  • Draft a written agreement appointing the EU representative and define their responsibilities.

  • Provide contact details of the representative on privacy notices or relevant communication channels.

  • Train staff and the representative on GDPR obligations and compliance processes.

  • Periodically review the representative’s role and appointment to ensure continued compliance.

Periodic Review

  • Frequency: Annually or when processing activities or data subject jurisdictions change.

  • Responsible Role: Data Protection Officer (DPO), Compliance Team, or legal counsel.

  • Outcome: Confirm that a representative is appointed, accessible, and GDPR compliance responsibilities are fulfilled.

Non-Compliance Risks

  • Fines: Up to €20 million or 4% of global annual turnover.

  • Legal Exposure: Complaints or enforcement actions for lack of EU representation.

  • Reputational Damage: Loss of trust from EU data subjects and regulators.

  • Operational Risk: Inability to respond to data subject requests or regulatory inquiries efficiently.