# GDPR Article 27: Representatives of Controllers or Processors Not Established in the Union

- Source: https://support.icompaas.com/support/solutions/articles/62000236372-gdpr-article-27-representatives-of-controllers-or-processors-not-established-in-the-union
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Chapter IV: Controller and Processor](https://support.icompaas.com/support/solutions/folders/gdpr-chapter-4-controller-and-processor)
- Last updated: 2026-07-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Overview**

This article requires non-EU controllers or processors that fall within GDPR’s territorial scope to appoint a representative in an EU Member State where the data subjects reside. The representative acts as a point of contact for data subjects and supervisory authorities to address GDPR compliance issues. Exemptions apply if processing is occasional, low-risk, and excludes large-scale processing of special category or criminal data.

  

### **Key Principles**

-   EU Representation: Non-EU organizations must have a representative in the EU to ensure GDPR accountability.
    
-   Point of Contact: The representative serves as the liaison with supervisory authorities and data subjects.
    
-   Exemptions: Occasional or low-risk processing with no large-scale special category or criminal data may be exempt.
    
-   Written Designation: Appointment of the representative must be formalized in writing.  
      
    

### **Organizational Applicability**

This article applies to non-EU controllers or processors whose processing activities fall within GDPR’s scope:

-   Non-EU organizations targeting or monitoring data subjects in the EU.
    
-   Public and private sector entities processing personal data of EU/EEA residents.
    
-   Teams responsible for compliance, legal, and data protection operations for non-EU entities.  
      
    

### **Implementation Requirements**

-   Appoint a written-designated representative in an EU Member State where data subjects reside.
    
-   Ensure the representative is accessible to data subjects and supervisory authorities.
    
-   Document the representative appointment and contact details.
    
-   Evaluate whether exemptions apply based on the nature, scope, and type of processing.  
      
    

### **Implementation Guidance**

-   Draft a written agreement appointing the EU representative and define their responsibilities.
    
-   Provide contact details of the representative on privacy notices or relevant communication channels.
    
-   Train staff and the representative on GDPR obligations and compliance processes.
    
-   Periodically review the representative’s role and appointment to ensure continued compliance.  
      
    

### **Periodic Review**

-   Frequency: Annually or when processing activities or data subject jurisdictions change.
    
-   Responsible Role: Data Protection Officer (DPO), Compliance Team, or legal counsel.
    
-   Outcome: Confirm that a representative is appointed, accessible, and GDPR compliance responsibilities are fulfilled.  
      
    

### **Non-Compliance Risks**

-   Fines: Up to €20 million or 4% of global annual turnover.
    
-   Legal Exposure: Complaints or enforcement actions for lack of EU representation.
    
-   Reputational Damage: Loss of trust from EU data subjects and regulators.
    
-   Operational Risk: Inability to respond to data subject requests or regulatory inquiries efficiently.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.