EU Representative under Article 27 GDPR
Controllers and processors that have no establishment in the European Union must designate a representative in the Union — in writing — whenever Article 3(2) of Regulation (EU) 2016/679 (GDPR) applies to their processing: when they offer goods or services to data subjects who are in the Union, or monitor their behaviour as far as it takes place within the Union (Article 27(1) GDPR). Regingada UG (haftungsbeschränkt) takes on that named role under its own representation contract: point of contact for supervisory authorities and data subjects, documentation and records support — not legal advice.
GDPR EU representative service for non-EU SaaS providers, app publishers and online businesses serving customers or tracking users in the Union.
Software & appointed EU representation: Regingada UG (haftungsbeschränkt) · Legal advice exclusively: the law firm Theo Funk — separate mandate
Who must appoint an EU representative under Article 27?
Article 27(1) GDPR ties the duty to Article 3(2) GDPR: a controller or processor not established in the Union must designate a representative in the Union where its processing of personal data of data subjects who are in the Union relates to (a) the offering of goods or services to such data subjects in the Union — irrespective of whether a payment is required — or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
Neither trigger requires an EU entity or EU revenue. For the offering limb, recital 23 GDPR looks at whether you envisage offering goods or services to data subjects in the Union — mere accessibility of a website is not sufficient, but factors such as EU languages or currencies with the possibility of ordering, or the mentioning of customers in the Union, make it apparent. For the monitoring limb, recital 24 GDPR points to the tracking of natural persons on the internet, including the subsequent use of profiling techniques to analyse or predict personal preferences, behaviours and attitudes.
If Article 3(2) applies and no exemption under Article 27(2) is available, the designation must be made in writing (Article 27(1) GDPR) — and the representative must be established in one of the Member States where the data subjects concerned are (Article 27(3) GDPR).
The exemptions — Article 27(2) GDPR
The duty does not apply to processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) GDPR or processing of personal data relating to criminal convictions and offences referred to in Article 10 GDPR, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing (Article 27(2)(a) GDPR). It also does not apply to public authorities or bodies (Article 27(2)(b) GDPR).
The three conditions of the first exemption are cumulative. For a live online service that continuously serves or tracks people in the Union, processing is rarely “occasional” — which is why most non-EU SaaS and app businesses within Article 3(2) end up needing the representative.
What does the EU representative do?
The representative is mandated by the controller or processor to be addressed in addition to or instead of the controller or processor — in particular by supervisory authorities and by data subjects — on all issues related to the processing, for the purposes of ensuring compliance with the GDPR (Article 27(4) GDPR). Unlike most other EU representative regimes, Article 27 makes the representative an address for individuals, not only for authorities.
- Named address in the Union — receipt of supervisory-authority correspondence and data-subject requests directed at the representative
- Documented routing — timely forwarding to the people you designate, with a defined escalation path and an audit trail
- Records — the representative maintains its own record of processing activities under Article 30(1) and (2) GDPR, kept in sync with yours
- Disclosure support — the representative’s identity and contact details belong in your privacy notices (Articles 13(1)(a) and 14(1)(a) GDPR)
Recital 80 GDPR states that the designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor — while Article 27(5) GDPR makes clear that the designation is without prejudice to legal actions against the controller or processor themselves. That is why our representation contract defines duties, information flows and escalation paths precisely.
There is no notification of the representative to a supervisory authority under the GDPR: the designation is documented in the written mandate, in your privacy notices and in the records of processing activities.
How does the appointment work?
Three steps take you from scoping to a disclosed and documented representative function.
-
Scoping
A guided question set — the same wizard you can start on this page — records your establishment, your Article 3(2) triggers and the Article 27(2) exemption conditions.
Deliverablea structured self-assessment record of your Article 27 status — not a legal determination; for that, the law firm advises under a separate mandate.
-
Written mandate
We prepare the written designation Article 27(1) GDPR requires, together with the representation contract that sets tasks, information channels and response times.
Deliverablea draft written designation plus representation contract naming role, duties and information flows — model terms on request.
-
Disclosure & go-live
No authority notification is needed under the GDPR — instead, your public disclosures and records are brought in line and the operational contact channel goes live.
Deliverablea disclosure package: representative contact block for your privacy notice (Articles 13(1)(a) and 14(1)(a) GDPR), Article 30 record entries, and a documented contact channel.
A named role, held by a registered company.
“Article 27 is an operational role: supervisory authorities and data subjects must be able to reach someone in the Union who receives, routes and documents — reliably. Regingada holds that named role under its own contract. Legal judgment stays with my firm, under a separate mandate.”
Regingada UG (haftungsbeschränkt), HRB 12595, AG Bamberg
Appointed EU representative & software: Regingada UG (haftungsbeschränkt) — owned by Theo Funk, a German attorney (Rechtsanwalt), no legal advice · Legal advice: independent law firm Theo Funk (RAK Bamberg) — separate mandate.
EU data discipline → Trust Center · security.txt (RFC 9116)
The same regulatory corpus powers the Regingada Compliance Suite — digital-twin software that maps the GDPR alongside the DSA, the AI Act, the DMA and NIS2.
Is the representative the same as a data protection officer?
No. The representative is an address in the Union under your written mandate (Article 27(4) GDPR); the data protection officer takes no instructions on those tasks (Article 38(3) GDPR). Regingada holds the Article 27 role only.
Both roles in full: EU representative vs. data protection officer.
How do you switch your EU representative?
Representative mandates change when providers leave the market, terms expire, or groups restructure. An orderly change has three parts — and none of them is complicated if the trail was kept properly.
- Overlap, not gap — align the end of the old mandate with the new written designation (Article 27(1) GDPR) so there is no period without a representative in the Union
- Update the disclosures — privacy notices must state the identity and contact details of the current representative (Articles 13(1)(a) and 14(1)(a) GDPR); the Article 30 records of processing are updated in parallel
- Hand over the trail — open supervisory-authority or data-subject threads, the correspondence log and the representative’s Article 30 record move to the new representative, with a documented cut-over date
We take over existing Article 27 mandates with a structured handover — and if you ever leave, we hand over the same way. The audit trail is yours, not ours.
Which non-EU SaaS setups trigger Article 27?
The duty is easy to miss because it follows your EU users, not your corporate structure. Three typical setups:
-
Art. 3(2)(a) GDPR
US SaaS with EU customers
A SaaS company incorporated in the US, no EU entity, sells subscriptions to customers in the Union. Offering goods or services to data subjects in the Union triggers Article 3(2)(a) GDPR — irrespective of whether a payment is required. Free tiers count too.
-
Art. 3(2)(a) · recital 23
App with EU users
A mobile or web app reaches users in the Union. Mere accessibility is not sufficient (recital 23 GDPR) — but EU-targeted store listings, EU languages or currencies with the possibility of ordering, or marketing that mentions customers in the Union make the offering apparent.
-
Art. 3(2)(b) · recital 24
Analytics & tracking
Even without selling anything into the EU, tracking people there can trigger the duty: Article 3(2)(b) GDPR covers the monitoring of behaviour within the Union — recital 24 GDPR points to internet tracking with subsequent profiling to analyse or predict preferences, behaviours and attitudes. Analytics, session replay and ad personalisation live here.
What does an Article 27 representative cost?
The engagement is priced by what the role actually has to carry: how many group companies the designation covers, the expected volume of supervisory-authority and data-subject contacts, documentation and records needs (Article 30 GDPR), whether the role is combined with DSA Article 13, AI Act or NIS2 representation (multi-regime setups reduce coordination overhead), and the response times we commit to.
Fixed annual fees by company size: €490 (micro) · €990 (small) · €2,290 (medium) · €5,200 (large).
Net of VAT, payable annually in advance, subject to onboarding and vetting. Article 27 representation is often combined with DSA or AI Act representation — multi-regime setups: −10% on the combined annual fee per additional regime, capped at −30%. See the full price list →
Frequently asked questions
Can our EU representative also be our data protection officer?
Two different roles. The representative is an address under your mandate (Article 27(4) GDPR); the data protection officer acts independently and takes no instructions on those tasks (Article 38(3) GDPR). The European Data Protection Board does not consider the representative compatible with an external data protection officer established in the Union — its view, not a statutory ban. The two roles compared.
Which exemptions does Article 27(2) GDPR provide?
Two. First, processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) GDPR or processing of personal data relating to criminal convictions and offences referred to in Article 10 GDPR, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing. Second, processing by a public authority or body. The conditions of the first exemption are cumulative — for a live online service, processing is rarely occasional.
Do we have to name the representative in our privacy policy?
Yes. Where a representative has been designated, the identity and contact details of the representative are part of the information you must provide to data subjects (Articles 13(1)(a) and 14(1)(a) GDPR). We supply the representative contact block for your privacy notice as part of onboarding.
Can the representative be the target of enforcement?
Recital 80 GDPR states that the designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor. At the same time, Article 27(5) GDPR makes clear that the designation is without prejudice to legal actions which could be initiated against the controller or the processor themselves. Our representation contract reflects that by defining duties, information flows and escalation paths precisely.
How do we change an existing EU representative?
By aligning the end of the old mandate with a new written designation (Article 27(1) GDPR), updating your privacy notices (Articles 13(1)(a) and 14(1)(a) GDPR) and your records of processing activities (Article 30 GDPR), and handing over open authority or data-subject threads together with the correspondence log. We support structured handovers in both directions.
Does the representative have to be registered with a supervisory authority?
No. The GDPR provides no registration of the representative with a supervisory authority — the designation lives in the written mandate, your privacy notices and the records of processing activities. That differs from NIS2, where certain entities must submit registration information that includes the details of their representative designated pursuant to Article 26(3) (Article 27 of Directive (EU) 2022/2555).
Can one representative act for several group companies?
Yes. Article 27 GDPR attaches the duty to each controller or processor, but nothing in the provision prevents several companies of a group from designating the same representative — each entity makes its own written designation, and the representative must be established in one of the Member States where the data subjects concerned are (Article 27(3) GDPR). Covering a group under one mandate is a common setup and one of the cost factors on this page.
Is this legal advice?
Regingada UG (haftungsbeschränkt) is the software and EU-representation company, owned by Theo Funk, a German attorney (Rechtsanwalt). It does not provide legal advice. For legal advice under a separate mandate, please see the independent law firm Theo Funk.
What does it cost?
The engagement depends on how many group companies the designation covers, the expected volume of supervisory-authority and data-subject contacts, documentation and records needs, whether the role is combined with DSA Article 13, AI Act or NIS2 representation (multi-regime setups reduce coordination overhead), and agreed response times. Fixed annual fees by company size: €490 (micro), €990 (small), €2,290 (medium), €5,200 (large). Net of VAT, annual prepayment, subject to onboarding and vetting. See the full price list.
Appoint your Article 27 EU representative.
Start with the scoping check — it records your Article 3(2) triggers and Article 27 status and leads straight into the representation request.
Legal advice on representative obligations — the law firm Theo Funk (separate mandate)
Who stands behind the representative role?
Regingada UG (haftungsbeschränkt), Bamberg, Germany — HRB 12595, Amtsgericht Bamberg (local court, commercial register) — is owned by Theo Funk, a German attorney (Rechtsanwalt). It holds the appointed representative role and builds the software; it does not give legal advice. Legal assessment is a separate mandate with the law firm Theo Funk, which is bound by professional secrecy (§ 43a BRAO). Two contracts, billed separately: neither engagement requires the other, and no referral fees are paid in either direction.
Last reviewed: 27 September 2026