In 2018, the European Commission introduced the General Data Protection Regulation (GDPR). It shook the world because it applied both to European businesses and to any organization that processes the data of European individuals.

The GDPR is the most sweeping set of privacy regulations currently in place. Because it applies to so many organizations outside of Europe, it also requires some groups to appoint what’s called a GDPR representative.

Does your organization need to comply with Article 27 (GDPR Representative)? Keep reading to learn what this rule entails.

What is Article 27 of the GDPR?

Article 27 of the GDPR applies specifically to controllers and processors not established in the European Union. In short, the article applies to you if you need to comply with the GDPR but you don’t have an office or presence in the EU.

It says that those businesses who aren’t established in the Union need to appoint a representative in one of the EU member states.

What is a GDPR Representative?

A GDPR representative acts on your behalf with respect to the GDPR from within the EU. The appointed party is a direct contact between your organization and both data subjects and regulatory authorities. A representative can also receive legal documents on your behalf.

Why would the EU require you to find a representative based in a member state?

Because traditionally, it’s hard to get in touch with companies outside the EU. A regulatory body could send letter after letter, and the recipient may never respond. Appointing an EU-based representative makes all communication more efficient and effective for everyone involved.

It’s not all about making life easier for regulatory bodies. Appointing a representative also makes it simpler for your business to uphold your obligations under the GDPR and avoid the huge fines associated with violations.

Are There Any Exceptions to the Representative Rule?

Yes, Article 27(2) says that this section doesn’t apply to organizations that only process data occasionally. It also doesn’t apply to public bodies.

To qualify for the exemption, you must also not process on a large scale any data related to Article 9(1) or Article 10, which are special categories of data, and your processing must be unlikely to affect the rights and freedoms of individuals.

Remember: even if there’s no obligation to comply with Article 27, you may still likely have to comply with the GPDR more generally. Not appointing a representative doesn’t give you a free pass.

How to Nominate a GDPR Representative

Do you need a GDPR representative? It’s important to follow the regulation’s guidelines when selecting one.

These are the most important points that you need to cover when you make your selection.

Who Can Be a Representative?

Your GDPR representative can be any natural or legal person. 

Experts are most likely to fulfill this role because Recital 80 of the GDPR says that your representative can be subject to enforcement proceedings if you violate the law. In other words, they take on the risk of your violations.

The EU’s willingness to do this reveals its motivation for requiring the representative in the first place. It’s challenging to initiate lawsuits and enforcement proceedings against overseas bodies. If you have a representative within the EU, the enforcement process is much more streamlined.

Where Should Your Representative Be Located?

The answer to this question depends on your data processing activities.

If you process data across many EU member states evenly, then you can choose any nation. Belgium is a popular choice because it is at the heart of EU infrastructure and it is a center for global business.

However, if you only process data in Germany or France, then you need to choose a representative in Germany or France.

The goal is to make it as easy as possible for data subjects to contact you. So if 90% of your European data processing takes place in Germany, then you need a representative in Germany – not Romania or Ireland.

How Do You Appoint a GDPR Representative?

Data controllers or processors must appoint a representative in writing.

In most cases, you can do this by using a mandate agreement. 

The agreement includes your organization’s details, the details of your representative, and a reference to Article 27.

Other clauses must also be included in your contract, like:

• Clauses describing each party’s obligations
• Liability clauses
• Indemnity clauses
• Non-disclosure clauses

You should also ensure that the agreement doesn’t provide for automatic termination if your company suffers a data breach.  

Remember to Note Your Representative’s Details in Your Privacy Policy

If you need a GDPR representative, it’s not enough to appoint one and call it good. You also need to share their details to make them available to regulatory bodies and data subjects.

For most companies, this is as simple as adding the representative’s details to your privacy policy.

Do You Need a GDPR Representative?

There are many elements of the GDPR that are confusing. Article 27 is one of them because many companies are only just finding out about the need to appoint a GDPR representative.

When does Article 27 apply to you? If you are a data controller or processor that processes personal data of individuals in the EU and you don’t have a European base, then you likely need a GDPR representative.

Choosing the right representative is important. Not only is it your obligation under the law, but the right service will also make it easier to comply.

Are you still wondering whether or not Article 27 applies to you? Click here to take EDPO’s GDPR assessment for more insight.