Find a GDPR Article 27 Representative in the EU
Organisations outside the EU/EEA that process personal data of EU residents without an EU establishment must designate an EU representative under GDPR Article 27. This representative acts as the point of contact for EU data protection authorities and data subjects. Submit one request — ECP matches you to qualified GDPR Art. 27 representative providers.
Who needs a GDPR Article 27 representative?
Your organisation needs a GDPR Article 27 representative if:
- You are established outside the EU/EEA (including UK post-Brexit)
- You process personal data of individuals located in the EU
- The processing relates to offering goods or services to EU residents, or monitoring EU residents’ behaviour
- No exemption applies (occasional processing, no risk to natural persons)
Common examples include: SaaS companies serving EU customers, e-commerce businesses, mobile app providers, analytics and advertising platforms, and employers with EU-based staff.
Failure to appoint a GDPR Article 27 representative is itself a GDPR violation. Supervisory authorities can impose fines under Article 83 GDPR and take enforcement action directly against the representative.
What the GDPR Article 27 representative does
- Acts as EU point of contact for EU data protection supervisory authorities (e.g., DPA in Germany, CNIL in France, ICO in UK)
- Receives communications, requests and regulatory inquiries on behalf of the controller or processor
- Forwards communications to the data controller or processor promptly
- Listed in your Records of Processing Activities (RoPA) as the EU representative
- Available to data subjects exercising their rights (access, erasure, portability etc.)
The GDPR Art. 27 representative does not make compliance decisions for your organisation — they are a conduit for communications. You remain responsible for GDPR compliance.
Documents and information typically required
- Description of your data processing activities involving EU residents
- Categories of personal data processed
- EU member states where data subjects are located
- Your existing Privacy Policy and Records of Processing Activities (RoPA)
- Any existing DPA correspondence or supervisory authority contacts
Related services
| Service | Description |
|---|---|
| Swiss FADP Representative | Swiss data protection representative under Swiss FADP/nDSG Art. 14 — separate from GDPR Art. 27 |
| DSA Article 13 Legal Representative | EU legal representative for digital service providers under Digital Services Act |
| All Representative Services | Overview of all 11 representative and compliance service types on ECP |
Ready to Start?
Organisations outside the EU/EEA processing personal data of EU residents must appoint an EU representative under GDPR Article 27. Submit one request — ECP matches you to GDPR Art. 27 representative providers.
Search Authorized Representatives Free →