When is the EU representative required under the GDPR?

Perhaps not everyone is aware that Article 27 of the GDPR requires the appointment of a European representative to companies located outside the EU and carrying out data processing activities of European citizens.

In brief, the representative’s role is to act as a point of contact between the data controller, located outside the territory of the EU, and national data protection authorities and data subjects.

As an obligation imposed only on non-European companies, it is not surprising that, within the European Union, this regulatory imposition had never been given particular importance.

Nonetheless, companies that fail to comply with this requirement can often face large fines.

Inside this article we try to answer some of the most frequently asked questions about the EU representative.

What is the role of an EU representative under the GDPR?

The role of an EU representative under the General Data Protection Regulation (GDPR) is to act as a point of contact for EU data protection authorities and individuals whose personal data is processed by the non-EU based organization that the representative is representing. Although the representative is not responsible for the organisation’s compliance with the GDPR and may still be required to cooperate with and assist the DPAs in carrying out their tasks. This includes responding to inquiries from individuals whose personal data is processed by the organization and providing information to data protection authorities when requested. The EU representative is also responsible for ensuring that the organization keeps records of its processing activities, and for making those records available to data protection authorities upon request.

Should my company appoint an EU representative?

Whether a company is required to appoint an EU representative under the General Data Protection Regulation (GDPR) depends on several factors. The GDPR requires non-EU based organizations that:

• offer goods or services to individuals in the EU, or
• that monitor the behavior of individuals in the EU,

to appoint an EU representative if they do not have a physical presence in the EU.

According to the EDPB guidelines (guideline 3/2018), there are several factors that need to be considered in order to determine whether a company is offering its goods or services to individuals in a particular territory within the EU. Some of these factors are:

• using the languages of a specific region or offering payments in the currency of that region;
• using Google, Facebook or TikTok ads to target a specific market, or any other marketing activity directed at customers in that market;
• the use of top-level domains in that market;
• offering delivery of goods to individuals in the European region.

Furthermore it is important to note that the GDPR applies to organisations of all sizes, so even if your company is small, you may still be required to appoint an EU representative. It is always best to consult with a legal advisor to determine whether your company is required to appoint an EU representative.

What happens if I do not appoint an EU representative under the GDPR?

If a non-EU based organization that is required to appoint an EU representative under the General Data Protection Regulation (GDPR) does not do so, it may be subject to penalties and fines. The GDPR provides for a range of administrative fines, including fines of up to 20 million euros or 4% of the organization’s global annual revenue, whichever is greater, for violations of certain provisions of the GDPR. Failing to appoint an EU representative when required to do so could be considered a violation of the GDPR, and could result in the organization being fined. Additionally, EU data protection authorities may take other enforcement actions against the organization, such as requiring it to appoint an EU representative or suspending or prohibiting the processing of personal data. It is important for non-EU organizations to comply with the GDPR and appoint an EU representative if required to do so.

How to appoint an EU representative?

To appoint an EU representative under the General Data Protection Regulation (GDPR), your company can take the following steps:

• Identify an individual or organization based in the European Union (EU) that is willing and able to act as your company’s EU representative.
• Have the EU representative sign a written mandate that outlines the scope of their responsibilities and the duration of their appointment.
• Keep a copy of the mandate on file, along with any other relevant documents, such as proof of the EU representative’s identity and location.
• Make the contact information for your company’s EU representative available on your website and in your privacy policy, and provide it to any individuals or data protection authorities who request it.

It is important to note that the EU representative must be based in the EU and must be easily accessible to individuals and data protection authorities. The representative must also be able to communicate in the language(s) used by the individuals and authorities with whom they will be interacting. It is also important to ensure that the EU representative is able to fulfill their responsibilities under the GDPR and is familiar with the organization’s processing activities. You may wish to consult with a legal advisor to ensure that your company’s appointment of an EU representative complies with the GDPR.