5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Appoint an EU representative under Art. 27 GDPR
An address in the EU is not enough.
We check whether your company must designate a representative in the Union, draft the written designation and act as representative towards supervisory authorities and data subjects. Companies without an EU establishment often have to appoint an EU representative under Art. 27 GDPR; we check the obligation and take on the representation.
Please enter a short description first.
The first contact is free of charge. We will tell you explicitly before any costs arise.
Response within 24 hours on working days
As of: 23 October 2026
Art. 27 GDPR: designation required?2 of 6
- No establishment in the EURegistered in DelawarePresent
- Offering to people in the EUPrices in euros, pages in GermanPresent
- Monitoring of behaviourProduct analytics in the appCheck
- Exception under Art. 27(2)Check
- Representative named in privacy noticesMissing
- Representative recorded in the RoPAMissing
Point of review: Occasional processing or ongoing analytics?
- 1Clarify the obligationOffice, markets, exceptions
- 2Draft the designationMandate, notices, RoPA
- 3Act as representativeAuthorities, data subjects
Schematic illustration of an obligation check. Simplified example.
We represent companies from
- USA
- United Kingdom
- Switzerland
- Asia
Key points at a glance
- Under Art. 27 GDPR, companies without an establishment in the EU must designate a representative in the Union if they offer goods or services to people in the EU or monitor their behaviour.
- At ITMR, we check the obligation, draft the written designation and act as representative towards supervisory authorities and data subjects.
- Responsibility for GDPR compliance remains with the company.
- If there is no obligation, we document the reasoning for customers, audits and authorities.
- Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
- Art. 27
- GDPR provision on the representative in the EU for companies without an establishment in the EU.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- VVT
- Record of processing activities under Art. 30 GDPR. It lists which data is processed for which purpose.
Typical triggers
When does the question of an EU representative arise?
In our experience, the obligation is rarely noticed in the data protection manual. It shows up in a business transaction, for example when launching in the EU or onboarding a major customer.
We first clarify whether the obligation applies and then set up a representation that is reachable when it matters.
Art. 27 GDPR is not linked to nationality. What matters are people located in the Union and processing related to offering goods or services to them or monitoring their behaviour.
That is why it is not enough to name an address somewhere. Before the designation, it must be clear whether Art. 3(2) GDPR applies, which processing is concerned and how the representative remains reachable and able to act.
The representative does not take over the company's entire data protection organisation. Legal bases, transparency, data subject rights, security, service providers and documentation remain the company's responsibility.
- For whom
- Controllers and processors without an establishment in the EU
- Provision
- Art. 27 in conjunction with Art. 3(2) GDPR
- Form
- Written designation
- Location of the representative
- In a Member State where data subjects are located
Clear first assessment
State your registered office, EU markets and offering in the form. We will get back to you on working days within 24 hours with a first assessment and the next step.
How it works
How does EU representation work in three steps?
From the obligation check to ongoing representation, we agree every step with you.
01
Clarify the obligation We check the registered office, EU target markets, your role as controller or processor, data types, analytics and possible exceptions under Art. 27(2) GDPR.
02
Draft the designation We draft the written mandate, define contact details and responsibilities and update the privacy notices and the record of processing activities.
03
Act as representative We are the point of contact for supervisory authorities and data subjects in the EU and forward enquiries to your team in an orderly way with a deadline note.
What we need for the assessment
- 1
Company and market Registered office, EU countries with customers or users, websites, apps and sales channels, languages, currencies, delivery areas and EU campaigns.
- 2
Data processing Role as controller or processor, categories of data subjects, data types and special risks, analytics, profiling or automated evaluation.
- 3
Documents Privacy notices, record of processing activities or process overview, data processing agreements and open customer, authority or audit enquiries.
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Service package
What do we take on as EU representative?
Service package: EU representative under Art. 27 GDPR
Obligation check Registered office and group structure, role, EU offering, EU target markets, monitoring of behaviour, data types, scale of processing and possible exceptions.
Written designation Mandate and tasks, contact details and responsibilities, internal reporting channels and delimitation from data protection officers and service providers.
Updating documentation Information on the representative in the privacy notices under Art. 13 and 14 GDPR and in the record under Art. 30 GDPR.
Ongoing representation Receiving enquiries from supervisory authorities and data subjects, forwarding them with a deadline note and coordinating the response with your team.
Documentation where there is no obligation If there is no obligation, we record the reasoning in writing so that you can answer customer and audit enquiries in an orderly way.
- For whom
- Companies without an establishment in the EU
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Defence in proceedings before the supervisory authority and court action. These are separate services, on request.
Who delivers what and who decides
- Registered office and company structure
- EU markets and offerings
- Privacy notices and RoPA
- Internal contacts
- Obligation check
- Written mandate
- Updating documentation
- Representation towards authorities and data subjects
- Your company decides on the processing
- The supervisory authority decides on its measures
How does the engagement work?
- 1
First assessment You describe your registered office, EU markets and offering using the form. We assess whether a designation is likely needed. The first contact is free of charge.
- 2
Offer Before we start work, we tell you the scope and costs of the obligation check and ongoing representation transparently.
- 3
Court steps separately If you wish, we agree proceedings before the supervisory authority and court action separately.
Typical triggers
In which situations do companies contact us?
These are the six triggers we see most often.
A company from the USA, the United Kingdom, Switzerland or another third country offers goods, software, apps or digital services to people in the EU.
Web analytics, retargeting, app analytics or user segmentation capture the behaviour of people while they are in the EU.
A major customer, investor, auditor or data protection officer asks about the representative in the Union or the documentation in the record of processing activities.
The website or app clearly targets EU markets but names no representative, or contains information that does not match the actual processing.
Processors outside the EU can also be covered if their processing relates to offering or monitoring in the EU market.
Access, erasure, a complaint or a letter from the supervisory authority should go through a fixed point of contact in the EU.
Obligation check
When must you designate an EU representative?
Art. 27 GDPR builds on Art. 3(2) GDPR. We check four points.
The question arises for controllers and processors that are not established in the Union but fall within the territorial scope of the GDPR.
Goods or services can be paid or free of charge. Indications are EU target markets, delivery to the EU, euro prices, EU languages or country-specific targeting.
Analytics, profiling, behavioural advertising, app analytics or user segmentation can be enough if the behaviour takes place in the EU.
The exception for occasional processing without special risks is narrow. Special categories of data, data on criminal offences or large-scale processing argue against it.
Review questions
Where does a designation fail in practice?
In our experience, mistakes arise from an overly formal view of the role. It becomes critical when the privacy policy, RoPA, internal responsibility and actual EU targeting do not fit together.
The company believes Art. 27 GDPR only applies to EU citizens. The standard is people located in the EU.
Mere accessibility of a website is not enough. But euro prices, EU languages, delivery areas, customer references or analytics can clearly indicate EU targeting.
The representative must be reachable and involved. Without a mandate, information flow and connection to the documentation, the designation remains open to challenge.
EU representative, external data protection officer, processor and data protection adviser are different functions. We check conflicts of interest before the designation.
Documents
What information does the check need?
The more precisely the starting situation is described, the faster we clarify the obligation and the mandate.
- Registered office of the company
EU countries with customers, users or target markets Websites, apps, platforms or sales channels Languages, currencies, delivery areas and EU campaigns
Role as controller or processor Data types and categories of data subjects Analytics, profiling or automated evaluation Privacy notices, RoPA and data processing agreements
Legal framework
Which provisions apply to the EU representative?
Under Art. 3(2) GDPR, the Regulation also applies to companies without an establishment in the Union. The condition is that they offer goods or services to people in the Union or monitor their behaviour there.
In these cases, Art. 27(1) GDPR requires the written designation of a representative in the Union. Under Art. 27(2) GDPR, processing is exempt if it is occasional, does not include large-scale processing of special categories of data and is unlikely to result in a risk.
Under Art. 27(3) GDPR, the representative must be established in a Member State where data subjects are located. Under Art. 27(4) GDPR, they are the point of contact for supervisory authorities and data subjects.
Under Art. 13 and 14 GDPR, the name and contact details of the representative belong in the privacy notices. Under Art. 30(1) GDPR, they are also included in the record of processing activities. Under Art. 83(4)(a) GDPR, an infringement of Art. 27 GDPR can be punished with a fine.
- General Data Protection Regulation (EUR-Lex) Official text, in particular Art. 3, Art. 4(17), Art. 27, Art. 30 and Art. 83 GDPR.
- EDPB Guidelines 3/2018 on territorial scope Guidelines of the European Data Protection Board on Art. 3 and on designation under Art. 27 GDPR.
- DSK short paper no. 7: market location principle Guidance from the German supervisory authorities for companies outside the EU.
Limits
What does the EU representative not do?
The representative is a point of contact. The obligations under the GDPR remain with the company.
- 1
No transfer of responsibility Legal bases, transparency, data subject rights, security and management of service providers remain the company's task.
- 2
Not a data protection officer The data protection officer has an independent monitoring and advisory function. We review both roles separately.
- 3
No decision of the authority We are the point of contact. A supervisory authority decides for itself which measures it takes.
Mistakes that make the designation open to challenge
- The representative is named in the privacy notices but does not know the processing.
- Enquiries from authorities end up in a general inbox without a deadline note.
- The RoPA names no representative or a different one from the privacy notices.
- The obligation is denied without the reasoning being documented.
Your contact
Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“The ITMR lawyers gave me excellent advice on data protection for my website. Professional, friendly and tailored solutions. Any time again! Absolutely recommended!” (translated from German)
“Very friendly and helpful staff. The advice is always competent and easy to understand. I always felt in good hands and taken seriously. Clear recommendation!” (translated from German)
“We have come to know Mr Bohne as a very competent, uncomplicated lawyer who responds to enquiries quickly and clearly, so that even laypeople understand. What we also value highly: proactive information when the law changes.” (translated from German)
FAQ
What do companies ask before the designation?
Does every company outside the EU with EU customers need a representative?
Not automatically. It depends on whether the processing relates to offering goods or services to people in the EU or to monitoring their behaviour. We also check the exception under Art. 27(2) GDPR.
Is it enough that our website can be accessed in the EU?
Mere accessibility is not enough on its own. What matters are indications such as EU delivery areas, euro prices, EU languages, EU campaigns, references to customers or analytics.
Does the EU representative have to be based in Germany?
They must be established in a Member State where the data subjects are located. Germany fits if your EU connection includes Germany.
Is the EU representative the same as a data protection officer?
No. The representative is a point of contact under Art. 27 GDPR. The data protection officer advises and monitors independently under Art. 37 to 39 GDPR.
Must the representative be named in the privacy policy?
Yes, if the obligation applies. Under Art. 13 and 14 GDPR, the name and contact details belong in the privacy notices and, under Art. 30 GDPR, in the record.
What should we prepare before the designation?
An overview of the EU markets, the processing concerned, your role, the privacy notices, the status of the RoPA, the services used and internal contacts.
Do you also check whether there is no obligation at all?
Yes. In borderline cases, the obligation check is the first step. If there is no obligation, we document the reasoning so that customer, audit and authority enquiries can be answered in an orderly way.
Next step
Do you need to designate an EU representative?
Tell us your registered office, EU markets and offering. We check the obligation, draft the mandate and take on the representation.
Helpful for your enquiry
- Registered office of the company
- EU countries with customers or users
- Link to website or app
- Privacy notices or RoPA
You can also submit documents after our first response.
Have the Art. 27 obligation checked
State your registered office, EU markets and offering. We assess whether you need to designate an EU representative.
Helpful are your registered office, EU target markets, website or app, privacy notices and any existing customer or authority enquiries.
Related services
Data protection law GDPR obligations, data subject rights, data protection organisation and contact with authorities.Data transfer Data transfers to third countries, standard contractual clauses and transfer assessments.record of processing activities Document processing and demonstrate it to customers and authorities.Data processing agreement Roles, instructions, technical measures and sub-processors.Data protection audit Data protection set-up before market entry, due diligence or customer audits.Help with the supervisory authority When a letter, deadline or complaint has already arrived.External data protection officer Appoint an external DPO.Cross-border advice Plan EU market entry.