EU Representatives under Article 27 GDPR

Art. 27 GDPR EU Representatives

More about EU Representatives

Questions and Answers about EU Representatives

What are EU Representatives?
Is it mandatory to appoint an EU Representative?
What do EU Representatives do?
What is the difference between EU Representative and Data Protection Officer?
Do EU Representatives have to reside in the EU in order to comply with GDPR?
How to communicate with the EU Representative team?
How to appoint an EU Representative?

What are EU Representatives?

EU Representatives under Article 27 GDPR are designated by a controller or processor outside the EU. They liaise with the data subjects, act on behalf of the controller or processor within the EU and may be addressed by and cooperate with supervisory authorities to ensure compliance with the GDPR.

Is it mandatory to appoint an EU Representative?

Yes, designation of EU Representatives under the GDPR is mandatory if you process personal data in any of the following cases:

1. When offering goods or services in the EU, irrespective of whether it is free of charge or a payment is required.
2. When monitoring the behaviour of data subjects as far as their behaviour takes place within the EU.

In order to establish an exemption the nature, context, scope and purpose of the processing must be considered. The appointment of an EU Representative is not required if:

1. the processing is carried out by a public body, or
2. processing is occasional and does not include special categories of personal data or data relating to criminal convictions and offences and is unlikely to result in a risk to the rights and freedoms of data subjects.

What do EU Representatives do?

Under GDPR, EU Representatives are the direct point of contact for data subjects. They may be addressed by supervisory authorities and are authorized to receive legal documents on behalf of the controller or the processor. Under Art. 27 GDPR, the EU Representative acts on behalf of the controller or the processor regarding their obligations under GDPR. The EU Representative is the point of contact for data subjects and, as an authorised recipient, they are the addressee for supervisory authorities to receive applications, legal documents, data subject access requests and official instructions. The Representative works with the relevant supervisory authorities to ensure the controller or the processor are compliant with GDPR: Inter alia, the Representative keeps documentation on data privacy breaches and provides evidence of lawful consent according to Art. 27 (4) GDPR. Pursuant to Art. 30 (1) to (3) GDPR, EU Representatives act for the controller or the processor in their duty to maintain a record of processing activities and data processing contracts, making these records available to the supervisory authorities upon request.

What is the difference between EU Representative and Data Protection Officer?

An EU Representative should not be confused with a Data Protection Officer within the meaning of Art. 37 GDPR. Both have different tasks and duties: A Data Protection Officer advises the company on data protection issues and must promote a compliance culture. The EU Representative is merely a point of contact, subject to a mandate and instructions from the company. They are available to receive inquiries and complaints and can keep a record of the processing activities, but beyond that they have no other active duties.

Do EU Representatives have to reside in the EU in order to comply with GDPR?

Yes. Art. 4 No. 17 GDPR defines ‘representative’ as a natural or legal Person established in the Union. In addition, Art. 27(3) GDPR clearly states that the EU Representatives shall be established in one of the EU Member States where the data subjects, whose personal data are processed are. Hence, appointing EU Representatives that do not reside in the EU seems to be in violation of the GDPR.

How to communicate with the EU Representative team

OBSECOM offer their customers various communication options. If you wish, we will forward you information by encrypted or unencrypted e-mail, fax or registered mail. All documents are made available on the OBSECOM communication platform. Data subjects and supervisory authorities can make enquiries about a non-EU organisation for which OBSECOM GmbH has been appointed EU Representative by sending a formal request by registered mail or via the contact form at https://www.obsecom.eu/EU-Representative-Inquiry.

How to appoint an EU Representative?

The appointment is made in writing and is based on a contractual agreement between the controller and the EU Representative. The contact details of the EU Representative must be shared in the privacy notice, but notification to the supervisory authorities is not required. You can order the EU Representative online directly via the OBSECOM website. Just follow the link below, select the basic annual program fee and enter your company details. The service will be ready, set up and running within 24 hours of order confirmation. You will receive further information on how to proceed after the service is set up: Click here to order the EU Representative service online.