Article 27 GDPR for US Companies: Do You Need an EU Representative?

Summary

A US company needs an EU representative under Article 27 of the GDPR when it offers goods or services to people in the EU, or monitors their behaviour there, and has no EU establishment. Two exemptions apply: occasional low-risk processing and public authorities. The representative is appointed in writing and based in an EU country where those people are.

This guide covers when Article 27 applies to a US business, how targeting is judged, the exemptions, the representative’s role and the separate UK representative rule. US state privacy laws are outside its scope.

Key Takeaways

•  Article 27 follows Article 3(2). A US company with no EU establishment needs a representative if it offers goods or services to people in the EU or monitors their behaviour there.

•  Serving an American who happens to be travelling in Europe does not trigger it. The EDPB treats a US app aimed only at the US market as outside the GDPR.

•  The UK has its own rule. A US company covered by the UK GDPR may also need a representative in the United Kingdom.

When Article 27 Applies to a US Company

Article 27(1) says that where Article 3(2) applies, the controller or processor must designate a representative in the Union in writing. Article 3(2) covers a controller or processor that is not established in the Union when its processing relates to:

•  offering goods or services to people in the Union, whether or not they pay; or

•  monitoring the behaviour of people in the Union, as far as that behaviour takes place there.

The test looks at where the individuals are. Citizenship is not part of it. The European Data Protection Board (EDPB) gives an example of a bank in Taiwan with customers who hold German citizenship but live in Taiwan. Because the bank operates only in Taiwan, the GDPR does not apply to it.

How Targeting Is Judged

The EDPB says that processing the data of someone in the EU is not enough on its own. There must be targeting. Recital 23 says that a website being reachable from the EU, or an email address or contact details being shown, does not show intent to offer services there.

The EDPB’s guidelines on territorial scope list factors that can point towards an offer to people in the EU, and they work best in combination:

•  an EU country is named in connection with the product or service;

•  the company pays for search advertising or runs campaigns aimed at an EU country audience;

•  the site uses an EU country domain such as “.de”, or a neutral one such as “.eu”;

•  the site offers a language or currency of an EU country, with the option to order in it;

•  the company delivers goods to EU countries; and

•  the site mentions customers based in EU countries.

The EDPB’s own examples show the line. A US news app aimed only at the US market, with US dollars as the sole currency, is not subject to the GDPR when an American downloads it on holiday in Europe. A US city-mapping app that offers its service to tourists in Paris and Rome, and uses their location to show targeted adverts, is.

Monitoring Behaviour in the EU

The second trigger covers monitoring. The EDPB lists behavioural advertising, location tracking for marketing, online tracking through cookies or fingerprinting, and health analytics services among the activities that can count.

The EDPB says the monitoring trigger does not require an intention to target. It also says not every online collection of data about people in the EU counts, and that the company’s purpose and any later profiling matter.

One example is a US health and lifestyle app used by people in the EU that records their sleep, weight, and heart rate. The app’s US cloud provider is also caught, as a processor carrying out processing related to that targeting.

The Two Exemptions

Article 27(2) removes the duty for:

• occasional processing, does not include large scale processing of special category data or criminal offence data, and is unlikely to result in a risk to the rights and freedoms of individuals, taking into account its nature, context, scope and purposes; and

•  a public authority or body.

The EDPB reads “occasional” narrowly. It must not be carried out regularly and must fall outside the company’s normal course of business. The risk test refers to any risk, not only high risk. A US business that sells to EU customers as part of its normal trade is unlikely to qualify.

Choosing and Using a Representative

The EDPB says a representative can be an individual or an organisation established in the Union, such as a law firm or consultancy, appointed through a service contract. One representative can act for several non-EU companies. It does not consider the role compatible with that of an external data protection officer or with acting as the company’s processor.

Under Article 27(3), the representative must be established in one of the Member States where the people whose data you process are. If most are in one country, the EDPB recommends choosing a representative there.

Under Article 27(4), supervisory authorities and individuals can address the representative in addition to, or instead of, you. The representative keeps a copy of your Article 30 record of processing activities, which you must keep accurate and supply to them.

You must also name the representative in your privacy notice. Articles 13(1)(a) and 14(1)(a) require the identity and contact details of the controller’s representative, where applicable. The GDPR does not require you to notify the supervisory authority of the appointment.

Responsibility Stays With You

Article 27(5) states that the appointment is without prejudice to legal action against the controller or processor, and Recital 80 says it does not affect their responsibility or liability. The EDPB confirms that the representative is not liable in your place. It also says authorities can start enforcement through the representative, who can be held directly liable only for its own duties under Articles 30 and 58(1)(a).

The UK Has a Separate Rule

The UK GDPR has its own Article 27. It requires a controller or processor covered by Article 3(2) of the UK GDPR to designate in writing a representative in the United Kingdom. It carries the same two exemptions. The UK definition says the representative must be established in the United Kingdom, and the UK text no longer includes the rule on choosing a Member State.

Under the UK version, the regulator and individuals can address the representative. Since 30 September 2026, the text names the Information Commission as the regulator.

A US company serving customers on both sides of the Channel may therefore need two representatives, one in the EU and one in the UK. Our UK representative service covers the second.

Conclusion

For a US company, the question is whether you offer goods or services to people in the EU or track their behaviour there. If you do, and no exemption applies, appoint a representative in writing, name them in your privacy notice and check whether the UK rule applies as well.

We are updating this guide because the original quoted a specific fine amount, referred to EU citizens where the law covers people in the Union, and used American spelling. It also left out the UK representative rule. For help with either appointment, see our Article 27 EU Representative service or speak to our GDPR consultants.

Frequently Asked Questions

Does a US Company Need an EU Representative if EU Visitors Can Reach Its Website?

Not by that fact alone. Recital 23 says that a website being reachable in the EU does not show intent to offer services there. Factors such as EU languages, euro pricing, delivery to EU countries or tracking of EU visitors can change the answer.

Does a US Company With an EU Representative Still Answer to EU Regulators?

Yes. The representative is the point of contact, and Article 27(5) keeps legal action against the company itself open. The EDPB says the representative is not liable in the company’s place.

Do We Need a UK Representative as Well?

Possibly. If the UK GDPR applies to your processing under its Article 3(2) and no exemption covers you, the UK GDPR requires a representative established in the United Kingdom. This is separate from the EU appointment.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.