According to Art. 27 of the European Union’s General Data Protection Regulation, most companies outside the EU have to designate a representative in the EU if they process personal data of EU residents and do not maintain an establishment in the EU (such as a branch, representative office or other unincorporated presence — which most companies try to avoid for tax reasons). With this requirement, the EU wants to increase the chances for data protection authorities to reach and sanction foreign companies that could otherwise be difficult to get ahold of.
Art. 27 GDPR
Representatives of controllers or processors not established in the Union
- Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
- The obligation laid down in paragraph 1 of this Article shall not apply to:
a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to
in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to
result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the
processing; or
b) a public authority or body
3. The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.
4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.
