Article 27: Representatives of controllers or processors not established in the Union

Praxikon tracks Article 27 (Representatives of controllers or processors not established in the Union) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Official text

Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.

The obligation laid down in paragraph 1 of this Article shall not apply to: (a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or (b) a public authority or body.

The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.

The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.

The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Cross-references

Art. 3: Territorial scope Art. 9: Processing of special categories of personal data Art. 10: Processing of personal data relating to criminal convictions and offences

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Guidelines (1)

12 November 2019 · v2.1 · EDPB
Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
Describes when the GDPR applies to organisations inside and outside the EEA, based on establishment or on offering goods or services and monitoring behaviour, and when an EU representative is required.

Fines (1)

16 May 2024 · Dutch Data Protection Authority€30,500,000
Clearview AI: illegal database of face prints
Clearview scraped billions of photos from the internet and turned faces into biometric codes, without a legal basis and in breach of the ban on processing biometric data. It did not inform people, ignored access requests and had no representative in the EU.
Decision of 16 May 2024, announced on 3 September 2024. Clearview did not object, so the fine is final. The AP imposed no separate fine for the missing EU representative (Article 27).

Checked on 5 November 2026

← Art. 26: Joint controllers Art. 28: Processor →

Connections

Guidelines

Guidelines 9/2022 on personal data breach notification under GDPR
2023-03-28 · final, European Data Protection Board (EDPB)

Enforcement and fines

Clearview AI: 30.5 million euro fine and penalty orders for illegal facial database
2024-05-16 · final, Autoriteit Persoonsgegevens