In short. A non-EU website operator covered by Article 3(2) must appoint an EU representative in writing unless an Article 27(2) exception applies.

Definition: An EU representative under the General Data Protection Regulation (GDPR) is a person or organisation established in the European Union and appointed in writing to act for a website operator on its GDPR obligations. A website operator without an EU establishment must appoint one when its processing falls under Article 3(2), unless an Article 27(2) exception applies.

Key facts

As of October 2026, GDPR Article 27(1) requires a written appointment where Article 3(2) applies, covering relevant offers of goods or services and monitoring of behaviour in the EU.
The European Data Protection Board's territorial-scope guidelines interpret occasional processing as processing that occurs outside the regular course of business and is not carried out regularly.
The Irish Data Protection Commission's register FAQ states that registering an EU representative with the DPC is unnecessary; identity and contact details must be available to individuals and the relevant supervisory authorities.

Which website activities trigger the requirement?

A controller determines why and how personal data is processed. A processor processes that data on the controller's behalf. Personal data means information relating to an identified or identifiable individual, and processing includes collection, storage and use. These definitions appear in GDPR Article 4.

Article 3(2) covers processing by a controller or processor without an EU establishment when it relates to offering goods or services to people in the EU, including free services, or monitoring their behaviour within the EU. Article 27 attaches the appointment obligation to that provision.

The EDPB guidelines, explaining Recital 23, state that mere website accessibility in the EU is insufficient to establish an intention to offer services there. Indicators include using a Member State's language or currency with the possibility of ordering in that language, or mentioning customers in the EU.

When does an exception apply?

GDPR Article 27(2)(a) requires all the following conditions for the processing exception:

The processing is occasional.
It excludes large-scale processing of special categories of personal data, including health data and religious beliefs under Article 9(1), or of criminal-conviction and offence data under Article 10.
It is unlikely to result in a risk to individuals' rights and freedoms, considering its nature, context, scope and purposes.

Article 27(2)(b) separately exempts a public authority or body.

The EDPB's explanation of the exceptions treats regularity and the ordinary course of business as relevant to whether processing is occasional. Its large-scale assessment factors include the number of people concerned, data volume, duration and geographical extent. The risk assessment considers both likelihood and severity; the exemption requires processing unlikely to create a risk, even below a high-risk level.

How is the representative appointed and identified?

GDPR Article 27(3) and (4) requires the representative to be established in a Member State where the relevant individuals are located. The mandate enables individuals and supervisory authorities to address the representative on processing issues. Under Article 27(5), legal actions can still be brought against the controller or processor.

The EDPB guidelines describe appointment through a service contract with an EU-based individual or organisation, including a law firm or consultancy. They require controllers to identify the representative in information supplied at collection and in the website's general privacy notice, applying Articles 13(1)(a) and 14(1)(a).

FAQ

Does being a small business automatically exempt you?

Article 27(2) provides exceptions based on the processing conditions or public-authority status. It sets no employee-count exemption for this appointment obligation.

Do you need a separate representative for each processing activity?

The EDPB guidelines explain that a controller or processor with several activities covered by Article 3(2) can use one representative for those activities. One representative can also act for several non-EU controllers or processors.

Sources

Check how a page reads to answer engines. Open the GEO score analyzer

When does a non-EU website need an EU GDPR representative?