What is a Legal Representative under Article 27 GDPR?
Under Article 27 of the GDPR, businesses that are not established in the EU but target EU residents—either by offering goods or services or monitoring their behavior—are required to appoint a legal representative within the Union. This rule makes sure that non-EU organizations can be reached and held responsible by EU data subjects and regulatory authorities, even though they don't have a physical location in the region.
The GDPR legal representative acts as the primary point of contact for all data protection-related matters. They facilitate communication between the company, EU regulators, and data subjects, handling inquiries, complaints, and regulatory requests. Importantly, while they represent the organization in the EU, they do not make decisions about data processing activities.
Key GDPR Provisions:
- Article 27(1): "Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union."
- Recital 80: "In order to ensure compliance with this Regulation in cases where the controller or the processor is not established in the Union, a representative should be designated by the controller or processor. Any supervisory authority may address the representative, who will act on behalf of the controller or processor. The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation. Such a representative should perform its tasks according to the mandate received from the controller or processor, including cooperating with the competent supervisory authorities on any action taken to ensure compliance with this Regulation."
The representative must be physically established in one of the Member States where the organization’s data subjects reside, ensuring they are readily available for local regulators and individuals seeking assistance or clarification.
Who Must Appoint a Legal Representative?
Not all businesses are obliged to appoint a representative under Article 27 GDPR. Here's who must appoint one:
- Non-EU Businesses: Any organization that processes personal data of EU residents for purposes of offering goods or services or monitoring behavior must appoint a representative unless:
- The processing is occasional and does not include large-scale processing of sensitive data. Large-scale processing generally refers to extensive activities involving a significant volume of data subjects, data sets, or geographic scope. According to the European Data Protection Board (EDPB) guidelines, examples include hospital systems processing patient data, an insurance company handling customer health records, or a search engine processing data on individuals within the EU. These activities typically involve regular and systematic processing that may significantly affect data subjects.
- The organization employs fewer than 250 people, and the processing is not high risk. According to the EDPB guidelines, processing is considered high risk when it involves activities such as large-scale monitoring of individuals, processing sensitive data like health information, or processing data that could significantly impact individuals’ rights and freedoms. Examples include processing biometric data for identification, analyzing sensitive personal data to predict behavior, or conducting systematic surveillance in public spaces. These activities generally require detailed risk assessments and heightened compliance measures, even for small organizations.
Failure to appoint a representative can result in fines and enforcement actions under GDPR. These fines can be significant, with penalties reaching up to €10 million or 2% of the company’s total worldwide annual turnover, whichever is higher, depending on the severity of the violation.
