GDPR Art. 27 EN

Representatives of controllers or processors not established in the Union

Territorial scope (GDPR)

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.

Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.¶

Representatives Processors Controllers 91
2.
The obligation laid down in paragraph 1 of this Article shall not apply to:¶

4
1. a)
  processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or ¶
  Special Categories of Data Criminal Data Types of Special Categories of Personal Data
2. b)
  a public authority or body. ¶
  Public Authority Public Sector
3.

The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.¶

Representatives Territorial scope (GDPR) Personal Data 3
4.

The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.¶

Representatives Processors Supervision 4
5.

The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.¶

Representatives Processors Controllers 5

Enforcement

Cited in 19 fines totalling €2.9M

Top authority: 🇪🇺Croatian Data Protection Authority (azop) (12) · median fine €3,343 · see all enforcement for Art. 27 →

Connections by provision

27(1) 87 Case Law 4 Guidance .md

Case Law 87

VOLKER UND MARKUS SCHECKE GBR V. LAND HESSEN, EIFERT V. LAND HESSEN AND BUNDESANSTALT FUR LANDWIRTSCHAFT UND ERNAHRUNG, 9.Nov.2010 (“SCHECKE”) Order of the Vice-President of the Court of 14 July 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Independence of the Izba Dyscyplinarna (Disciplinary Chamber) of the Sąd Najwyższy (Supreme Court, Poland) – Charter of Fundamental Rights of the European Union – Article 47 – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of quest Order of the Vice-President of the Court of 27 October 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of questions of law concerning the lack of independence of judges – Periodic penalty payment.#Case C-204/21 R Order of the Vice-President of the Court of 21 April 2023.#European Commission v Republic of Poland.#Interim relief – Article 163 of the Rules of Procedure of the Court of Justice – Application to cancel or vary an order for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Non-execution – Change in circumstances – Periodic penalty payment.#Case C-204/21 R- Judgment of the Court (Grand Chamber) of 5 June 2023.#European Commission v Republic of Poland.#Failure of a Member State to fulfil obligations – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union ‐ Rule of law – Effective legal protection in the fields covered by EU law – Independence of judges – Article 267 TFEU – Possibility of making a reference to the Court for a preliminary ruling – Primacy of EU law – Jurisdiction in relation t ¶92 Order of the Vice-President of the Court of 21 April 2023.#European Commission v Republic of Poland.#Interim relief – Article 163 of the Rules of Procedure of the Court of Justice – Application to cancel or vary an order for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Non-execution – Change in circumstances – Periodic penalty payment.#Case C-204/21 R- ¶151 Order of the Vice-President of the Court of 21 April 2023.#European Commission v Republic of Poland.#Interim relief – Article 163 of the Rules of Procedure of the Court of Justice – Application to cancel or vary an order for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Non-execution – Change in circumstances – Periodic penalty payment.#Case C-204/21 R- ¶144 Order of the Vice-President of the Court of 21 April 2023.#European Commission v Republic of Poland.#Interim relief – Article 163 of the Rules of Procedure of the Court of Justice – Application to cancel or vary an order for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Non-execution – Change in circumstances – Periodic penalty payment.#Case C-204/21 R- +79 more

Guidance 4

EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) Opinion 20/2021 on Tobacco Traceability System EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB comments on European Commission's Guidelines on Art. 28 DSA

27(2) 4 Guidance .md

Guidance 4

EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

27(2)(a) 2 Case Law 1 Guidance .md

Case Law 2

Judgment of the General Court (Fourth Chamber) of 20 July 2016 (Extracts).#Athanassios Oikonomopoulos v European Commission.#Non-contractual liability — Damage caused by the Commission in the context of an OLAF investigation and by OLAF — Actions for damages — Action for a declaration that certain measures taken by OLAF were void and inadmissible for evidentiary purposes before the national authorities — Admissibility — Misuse of powers — Processing of personal data — Rights of the defence.#Case ¶107 Judgment of the General Court (Fourth Chamber) of 20 July 2016 (Extracts).#Athanassios Oikonomopoulos v European Commission.#Non-contractual liability — Damage caused by the Commission in the context of an OLAF investigation and by OLAF — Actions for damages — Action for a declaration that certain measures taken by OLAF were void and inadmissible for evidentiary purposes before the national authorities — Admissibility — Misuse of powers — Processing of personal data — Rights of the defence.#Case

Guidance 1

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

27(3) 2 Guidance 1 Literature .md

Guidance 2

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act)

Literature 1

If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

27(4) 2 Case Law 1 Guidance 1 Literature .md

Case Law 2

Judgment of the Court (Fourth Chamber) of 16 December 2021.#Criminal proceedings against HP.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Judicial cooperation in criminal matters – European Investigation Order (EIO) – Directive 2014/41/EU – Article 2(c)(i) – Concept of ‘issuing authority’ – Article 6 – Conditions for issuing an EIO – Article 9(1) and (3) – Recognition of an EIO – EIO seeking to obtain traffic and location data ass ¶33 Judgment of the Court (Fourth Chamber) of 16 December 2021.#Criminal proceedings against HP.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Judicial cooperation in criminal matters – European Investigation Order (EIO) – Directive 2014/41/EU – Article 2(c)(i) – Concept of ‘issuing authority’ – Article 6 – Conditions for issuing an EIO – Article 9(1) and (3) – Recognition of an EIO – EIO seeking to obtain traffic and location data ass

Guidance 1

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Literature 1

Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)?

27(5) 4 Guidance 1 Literature .md

Guidance 4

Guidelines 9/2022 on personal data breach notification under GDPR Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) ¶76 Guidelines 9/2022 on personal data breach notification under GDPR ¶138 Guidelines 9/2022 on personal data breach notification under GDPR

Literature 1

If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

Related across sources

Enforcement Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B Literature Perspectives for Open Source AI Guidance Opinion 13/2026 on the draft decision of the Office of the Data Protection Ombudsman (FI SA) regarding the approval of the requirement for accreditation of a certification body pursuant to Article 43(3) GDPR Guidance Opinion 14/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR Guidance Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria Enforcement AEPD sanctions 23andMe for security failures in credential-stuffing breach