Representatives of controllers or processors not established in the Union

Territorial scope (GDPR)

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.

Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.¶

Representatives Processors Controllers 114
2.
The obligation laid down in paragraph 1 of this Article shall not apply to:¶

26
1. a)
  processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or ¶
  Criminal Data Types of Special Categories of Personal Data Personal Data
2. b)
  a public authority or body. ¶
  Public Authority
3.

The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.¶

Territorial scope (GDPR) Representatives Personal Data 4
4.

The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.¶

Processors Controllers Representatives 7
5.

The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.¶

Representatives Processors Controllers 5

Enforcement

Cited in 20 fines totalling €3.1M

Top authority: 🇪🇺Croatian Data Protection Authority (azop) (12) · median fine €3,500 · see all enforcement for Art. 27 →

Connections by provision

27(1) 87 Case Law 15 Enforcement 12 Guidance .md

Case Law 87

European Commission v Republic of Poland CJEU: Processing of beneficiary data not based on consent; individuals must be informed European Commission v Republic of Poland European Commission v Republic of Poland European Commission v Republic of Poland ¶255 European Commission v Republic of Poland ¶97 European Commission v Republic of Poland ¶63 European Commission v Republic of Poland +79 more

Enforcement 15

CROATIA DPA: Insufficient fulfilment of information obligations Garante per la protezione dei dati personali (Italy) - 487/2026 Retailer: Insufficient fulfilment of information obligations Betting place: Insufficient fulfilment of information obligations Car dealership: Insufficient fulfilment of information obligations HDPA (Greece) - 12/2026 Character Technologies Inc.: Non-compliance with general data processing principles Clearview AI Inc.: Non-compliance with general data processing principles +7 more

Guidance 12

Opinion 20/2021 on Tobacco Traceability System EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation ¶105 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶95 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶17 Opinion 20/2021 on Tobacco Traceability System ¶75 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) +4 more

27(2) 10 Enforcement 16 Guidance .md

Enforcement 10

Retailer: Insufficient fulfilment of information obligations Fish market: Insufficient fulfilment of information obligations Retailer: Insufficient fulfilment of information obligations Retailer: Insufficient fulfilment of information obligations Retailer: Insufficient fulfilment of information obligations Betting place: Insufficient fulfilment of information obligations Jewelry manufacturer: Insufficient fulfilment of information obligations Garante per la protezione dei dati personali (Italy) - 487/2026 +2 more

Guidance 16

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria ¶75 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) ¶33 Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria ¶103 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 +8 more

27(2)(a) 2 Guidance .md

Guidance 2

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) ¶77 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

27(3) 4 Guidance .md

Guidance 4

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) ¶76 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) ¶75 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

27(4) 2 Case Law 2 Enforcement 2 Guidance 1 Literature .md

Case Law 2

Criminal proceedings against HP ¶33 Criminal proceedings against HP

Enforcement 2

Alpha Exploration: Non-compliance with general data processing principles ¶2 Alpha Exploration: Non-compliance with general data processing principles

Guidance 2

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) ¶79 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Literature 1

Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)?

27(5) 4 Guidance 1 Literature .md

Guidance 4

Guidelines 9/2022 on personal data breach notification under GDPR Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) ¶76 Guidelines 9/2022 on personal data breach notification under GDPR ¶81 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Literature 1

If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

Related across sources

C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) CJEU Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing

Guidelines 3/2018 territorial scope of the GDPR (Article 3) Guidelines on the territorial scope of the GDPR Guidelines ·EDPB Nov 12, 2019 Territorial scope (GDPR) IP Address Processors

Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL) Google - Global De-linking CJEU Sep 24, 2019 Territorial scope (GDPR) Personal Data Controllers

C-306/21 Komisia za zashtita na lichnite danni and Tsentralna izbiratelna komisia v Koalitsia „Demokratichna Bulgaria - Obedinenie“ In this preliminary ruling, the Court of Justice of the European Union addressed whether the GDPR applies to the processing of personal data during national and European elections… CJEU ·Eighth Chamber Oct 20, 2022 Material scope (GDPR) Supervision Personal Data

451423 French Supreme Court reviews CNIL €35M cookie consent fine against Amazon The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded… Supreme Administrative Court Jun 27, 2022 Consent Cookies Supervision

Guidelines 02/2024 Article 48 GDPR Article 48 GDPR provides that: ' Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to… Guidelines ·EDPB Jun 5, 2025 Controllers Privacy Shield International Transfer