GDPR Article 27: when a business outside the EU needs a GDPR representative

The GDPR covers what you do with your customers’ names, addresses and emails (GDPR Art. 3(2)(a)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 2, point (a)Click opens the article on EUR-Lex.). Your representative is the one the authorities and your customers can contact in addition to or instead of you (Art. 27(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 1Click opens the article on EUR-Lex., Art. 27(4)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 4Click opens the article on EUR-Lex.).

When the GDPR reaches a business outside the EU

The GDPR has applied since 25 May 2018 (Art. 99(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 99, paragraph 2Click opens the article on EUR-Lex.). It reaches a business outside the EU through one article:

“This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.” (Art. 3(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 2Click opens the article on EUR-Lex.)

Three things must meet.

You process personal data. A customer’s name, postal address, email and phone number are personal data, because they identify a person (Art. 4(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 4, point 1Click opens the article on EUR-Lex.). Collecting, storing, using or passing them to a courier is processing (Art. 4(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 4, point 2Click opens the article on EUR-Lex.). Every order you ship yourself carries them.

The people are in the EU. What counts is where the person is when you offer the goods, not their nationality or residence. The European Data Protection Board (EDPB), the body of the EU’s data protection authorities, says so in its Guidelines 3/2018 on territorial scope.

You offer them goods on purpose. The test is whether it is apparent that you envisage selling to people in one or more EU countries (Recital 23). The EDPB lists the signs, to be weighed together:

No single sign settles it. The EDPB says that several of them “if taken alone may not amount to a clear indication” of an intention to offer goods to people in the EU, and that the question is whether the combination of them, weighed on the facts, amounts to such an offer. A listing priced in euros, orderable in an EU language and shipped to EU addresses carries several at once. The EDPB’s own example is a business in Turkey that makes photo albums, runs its site in four EU languages, takes euros and delivers to France, Benelux and Germany: it offers its services to people in the EU, falls under Article 3(2)(a)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 2, point (a)Click opens the article on EUR-Lex., and “will have to designate a representative in the Union”.

The second trigger, monitoring, can reach a shop too, where you track people for a purpose such as profiling them or targeting them with ads. The EDPB names “Online tracking through the use of cookies or other tracking techniques such as fingerprinting” and “Behavioural advertisement” among monitoring activities (Art. 3(2)(b)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 2, point (b)Click opens the article on EUR-Lex., Recital 24). It also says that not every online collection or analysis of personal data counts as monitoring: what decides it is your purpose, and any behavioural analysis or profiling that follows. A cookie that only keeps the basket working is not monitoring.

What changes if you have an establishment in the EU

Then the GDPR applies to the processing carried out “in the context of the activities” of that establishment (Art. 3(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 1Click opens the article on EUR-Lex.). For that processing Art. 3(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 2Click opens the article on EUR-Lex. does not apply, and Art. 27Regulation (EU) 2016/679, General Data Protection RegulationArticle 27Click opens the article on EUR-Lex. asks for no representative. Whether your order handling is carried out in the context of the establishment’s activities is decided case by case, on the facts: the EDPB reads the link broadly, but not so broadly that any presence in the EU with “even the remotest links” to your processing is enough. “Establishment implies the effective and real exercise of activity through stable arrangements”, and a branch or a subsidiary can both be one (Recital 22). The EDPB adds that one employee or agent acting with enough stability can be enough for a business that works online, and that a representative appointed under Article 27Regulation (EU) 2016/679, General Data Protection RegulationArticle 27Click opens the article on EUR-Lex. is not an establishment.

When you must name a representative

“Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.” (Art. 27(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 1Click opens the article on EUR-Lex.)

The EDPB is plain about the consequence: a business outside the EU that falls under Article 3(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 2Click opens the article on EUR-Lex. and names no representative “would therefore be in breach of the Regulation”.

How the exemption works, and why a shop rarely fits it

Article 27(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 2Click opens the article on EUR-Lex. lifts the duty in two cases. One is a public authority or body (point (b)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 2, point (b)Click opens the article on EUR-Lex.). The other is the only one open to a business, and it needs all three of these at once (point (a)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 2, point (a)Click opens the article on EUR-Lex.):

Miss one and the exemption is gone. The first condition is the one a shop cannot meet: for the EDPB a processing activity is occasional only if it “is not carried out regularly, and occurs outside the regular course of business or activity of the controller or processor”. Taking and shipping orders from EU buyers is the regular course of an online shop’s business.

What the representative does

A representative is “a natural or legal person established in the Union” who, designated by you in writing under Article 27Regulation (EU) 2016/679, General Data Protection RegulationArticle 27Click opens the article on EUR-Lex., represents you for your obligations under the GDPR (Art. 4(17)Regulation (EU) 2016/679, General Data Protection RegulationArticle 4, point 17Click opens the article on EUR-Lex.). Its work:

• It is your address in the EU. You mandate it “to be addressed in addition to or instead of” you, by the data protection authorities and by the people whose data you hold, on all issues related to processing (Art. 27(4)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 4Click opens the article on EUR-Lex.). The EDPB expects it to pass requests between them and you so that people’s rights work in practice, in the language of the authority or the person where that is not a disproportionate effort.
• It keeps your record of processing activities alongside you, and hands it to an authority on request (Art. 30(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 30, paragraph 1Click opens the article on EUR-Lex., Art. 30(4)Regulation (EU) 2016/679, General Data Protection RegulationArticle 30, paragraph 4Click opens the article on EUR-Lex.). You write and update the record; it keeps a current copy (EDPB). The exemption for businesses with fewer than 250 employees does not help a shop, because it falls away where the processing is not occasional (Art. 30(5)Regulation (EU) 2016/679, General Data Protection RegulationArticle 30, paragraph 5Click opens the article on EUR-Lex.).
• It answers an authority’s orders for information (Art. 58(1)(a)Regulation (EU) 2016/679, General Data Protection RegulationArticle 58, paragraph 1, point (a)Click opens the article on EUR-Lex.).

It does not take your liability. Naming it “shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves” (Art. 27(5)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 5Click opens the article on EUR-Lex.). The EDPB adds that authorities may address corrective measures and fines imposed on you to the representative, while holding it directly liable only for its own duties under Article 30Regulation (EU) 2016/679, General Data Protection RegulationArticle 30Click opens the article on EUR-Lex. and Article 58(1)(a)Regulation (EU) 2016/679, General Data Protection RegulationArticle 58, paragraph 1, point (a)Click opens the article on EUR-Lex..

Who can be the representative, and where

• Where: in one of the EU countries where the people whose data you process are (Art. 27(3)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 3Click opens the article on EUR-Lex.). If most of your EU customers are in one country, the EDPB recommends that country, and the representative must stay easy to reach from the others.
• Who: any person or company based in the EU, under a service contract: the EDPB names law firms, consultancies and private companies. One representative can act for several businesses, and a company acting as one should name a single lead contact for you.
• How many: one, for all your processing that falls under Article 3(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 2Click opens the article on EUR-Lex.. The EDPB says you are not expected to name a separate representative for each processing activity.
• Not these: the EDPB holds that the role cannot be combined with that of your external data protection officer, or with that of your processor, such as a service that handles your customer data for you.
• The paper: a written mandate (Art. 27(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 1Click opens the article on EUR-Lex., Recital 80). No authority needs to be notified (EDPB).

If you also sell to people in the United Kingdom, the UK GDPR has its own Article 27, which requires a representative “in the United Kingdom”. An EU representative does not cover it. The UK rule is on UK GDPR representative.

Where its name must appear

When you collect personal data from a customer, you give them, at that moment, “the identity and the contact details of the controller and, where applicable, of the controller’s representative” (Art. 13(1)(a)Regulation (EU) 2016/679, General Data Protection RegulationArticle 13, paragraph 1, point (a)Click opens the article on EUR-Lex.). Where you get the data from someone else, such as a marketplace passing you a buyer’s delivery details, the same information is due (Art. 14(1)(a)Regulation (EU) 2016/679, General Data Protection RegulationArticle 14, paragraph 1, point (a)Click opens the article on EUR-Lex.) within a reasonable period and at the latest within one month; if you use the data to contact that person, at the latest at your first communication; and if you pass the data on to another recipient, at the latest when you first disclose them (Art. 14(3)Regulation (EU) 2016/679, General Data Protection RegulationArticle 14, paragraph 3Click opens the article on EUR-Lex.). Handing a marketplace buyer’s address to a courier is such a disclosure, so for most orders the information is due by the time the buyer’s details first go to the courier.

In practice that means your privacy notice. The EDPB’s own example puts the name and contact details of the business and its representative in the information shown online once a customer starts using the service, and in the website’s general privacy notice. It also wants the details easy for authorities to find. A business that leaves the representative out is in breach of its transparency obligations, in the EDPB’s words.

Why it is not the GPSR responsible person

The two roles share a word and nothing else. A marketplace that blocks a listing wants the product-safety role; a GDPR representative does not unblock it.

One company may offer both, but each needs its own mandate under its own law. What the product role asks of you is on the EU Responsible Person, and the three roles that get mixed up are set side by side on EU authorised representative. A VAT tax representative is a different role again, with its own law: fiscal representative.

What happens if you do nothing

Failing to designate a representative breaks Article 27Regulation (EU) 2016/679, General Data Protection RegulationArticle 27Click opens the article on EUR-Lex., one of the articles fined at the lower tier: up to EUR 10 000 000, or for a business up to 2% of its total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4)(a)Regulation (EU) 2016/679, General Data Protection RegulationArticle 83, paragraph 4, point (a)Click opens the article on EUR-Lex.). Leaving the representative out of the information you give customers breaks Article 13Regulation (EU) 2016/679, General Data Protection RegulationArticle 13Click opens the article on EUR-Lex. or Article 14Regulation (EU) 2016/679, General Data Protection RegulationArticle 14Click opens the article on EUR-Lex., which sit in the upper tier: up to EUR 20 000 000 or 4% (Art. 83(5)(b)Regulation (EU) 2016/679, General Data Protection RegulationArticle 83, paragraph 5, point (b)Click opens the article on EUR-Lex.). Every fine is set case by case, weighed on the factors of Article 83(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 83, paragraph 2Click opens the article on EUR-Lex., and must be “effective, proportionate and dissuasive” (Art. 83(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 83, paragraph 1Click opens the article on EUR-Lex.). An authority can also order you to bring your processing into line (Art. 58(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 58, paragraph 2Click opens the article on EUR-Lex.).

Without an establishment in the EU you also have no lead authority. The one-stop shop of Article 56(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 56, paragraph 1Click opens the article on EUR-Lex. works through a main or single establishment, and the EDPB confirms that a business without one “cannot benefit from” it. So the authority of each EU country where you have customers can act on its own.

The duty is enforced on its own. The Dutch data protection authority fined Locatefamily.com, a website based outside the EU that published people’s addresses and phone numbers, EUR 525,000 for not designating a representative, in breach of Article 27(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 1Click opens the article on EUR-Lex. read with Article 3(2)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 2Click opens the article on EUR-Lex.. The decision is dated 10 December 2020 and was announced on 12 May 2021. It came with an order to designate one, backed by EUR 20,000 for every two weeks of delay, up to EUR 120,000 (Autoriteit Persoonsgegevens, decision, in Dutch).

What you can skip

What the law leaves open

• Whether stock in someone else’s EU warehouse makes you established in the EU. The GDPR does not define establishment. Article 3(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 1Click opens the article on EUR-Lex. turns on “the effective and real exercise of activity through stable arrangements” (Recital 22), and the EDPB guidelines do not address goods stored by a fulfilment service under its own contract. Meanwhile, designate a representative: if you turn out to be established, the GDPR applies to you directly and the representative did no harm; if you are not, you have met Article 27(1)Regulation (EU) 2016/679, General Data Protection RegulationArticle 27, paragraph 1Click opens the article on EUR-Lex..
• Whether selling only to businesses is an offer to “data subjects”. Article 3(2)(a)Regulation (EU) 2016/679, General Data Protection RegulationArticle 3, paragraph 2, point (a)Click opens the article on EUR-Lex. speaks of offering goods to the people whose data you process, and the EDPB guidelines give no example of a seller outside the EU that sells only to companies. Meanwhile: a sole trader or a self-employed buyer is a person, so selling to them is selling to people in the EU.