EU Representative for Chinese Companies: GDPR Article 27 Explained

A company based in China that sells to customers in Europe must, in many cases, appoint a representative in the European Union under Article 27 of the GDPR. Sila International Advisory, led by Younes (legal consultant specialising in GDPR and external DPO services), explains who is affected, what the representative does and how to become compliant.

An online store shipping to Europe, a marketplace seller, an app offered in European languages, a SaaS platform, a game or an AI service. EDPB Guidelines 3/2018 point to targeting factors such as site language, payment in euros, delivery to the EU and references to European customers. Mere accessibility of your website from Europe is not enough. Tracking the behaviour of people in the EU (cookies, analytics, profiling) can however count as monitoring.

The representative acts as a contact point for data protection authorities and individuals, in addition to you or instead of you (Article 27(4)). It is appointed by written mandate, established in a Member State where the individuals are, and helps maintain your records of processing (Article 30). Its identity and contact details must appear in your privacy notice (Article 13).

Note that a representative is neither a DPO nor a substitute for your compliance. The designation does not prevent action against you (Article 27(5)).

A breach of Article 27 can lead to an administrative fine of up to 10 million euros or 2% of worldwide turnover (Article 83(4)). The practical risk often arrives faster than the fine: urgent measures and service restrictions. A public example: DeepSeek only designated its representative in late May 2025, almost five months after the Italian authority's decision (source: IAPP).

If you also process data collected in China, the Chinese PIPL requires covered foreign companies to set up an entity or appoint a representative in China (Article 53). According to several law firm analyses, it has no exemptions equivalent to those of Article 27. The two regimes can therefore stack.

First, check whether the GDPR applies to you by listing your markets, languages, payment methods and tracking tools. Second, choose a representative that is reachable, responsive and able to deal with authorities. Third, sign a written mandate. Fourth, update your privacy notice and your records of processing.

My online store sells from Shenzhen to French customers: do I need an EU representative?

Probably yes, if you target customers in the EU (language, euros, delivery). A review of your case confirms or rules out the obligation.

Is one representative enough for the whole EU?

Yes. You designate one representative established in one of the Member States where the individuals are (EDPB Guidelines 3/2018).

Is the representative liable instead of me?

No, it does not replace your compliance. Recital 80 of the GDPR does provide that it may be subject to enforcement proceedings if the controller fails to comply, so choose carefully.

Is an EU representative the same as a DPO?

No. The representative is a contact point for a company outside the EU. The DPO monitors compliance, internally or externally. The two roles are distinct.

How much does an Article 27 representative cost?

The price depends on the number of processing activities, the countries targeted and the service level. Sila does not publish a price list: a scoping call, free of charge, is followed by a tailored quote within 48 hours.