Sila EU Representative · GDPR Article 27

Your GDPR Representative in the European Union

EU representation for international businesses subject to GDPR Article 27.

Establish your EU representation framework with Sila. We help eligible non-EU businesses assess their Article 27 requirements and organise their representation from France.

Assess Your Article 27 Requirements How the Service Works

Your business, outside the EU
EU representative, France
Supervisory authorities
Data subjects in the EU

The representative is the point of contact in the Union. Responsibility for compliance stays with your business.

Operating in Europe from Outside the EU?

The GDPR does not only apply to businesses established in the Union. Under Article 3(2), it also reaches a controller or processor established elsewhere when its processing relates to people who are in the Union.

A SaaS company selling into Europe

Your platform is marketed to customers in the EU, with pricing in euros, local-language pages or EU-specific terms. Offering services to people in the Union is one of the two criteria in Article 3(2).

A foreign business targeting EU consumers

You ship goods to EU addresses or run campaigns aimed at EU markets. Recital 23 explains that what counts is an apparent intention to offer goods or services in the Union, not the mere accessibility of a website.

A technology company tracking EU users

Your product profiles users, analyses their behaviour or personalises content for people in the Union. Monitoring behaviour that takes place in the Union is the second criterion in Article 3(2).

Not every business outside the EU has to appoint a representative. The obligation depends on whether Article 3(2) applies to your processing, and on whether one of the exemptions in Article 27(2) covers it. That is precisely what the assessment establishes.

Understanding GDPR Article 27

Article 27 is the counterpart of Article 3(2): a business that falls under the GDPR without being established in the Union must give EU authorities and individuals an identified contact inside the Union.

Linked to Article 3(2)

Article 27(1) applies where Article 3(2) applies: a controller or processor not established in the Union whose processing relates to offering goods or services to people in the Union, or to monitoring their behaviour there.

A written designation

The controller or processor must designate its representative in writing. In practice, this takes the form of a written mandate that defines what the representative is authorised to do.

Contact for authorities and data subjects

Under Article 27(4), the representative is mandated to be addressed, in addition to or instead of the controller or processor, by supervisory authorities and data subjects on all issues related to processing. Its contact details are given to data subjects under Articles 13(1)(a) and 14(1)(a).

Established in a relevant Member State

Under Article 27(3), the representative must be established in one of the Member States where the data subjects concerned are located. A representative based in France is a valid choice when your processing concerns people in France.

Two exemptions

Article 27(2) excludes processing that is occasional, does not include large-scale processing of special categories of data (Article 9(1)) or of data relating to criminal convictions and offences (Article 10), and is unlikely to result in a risk to individuals. It also excludes public authorities and bodies.

No transfer of liability

Article 27(5) provides that the designation is without prejudice to legal actions that could be initiated against the controller or processor itself. The representative also maintains a record of processing activities under Article 30(1) and (2) and cooperates with the supervisory authority under Article 31.

Four roles that should not be confused

Article 27 representative: Your contact point in the Union for authorities and data subjects. It does not determine your processing and does not become responsible for your compliance.
Data protection officer (DPO): Advises and monitors compliance under Articles 37 to 39. A different function: the EDPB considers that the role of representative is not compatible with that of external DPO for the same organisation.
Controller and processor: Your business, which determines the purposes and means of processing (controller) or processes on behalf of another (processor). Your obligations remain yours.
General GDPR advice: Mapping, policies, contracts, transfers, impact assessments. Advice is a separate scope of work, offered only where it is contracted for.

Official text of Article 27 on the CNIL website (French)

A Clear Framework for EU Representation

Three distinct services, each with a defined scope. The eligibility assessment, the representation mandate and complementary GDPR support are separate commitments.

One-off engagement

Article 27 Assessment

An initial qualification of whether Article 27 applies to your business and what representation you need.

Analysis of your activity against Article 3(2)
Review of the Article 27(2) exemptions
Identification of the relevant Member States
Written conclusion on the need for a representative

Annual subscription

EU Representative

Representation in the European Union from France, subject to your eligibility, Sila accepting the mandate and the contract being signed.

Written designation and mandate
Contact point for supervisory authorities
Contact point for data subjects
Representative’s record of processing activities (Article 30)
Forwarding of requests to your business

Annual subscription

EU Representative + GDPR Support

Representation together with complementary GDPR support, within a scope defined in the contract.

Everything in EU Representative
Support on data subject requests
GDPR advice within the contractual scope
Scope agreed before signature

Each mandate is accepted after review of your situation. Sila may decline a mandate where the conditions for representation are not met.

From Assessment to Representation

Initial Assessment

We review where your business is established, what you offer in the Union and how you process the data of people located there.

Scope and Requirements Review

We confirm whether Article 27 applies, check the exemptions, identify the Member States concerned and define the scope of the mandate.

Written Mandate and Contract

The designation is made in writing. The mandate and the service contract set out the tasks, the channels of communication and the limits of the mission.

Representation and Ongoing Coordination

Sila acts as your contact point in the Union, keeps the representative’s record of processing up to date and forwards requests to your teams.

Representation begins only once your file has been accepted, the applicable conditions verified and the required documents signed.

Who We Work With

These profiles often meet the Article 3(2) criteria. Whether a given business does depends on its actual activity, not its sector.

SaaS & Technology

Software sold on subscription to EU customers, with user accounts, telemetry and support data.

E-commerce

Online stores delivering to EU addresses, with customer accounts, payments and marketing lists.

Digital Platforms

Marketplaces, apps and communities with EU users, where profiling or recommendation may amount to behavioural monitoring.

International Startups

Teams launching in Europe before setting up a local entity, who need to know what their first EU users trigger.

US and UK Businesses

Since Brexit, a UK business is outside the Union for GDPR purposes, just like a US business, when it targets people in the EU.

Businesses in Any Non-EU Country

Article 27 turns on where your business is established, not which country it is. Wherever you are based outside the Union, the same criteria apply.

Frequently Asked Questions

What is a GDPR Article 27 representative?

A natural or legal person established in the Union, designated in writing by a controller or processor not established in the Union, which represents it with regard to its obligations under the GDPR (Article 4(17)). Under Article 27(4), it is the contact point for supervisory authorities and data subjects on all issues related to processing.

Does my non-EU company need an EU GDPR representative?

Only if two conditions are met. First, Article 3(2) must apply: your processing relates to offering goods or services to people in the Union, or to monitoring their behaviour there. Second, none of the Article 27(2) exemptions must apply. A company outside the EU with no such processing has no Article 27 obligation.

Who is exempt from appointing an Article 27 representative?

Article 27(2) exempts public authorities and bodies, and processing that is occasional, does not include large-scale processing of special categories of data under Article 9(1) or of data relating to criminal convictions and offences under Article 10, and is unlikely to result in a risk to the rights and freedoms of individuals. The three conditions of the first exemption are cumulative.

Can an EU representative be based in France?

Yes, provided France is one of the Member States where the data subjects concerned are located (Article 27(3)). If your processing concerns people in several Member States, the representative may be established in any one of them; it then deals with authorities and individuals in the other Member States as well.

What does an Article 27 representative actually do?

It receives and handles communications from supervisory authorities and data subjects on your behalf (Article 27(4)), maintains a record of the processing activities carried out under your responsibility (Article 30(1) and (2)), and cooperates with the supervisory authority on request (Article 31). It acts within the limits of its written mandate.

Is an EU representative the same as a DPO?

No. The data protection officer advises the organisation and monitors its compliance (Article 39). The representative is a contact point in the Union. The EDPB, in its Guidelines 3/2018, considers the two functions incompatible when held by the same external person for the same organisation, because of the risk of conflict of interests.

Does appointing a representative transfer GDPR liability?

No. Article 27(5) states that the designation is without prejudice to legal actions which could be initiated against the controller or processor itself. Your business remains responsible for its compliance under Article 24. Appointing a representative fulfils one obligation; it does not make your processing compliant.

What documents are required to appoint a representative?

The GDPR requires a designation in writing (Article 27(1)), in practice a written mandate setting out the representative’s tasks. The representative also needs the information necessary to keep its record of processing activities (Article 30). Your privacy notices must then be updated with its identity and contact details (Articles 13(1)(a) and 14(1)(a)).

How much does an EU GDPR representative cost?

It depends on the volume of processing, the number of Member States concerned, the expected flow of requests and whether complementary GDPR support is included. Sila does not publish a fixed price: contact us to discuss your requirements.

Can a SaaS company outside Europe appoint Sila?

Yes, if Article 27 applies to it and France is one of the Member States where the data subjects concerned are located. The appointment also depends on Sila accepting the mandate after reviewing the file. The assessment is the first step for confirming both points.

Determine Your Article 27 Requirements

Tell us where your business is established, how you operate in Europe and what kind of representation you are looking for.

Discuss Your Requirements

Territorial scope under Article 3, records of processing and the wider GDPR framework.

GDPR compliance for non-EU companies

Once you set up an establishment in the Union, Article 3(1) applies and Article 27 no longer does.

Establishing a business in Europe

A separate function from the representative, under Articles 37 to 39.

Outsourced DPO

Reference texts

The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm, a supervisory authority or a certification body.