Article 27 — Representatives of controllers or processors not established in the Union
GDPR, Regulation (EU) 2016/679
What does GDPR Article 27 say?
Short answer, straight from the official text
1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union. 2. The obligation laid down in paragraph 1 of this Article shall not apply to: (a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to …
Source: GDPR, Regulation (EU) 2016/679, read 2026-08-14.
| In the act | EU 2016/679 |
| Chapter | IV · Controller and processor |
| CELEX | 32016R0679 |
| Read on | 2026-08-14 |
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
Jump to a point: Point 1 · Point 2 · Point 3 · Point 4 · Point 5 · Point 6 · Point 7
1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
2. The obligation laid down in paragraph 1 of this Article shall not apply to:
(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
(b) a public authority or body.
3. The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.
4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.
Other articles in this chapter
- Article 24
- Article 25
- Article 26
- Article 28
- Article 29
- Article 30
- Article 31
- Article 32
- Article 33
- Article 34
- Article 35
- Article 36
Who does this apply to
The register names five roles. Open a role to see the duties this act places on it, each row with its article and its source.
Does this apply to us?
- Do ai governance rules apply to a cloud provider?
- Do personal data rules apply to a cloud provider?
- Do cross-border data rules apply to a cloud provider?
- Do cybersecurity rules apply to a cloud provider?
- Do health data rules apply to a cloud provider?
- Do online platforms rules apply to a cloud provider?
All roles in the register · All questions by role
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Back to the act · EU acts, read down to the national law
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
