Do you need an EU representative? The decision tree in seven questions

This is the question we get asked most often, and it’s almost never the question people think they’re asking. They ask: do we need to appoint an EU representative? What they’re really asking is: how bad will it be if we don’t?

Both questions have an answer, and the first one is shorter than you might think. Article 27 of the GDPR is one of the few provisions in the regulation that can be reduced to a series of yes/no questions. No balancing, no proportionality test, and little room for interpretation in most cases. You either fall under it or you don’t.

What makes the question tricky is that companies start in the wrong place. They begin with Article 27, while Article 27 only becomes relevant after Article 3 has determined that the GDPR applies to you at all. Reversing this order may lead to an answer that happens to be correct—or happens not to be.

Below are seven questions in the correct order. Allow a quarter of an hour, and note which tools you use while reading — that’s where the surprises lie.

Question 1: Do you process personal data of individuals located in the EU?

Pay attention to the wording, as every word matters.

“People located in the EU” — not EU citizens. Nationality doesn’t matter. An American on a business trip in Amsterdam filling out your form qualifies. A Belgian living in Ho Chi Minh City visiting your site does not. The criterion is physical presence at the time of processing, not passport or residence.

"Personal data" is broader than most companies assume. An email address is personal data. An IP address usually is as well. A cookie ID tied to a device typically counts too. A business contact at a customer — name, role, phone number — is personal data, even in B2B contexts. The GDPR does not recognize a B2B exemption. This assumption often costs companies half a day of rework.

Answer “no” and you’re done. Answer “I don’t think so, but we do use Google Analytics” and the answer is yes.

Question 2: Do you have an establishment in the European Union?

Article 27 only applies to organizations without an establishment in the Union. If you have one, this obligation falls away — although you will likely then fall under Article 3(1), and other obligations will apply. You are not less regulated; you are differently regulated.

"Establishment" is a factual concept, not a legal label. It involves a stable arrangement with real and actual activities — an office, staff, a structure that is durable. A post office box is not an establishment. A subsidiary that exists only on paper, neither.

Two cases that often go wrong:

• A single remote employee in Spain. This could already constitute an establishment, depending on what that person does and how permanent the arrangement is. This is not a theoretical discussion: it determines which article applies to you.
• A European sister company within the same group. It is not an establishment of your entity. Group affiliations do not resolve this automatically — more on that under whether your distributor or group affiliate suffices.

Question 3: Do you offer goods or services to people in the EU?

This is where the real work begins, as this is the question where companies most often mislead themselves.

The criterion is not whether Europeans can buy from you. It is whether you target the European market. A reachable website is not enough; targeting is. The European Data Protection Board lists a series of indicators in its guidelines on territorial scope, derived from case law of the Court of Justice:

• You name one or more EU member states by name, or you refer to European customers or users.
• Your site is available in a language that is not commonly used in your own country but is in the EU.
• You display prices in euros or accept payment in euros.
• You use a country domain of a member state — .de, .fr, .nl, .be.
• You deliver to EU addresses, or mention European delivery terms.
• You advertise or buy keywords targeting European users.
• You mention European reference clients or a European phone number.

None of these points are decisive on their own, and they are considered together. However, checking off three or four and then claiming you are not targeting Europe is a position you won’t win.

The answer doesn’t even have to be paid. Offering a free trial, a free newsletter, or a free tool to European users counts as a service.

Question 4: Do you monitor the behavior of people in the EU?

This is the question most companies skip, and it’s the one most often answered with a ‘yes’ without anyone realizing it.

Monitoring means tracking behavior that occurs within the Union. Specifically:

• Analytics that track individual visitors across pages.
• Advertising pixels from social networks or advertising networks.
• Retargeting or remarketing.
• Session recordings and heatmaps.
• Behavioral profiling for recommendations or pricing.
• Apps that track location or feature usage.

If you run any of these and have European visitors, you monitor behavior in the Union. That’s enough to fall under Article 3(2), even if you don’t sell a single product to a European.

This is the most common scenario we encounter: a company convinced it has nothing to do with Europe, with a marketing stack that has been tracking European visitors for four years.

Question 5: Do you fall under the exemption of Article 27, paragraph 2?

There is an exception. It is narrower than it appears, and the EDPB consistently interprets it strictly.

The obligation does not apply when all three of the following conditions are met simultaneously:

1. The processing is occasional. Not regular, not structural, not part of your core business operations. An online store accepting orders year-round does not process occasionally. A company visiting a trade fair in Germany once a year and collecting business cards might.
2. There is no large-scale processing of special categories of personal data as defined in Article 9, paragraph 1, or criminal conviction data as defined in Article 10. Special categories include, among others, health data, biometric data, and data concerning religious or political beliefs.
3. The processing is unlikely to pose a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope, and purposes.

The conditions are cumulative. If you fail on one, the exception is gone.

In practice, almost every exporting or online-selling business already stumbles at the first condition. If you serve European customers year-round, your processing is not occasional — no matter how small your business is. The exception isn’t meant for small companies; it’s for rare processing.

What you do: evaluate the three conditions separately, document your reasoning for each, and keep that record. If you conclude the exception applies, that written justification is exactly what you’ll need if someone asks. An unsupported conclusion isn’t a conclusion.

Question 6: Are you a government authority or government body?

The second exception in Article 27(2) applies to public authorities and public bodies. Short, and for most readers of this article not relevant — but it belongs in the decision tree, as skipping it means missing the only other basis for exemption.

A state-owned enterprise operating commercially is not a public authority in this sense. In case of doubt: it’s about the nature of the task, not who owns the shares.

Question 7: Who do you employ, where, and how?

If you answered “yes” to question 1, “no” to question 2, “yes” to question 3 or 4, and “no” to question 5 and 6, you must appoint a representative. This leaves three practical decisions to make.

Yes. The representative must be established in a member state where you engage with individuals to whom you offer goods or services, or whose behavior you monitor. If you serve multiple member states — which is almost always the case — you choose one. In practice, you select based on accessibility, language, and the supervisory authority you’ll deal with.

How. In writing. Article 27, paragraph 1, leaves no room: a written mandate outlining the role. An email exchange where someone says “fine” is not a mandate.

Visible. The data of your representative must be accessible to data subjects. In practice, this means: in your privacy statement, with name and address, easily findable without requiring anyone to search for it. A designated representative that is mentioned nowhere does not solve the issue—that is exactly the kind of shortcoming that stands out in a supplier questionnaire from a European buyer.

The representative also maintains the record of processing activities that must be provided in that capacity and serves as a point of contact for both data subjects and supervisory authorities.

The three outcomes

Outcome A — you don’t need a representative

You do not process data of people in the EU, or you have an establishment in the Union, or you demonstrably fall under the exemption.

What you’re doing now: document the reasoning, add the date, and set a review date — annually, or sooner if you change your market or marketing stack. This conclusion becomes outdated. One European campaign, one new pixel, one German distributor, and the answer shifts.

Outcome B — You need one, and you don’t have it

This is the most common outcome, and the good news is that it’s the cheapest shortcoming you can have on your list. Hiring can be done within a few working days. The annual cost for a standard service ranges between a few hundred and a few thousand euros — we explain where that difference comes from in what an EU representative costs in 2026.

That’s why the shortcoming looks so bad when it’s exposed. It’s small, visible, cheap to fix, and entirely within your control. A compliance team finding it will draw conclusions about the rest of your case.

Outcome C — you think you have one, but you don’t

The underestimated outcome. You have a European distributor, a law firm on retainer, a trade agent, or a group subsidiary in Ireland, and someone once said that would suffice.

That’s usually not the case, and the distinction is sharper than it seems. We’ve written a separate article about it, including the cases where a group entity *can* qualify.

What a representative does not solve for you

This is where companies lose their way after doing things correctly.

Appointing a representative does not make you GDPR-compliant. It is just one obligation among many. You still need a legal basis for each processing activity, data processor agreements with your suppliers, a record of processing activities, a working process for data subject requests, a data breach response plan, and a defensible structure for data transfers outside the EU.

A representative does not take on your liability either. Consideration 80 of the regulation states that the representative must be subject to enforcement procedures in case of non-compliance by the data controller or processor. The exact scope of this is still under discussion — the EDPB limits it to the possibility for supervisory authorities to enforce via the representative, not full liability in your place. What is certain: you remain the data controller, and the obligations remain yours.

What it does solve: it opens the door. Without a designated representative, every conversation with a European buyer starts with a deficiency. With a representative, the conversation starts about your product.

Where we come in

Chuyenso is based in Belgium — within the European market, under European rules. Our founder is certified EADPP under the European GDPR framework, with fifteen years of entrepreneurship and over a hundred clients in strategy, development, hosting, and data. We guide non-European businesses looking to sell in Europe without letting compliance delay the deal.

We act as your appointed representative in the European Union: a Belgian address in your privacy statement, a written mandate, a contact point reachable by data subjects and supervisory authorities, and the ability to provide the register required in this capacity.

Strategy Session — 60 minutes, €295. One question thoroughly reviewed, with a written summary and three concrete actions within 48 hours. Ideal if, after these seven questions, you want someone to review your reasoning before you finalize anything.

EU Scan — three sessions over three weeks, €1,950. Your full European exposure mapped out, gaps ranked by risk and revenue at stake, a 90-day plan, and a compliance summary you can immediately send to a European buyer. Choose a subscription within 30 days, and we’ll offset this amount.

Or book a free 25-minute introduction. We’ll go through the seven questions together and honestly tell you whether this is a problem for you—or not. Sometimes the answer is “less than you thought.” We’ll say so.

Chuyenso — literally: digital transformation. We help businesses outside Europe become Europe-ready: legally, technically, and commercially.

---

Sources: Article 27 GDPR — full text · EDPB Guidelines 3/2018 on territorial scope · Recital 80 — designation of a representative · Representatives under Art. 27 of the GDPR (IAPP)

General information, not legal advice.