Your European distributor is not an EU representative. Here’s the difference

The conversation almost always follows the same pattern.

We ask if an EU representative has been appointed. The answer is: yes, we’ve been working with a distributor in the Netherlands for seven years. Or: our law firm in Frankfurt handles our European affairs. Or, most often: our parent company is based in Ireland, so that’s taken care of.

All three sound reasonable. None of them answers the question.

This is the most common misunderstanding we encounter regarding Article 27 of the GDPR, and it’s an expensive one — not because it incurs heavy fines, but because companies often believe they’re compliant for years while nothing has actually been arranged. They find out at the worst possible time: when a European buyer asks for it.

Not sure if Article 27 applies to you? Start with the decision tree in seven questions. This article covers the next step: you need one, and you think you already have one.

What a representative actually is

Article 27 requires four things at once. All four must be correct.

1. A written appointment. A mandate in writing explicitly assigning and accepting the role. Not implied, nor derived from an existing agreement.
2. Established in the correct member state. In a member state where the parties involved are located to whom you offer goods or services, or whose behavior you monitor.
3. Point of contact for data subjects and supervisory authorities. For all questions regarding processing, alongside or instead of you.
4. Made known. The data must be accessible to those who need to use it. In practice: in your privacy statement.

Additionally, the representative must maintain the record of processing activities that can be presented to a supervisory authority in that capacity.

Pay attention to what is *not* on that list: a commercial relationship, knowledge of your product, or long-term collaboration. These are all good things. None of them constitute an appointment.

Case 1: the distributor

Your distributor sells your products in Europe. They have a European address, speak the language, and know your customers. Why wouldn’t they be your representative?

Two reasons, and the second is the most important.

There is no appointment. Your distribution agreement covers sales, inventory, margins, and territory. It says nothing about data protection, and the role of representative does not arise automatically from a commercial relationship. There is no mandate, so there is no representative.

Conflict of interest. This is the part people miss. The representative is the point of contact for data subjects — including a European customer who complains, requests their data, or demands erasure. Your distributor is the party selling to that customer and has a commercial interest in ensuring nothing goes wrong. You’re assigning complaint handling to the party with the most to lose from a complaint.

Here’s the catch: a distributor is usually the data controller for the data they process. Mixing two roles with conflicting interests is exactly what a supervisor does not want to see.

Is that possible? In theory, a distributor can formally be appointed if it is done in writing and they can actually fulfill the role. We advise against it, and in practice, we rarely see it work well. As soon as the commercial relationship becomes strained — and it will — your European point of contact is with a party you negotiate with.

Case 2: the law firm

You have a subscription office in Paris or Frankfurt that handles your European business. Isn’t that your representation?

Here lies the difference between hiring someone and appointing someone.

A law firm advising you is your advisor. A law firm formally appointed as a representative under Article 27, with details in your privacy statement, is your representative. These are two different roles, with different obligations, and one does not follow from the other.

The practical test is simple. Does your privacy statement include the name and address of the office under the heading 'representative'? If not, there is no designated representative, and thus, under Article 27, there is no representative.

A second point, less legal and more practical: the role is largely operational. Receiving mail, verifying the identity of requesters, monitoring deadlines, maintaining a register, and sending responses. This is work a law firm *can* do, but at legal fees — more on what an EU representative costs in 2026.

Case 3: the trading agent or sales office

A sales agent selling on your behalf in Europe is closer to a solution than a distributor, but the core remains: without a written appointment, there is nothing.

In addition to the sales office, there is a second question that must be answered first, and it is more important than the representative question: Is that office an establishment under GDPR?

An establishment is a stable arrangement with real and actual activities. If you have staff, an office, and a sustainable structure in Europe, you may have an establishment — and then the obligation under Article 27 no longer applies, as it only concerns organizations without an establishment in the Union.

That sounds like good news, and it usually isn’t. If you fall under Article 3, paragraph 1, instead of Article 3, paragraph 2, everything changes: which supervisory authority is competent, how the one-stop mechanism works, and which obligations rest on which entity. You are not less regulated. You are differently regulated, and that requires its own analysis.

Case 4: The European Group Company

The most interesting case, and the only one where the answer could be “yes, provided that.”

You have a sister company in Ireland, the Netherlands, or Germany. Could that serve as your representative?

Yes, provided it is done explicitly and in writing. There is no rule excluding group partnerships. What does exist is the requirement that the appointment must be formalized — and this almost never happens, as everyone assumes it is automatically handled within a group.

Three practical conditions where things often go wrong:

• The correct member state. An Irish entity is a fine representative if you have Irish stakeholders. If you mainly sell in Germany, France, and Spain and your representative is in Ireland, that is justifiable but not self-evident — document why.
• Actual accessibility. The entity must be accessible to stakeholders in the languages of the relevant markets. A holding company without staff does not meet this requirement.
• An internal process that works. When a request for inspection comes in at the Irish entity, who handles it, how does it reach the right systems, and who monitors the 30-day deadline? Without this process, you have a mailbox with a logo on it.

And once again, the question applicable to every group structure: if there is a European entity with staff, isn’t that simply a branch? Answer that question first. It determines whether Article 27 applies at all.

The test in thirty seconds

Four questions. If you answer one of them with no, you do not have an appointed representative.

Question	Where you find the proof
Is there a written document appointing this party as a representative under Article 27?	An appointment letter or an addendum to the contract. Not the distribution agreement itself.
Is the name and address in your privacy statement?	Open your privacy statement and search for “representative”. Thirty seconds of work.
Does that party know they have the role, and do they understand what it entails?	Call them. The answer is surprisingly often no.
Can that party provide the register of processing activities?	Ask about it. If you don’t get an answer within a workday, it doesn’t exist.

What should be in the appointment letter

If you want to arrange this yourself with an existing party, these are the elements that must be included. A short document, usually one to two pages.

• Who appoints and who is appointed. Full legal entities with address and company number, not trading names.
• Explicit reference to Article 27 of Regulation (EU) 2016/679. 'Representative in Europe' is too vague; this refers to this specific role.
• Scope. Which processing activities and entities the appointment covers.
• Tasks. Point of contact for data subjects and supervisors, maintaining the register, forwarding requests, and meeting agreed deadlines.
• Contact details as they are published. Exactly as they appear in your privacy statement.
• Effective date, duration, and termination. Including what happens to the file upon termination.
• Acceptance by both parties. Signed. By both.

One point to discuss with the counterpart upfront: Recital 80 of the Regulation states that the representative must be subject to enforcement procedures in case of non-compliance by the controller or processor. How far this goes is still debated — the European Data Protection Board interprets it as the possibility for supervisory authorities to enforce via the representative, not as full liability in your place. But it’s exactly why a distributor who is given the role often prefers not to accept it. Better to know this beforehand than during an incident.

Why this fails more often than you think

The reason is almost never unwillingness. It is structural.

Article 27 is one of the few GDPR obligations that requires having someone else take action. All other obligations can be addressed internally: creating a register, drafting a policy, building a process. This one demands an external party, a signature, and a publication — three steps spread across two organizations, with no clear owner.

It stays that way. And because nothing goes wrong in the meantime, the belief arises that it is settled.

Until a questionnaire from a European buyer lands on your desk. Then it turns out in one question that the obligation you thought you had checked off seven years ago was never filled out — and you have two weeks to respond. We have worked through this questionnaire question by question, including what a good answer to this point looks like.

Where we come in

Chuyenso is based in Belgium. Our founder is certified EADPP under the European GDPR framework, with fifteen years of entrepreneurship and over a hundred clients in strategy, development, hosting, and data.

We act as appointed representative in the European Union. With a mandate in writing, a Belgian address you include in your privacy statement, a contact point accessible to stakeholders and supervisory authorities, and the register of processing activities you must be able to present in that capacity. We are neither a distributor, agent, nor a party in your commercial chain — precisely for that reason, we can fulfill the role without conflicting interests.

Strategy session — 60 minutes, €295. Bring your current setup: your distribution agreement, your privacy statement, your group structure. We’ll tell you what’s in place and what’s missing, with a written summary and three actions within 48 hours.

EU representation — from €1,850 per year. Appointment within a few working days, including the appointment letter, the text for your privacy statement, and the register.

Do you just want to check if your structure holds? Book a free 25-minute introduction. Often, the answer is clear within ten minutes.

Chuyenso — literally: digital transformation. We help businesses outside Europe become Europe-ready: legally, technically, and commercially.

---

Sources: Article 27 GDPR — full text · EDPB Guidelines 3/2018 on territorial scope · Recital 80 — appointment of a representative · Interpretation of Art. 27 Representative Liability (Bird & Bird)

General information, not legal advice.