--- title: "Art. 27 GDPR: Representatives of controllers or processors not established in the Union" canonical: "https://dposchool.com/gdpr/article/27" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_27" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 27 GDPR · Chapter IV: Controller and processor · Section 1: General obligations # Article 27 GDPR: Representatives of controllers or processors not established in the Union Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) A controller or processor not established in the Union, to which Article 3(2) applies, must designate in writing a representative in the Union, except in the cases listed in paragraph 2. ## Official text ### Article 27(1) **1.** Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union. ### Article 27(2) **2.** The obligation laid down in paragraph 1 of this Article shall not apply to: #### Article 27(2)(a) **(a)** processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or #### Article 27(2)(b) **(b)** a public authority or body. ### Article 27(3) **3.** The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are. ### Article 27(4) **4.** The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation. ### Article 27(5) **5.** The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 27 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_27) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 80](https://dposchool.com/gdpr/recital/80) ## EDPB guidance ### [Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)](https://dposchool.com/gdpr/guidance/edpb-03-2018) EDPB 03/2018 · Final · First published 23 November 2018 · Final version 12 November 2019 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32018-on-the-territorial-scope-of-the-gdpr-article-3-version-adopted_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [Clearview AI, Inc: EUR 20,000,000](https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07) Hellenic Data Protection Authority, Greece · Decision of 13 July 2022 · Appeal status: unknown Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative. [Source: the authority](https://www.dpa.gr/en/en/enimerwtiko/prakseisArxis/imposition-fine-clearview-ai-inc) ### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02) Garante per la protezione dei dati personali, Italy · Decision of 10 February 2022 · Appeal status: unknown Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 27 Previous: [Art. 26 GDPR: Joint controllers](https://dposchool.com/gdpr/article/26) Next: [Art. 28 GDPR: Processor](https://dposchool.com/gdpr/article/28) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents