← back to the act's dossier

GDPR — Article 27

The article's text

Article 27 Representatives of controllers or processors not established in the Union 1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union. 2. The obligation laid down in paragraph 1 of this Article shall not apply to: (a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or (b) a public authority or body. taking into account the nature, context, scope and purposes of the processing; or (b) a public authority or body. 3. The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are. 4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the control
full text
ler or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation. 5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

Who wrote about this article in the consultations

Filers who named this exact article number in their own text. It is their sentence, not our reading — and not a causal claim.

4
business association
3
company
3
NGO
WhoCountryWhat they wrote
Deutscher Juristinnenbund e.V.DEhren AGBs die wichtigsten Parameter der Empfehlungssysteme nennen müssen, damit Nutzer*innen sie ändern oder beeinflussen können (Art. 27 DSA). Auch wenn zusätzlich noch ein „Online-Schutz“ für Minderjährige eingezogen wurde (Art. ↗
ACCISBEnline platforms ensure that users of social media and search engines are aware of the data collected for targeted advertisements (Article 27). In the draft final text of the AI Act, AI systems involving any form of profiling are considered high-risk, irrespect ↗
ACT | The App AssociationBEcers (DPO) functions to have access to clear guidelines and recommendations on this role. Certain provisions of the GDPR, such as Article 27, impose additional obligations on non-European firms, increasing the cost and risk associated with handling data of EU ↗
MyData-TRUSTBEis a need for more flexibility in interpretation of localisation criteria for establishing DPRs. Current requirements outlined in Article 27(3) require appointing the DPRs in the country of data subjects. However, in practice, some organizations may conduct pr ↗
Shoosmiths LLPGBe organisations with establishments outside the EU only and whose processing activities would give rise to the requirement for an Article 27 GDPR representative (EU Representative).  We find that the EU Representative mechanism is not well understood by non-E ↗
Computer & Communications Industry Association's (CCIA Europe)BErequirement: https://edpb.europa.eu/our-work-tools/our-documents/letters/edpb-letter-enisa-regarding-european-cybersec urity_en; Article 27 of the Data Act also creates a separate regime for non-personal data transfers for cloud services providers subject to ↗
noybATsupervisory authorities and the parties to the procedure; Chapter VI – Legally binding decisions Article 27 - Contents 1. Without prejudice to additional requirements under national law, any legally binding decision shall be issued in writing, using a concise ↗
EU Business PartnersIEsier for the authorities in the EU to come after us by appointing a representative?” So, it would appear that if the objective of Article 27 is to provide the Union with an effective means of implementing and enforcing the GDPR globally, this will only be effe ↗
Americans For Tax Reform FoundationUShe “reasonable” level of protection for personal data, allows regulators assessing fines with excessive flexibility. In addition, Article 27 requires firms outside the EU processing personal data to have a representative physically present in the EU. ↗
ACT | The App AssociationBEto its extraterritorial reach) increase the cost and risk associated with handling data pertaining to EU citizens. For example, Article 27 of the law requires firms to physically place a representative in the EU.5 This 5 Commission Regulation 2016/679, art. 27 ↗

Source: public consultation submissions and position papers. n = 10 mentions; counted as a literal reference to the article number.

Ask about this article →