Art. 27 of GDPR says that whoever processes data of people located inside the EU (includes storing and deleting in the GDPR definition, with a few exceptions) needs a Representative located inside the EU. This relates to a lot of apps and webpages. The Representative has to answer questions about private data in the name of the processor (who, in this scenario, is not located in the EU), and the Representative is not liable (GDPR says so, but it looks like this is not yet 100% confirmed when you read through various law blogs).

To get such a Representative, one can e.g. rent a service typically for about 100 - 200 EUR per month, and they typically charge another 100 EUR per request (actually, per hour working on a request). This could be quite expensive.

My question is, since to my understanding the Representative just passes requests and answers via mail to the processor (who is outside the EU), couldn't this be any person inside the EU working on much lower cost without real personal risk? The commercial services claim of course that much much work and knowledge is required, but going a few times through the GDPR text, I still see practically a simple mail-forwarding activity as long as the processor provides all required documents in the required form. Businesses inside the EU don't care about this because they get the requests directly, and do the Representative's job by themselves.

  • See law.stackexchange.com/questions/57697/…. Its not clear so far if GDPR is actually enforceable in practice outside the EU. Nov 22, 2020 at 21:10
  • Yes, I have seen it and also upvoted the question. It is not clear, but obviously a risk for anyone who is operating a website.
    – UweD
    Nov 22, 2020 at 21:16

1 Answer 1


Yes, the role of a Representative is largely to serve as a point of contact for supervisory authorities and data subjects. Much of this could be done by a person who just scans and forwards any incoming mail.

In practice, the Representative should be a lawyer or at least a compliance professional in order to fulfil their role effectively, in particular when it comes to a lawsuit or administrative proceedings against the controller/processor. These would be carried out against the representative on behalf of the controller/processor.

Regarding liability, recital 80 explicitly says: “The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.” This doesn't shield the controller/processor from liability, this just simplifies enforcement and ensures that judicial remedies are in fact available to data subjects.

There is a much more imminent consequence for the choice of Representative: which data protection agency will serve as main supervisory authority. Non-EU controllers might prefer the convenience of an English-speaking authority, otherwise (expensive) translation could be needed. Consequently, Representatives based in Ireland are effectively the default choice.

Many representatives do offer extra services, such as offering to serve as a Data Protection Officer. That would help justify the fees. Unfortunately, the conditions for appointing a representative and for appointing a DPO are somewhat different: per the letter of the law many controllers would need a Representative but not a DPO. A Representative is needed as soon as data processing is non-occasional, whereas a DPO would only be needed for processing on a large scale. I'll just add that many controllers forget about that and only think about getting a representative when appointing a DPO. Since the Representative aids enforcement, enforcing against a controller without a Representative is rather difficult, and I don't know of any fines for failing to appoint a Representative.

  • 1
    So does every app developer using admob and EVERY WEBSITE owner having a comment box nede need a somedone in EEA? Nov 22, 2020 at 17:40
  • 1
    According to various law blogs, that's how many people interpret "a Representative is needed as soon as data processing is non-occasional", and that can be logging of IP addresses of people residing inside the EU.
    – UweD
    Nov 22, 2020 at 17:55
  • So will all open source projects with wesites collecting minimal data shutdown due b to inablity to finance lawyers. Nov 22, 2020 at 18:10
  • Therefore, we try to figure out how to do this properly, or at least with as low risk as possible. What we are concerned is, that e.g. a competitor does a lot of requests to our Representative who charges every time a lot when he opens/scans/forwards a letter. GDPR says one can ignore such kind of requests if "excessive", but theoretically it can get expensive.
    – UweD
    Nov 22, 2020 at 18:10
  • @compenthusiast: Hopefully not. It looks like people are waiting for first law suits to clarify this.
    – UweD
    Nov 22, 2020 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .