2 von 4

30. Oktober 2020

Data transfers after Schrems II and Brexit transition – 2 von 4 Insights

GDPR EU-Representative - For companies without EU establishments

Axel von dem Bussche and Paul Voigt look at the requirement on non-EU established organisations to appoint an EU representative under the GDPR.


Dr. Paul Voigt, Lic. en Derecho, CIPP/E


Read More

Dr. Axel Frhr. von dem Bussche, LL.M. (L.S.E.), CIPP/E


Read More

Dr. Paul Voigt, Lic. en Derecho, CIPP/E


Read More

Dr. Axel Frhr. von dem Bussche, LL.M. (L.S.E.), CIPP/E


Read More

Extended scope of the GDPR

The GDPR has a very broad scope of application; companies doing business within the EU will often be subject to the GDPR, even if they have no establishments in the EU. The GDPR applies already when a NON-EU COMPANY offers goods or services to individuals in the EU or monitors their behaviour (Art. 3 sec. 2 GDPR).

Who has to appoint a representative under the GDPR?

All companies

  • without establishment in the EU
  • offering goods or services (even if for free) to, or monitoring the behaviour of individuals in the EU

will need to appoint an EU REPRESENTATIVE (Art. 27 GDPR), regardless of whether the companies are considered controllers or processors under the GDPR.

The threshold is very low: offering services to the EU via a website directed to EU users (e.g. because goods/services are delivered to the EU, EU currency is accepted or EU languages are used) will trigger the requirement to appoint an EU REPRESENTATIVE. Same applies to any user tracking of EU residents, e.g. via cookies. 

Duties of the Representative 

The EU REPRESENTATIVE shall act as local contact point for EU individuals and EU data protection supervisory authorities, and represent the NON-EU COMPANY with regard to their respective obligations under the GDPR (Art. 4 No. 17 GDPR).

The following requirements have to be met:

  • The EU REPRESENTATIVE needs to be designated in writing
  • The EU REPRESENTATIVE shall act on behalf of the NON-EU COMPANY and therefore needs to have power of representation.
  • The Representative needs to be established in one of the EU member states where the data subjects affected by the activity of the NON-EU COMPANY are located. It is not necessary to appoint an EU REPRESENTATIVE for each EU member state.


If a NON-EU COMPANY needs to appoint an EU REPRESENTATIVE but fails to do so, this may lead to fines of up to EUR 10,000,000.00 or 2% of NON-EU COMPANY’s annual group turnover, whatever is higher. 


The obligation of appointing an EU REPRESENTATIVE does not apply to cases where the legislator anticipates a small risk from a privacy perspective. This is the case if processing only takes place occasionally, no sensitive personal data is involved, and the processing is unlikely to result in a risk to the rights and freedoms of individuals. All these conditions have to be met cumulatively; therefore it is highly unlikely that a NON-EU COMPANY falling into the territorial scope of the GDPR can benefit from that exception. 

EU REPRESENTATIVE creates “one stop shop” for data breaches

NON EU COMPANIES can generally not take advantage of the “one stop shop” principle of the GDPR, which says that only one “lead authority” is responsible for all regulatory matters of a company throughout the EU. Consequently, whenever the GDPR requires contacting data protection authorities, without the one stop shop rule regulators in potentially all EU member states have to be contacted - in local language! One important practical example where notification of data protection authorities is required are data breaches, which have to be reported to the competent regulator within 72 hours. However, good news for companies who appointed an EU REPRESENTATIVE: the EU supervisory authorities regard the notification of a single data protection authority at the place of residence of the EU REPRESENTATIVE as sufficient. This facilitates the process of data breach notification significantly, in particular if individuals from various EU countries are affected. 

From 2021: UK Representative required

As of January 1, 2021, GDPR does no longer apply directly in the UK, but is implemented via the “UK GDPR”. The requirements of the GDPR are introduced “copy and paste” into UK law, including the requirement to appoint a representative. This means that companies doing cross-border business with the UK may need to appoint a separate UK Representative if they do not have an establishment in the UK. The requirements for appointing a UK rep and the corresponding fines for not doing so are the same as under the GDPR. In particular, if they do not have an establishment “on the ground”,

  • companies based in the EU collecting data in the UK may need to appoint a representative under the UK GDPR,
  • companies based in the UK collecting data in the EU may need to appoint a representative under the EU GDPR,
  • companies based in other countries collecting data in the UK and the EU may need to appoint both an EU and a UK representative.

Please click here to download the article as pdf file.


Global Data Hub

Go to Global Data Hub main hub