Does every US company with an EU visitor need a representative?

No. A visitor's presence in the Union does not by itself establish that the company offers goods or services to people there or monitors their behaviour there. Article 3(2) is the first test. Mere website accessibility is insufficient evidence of an intention to offer services. Only after the territorial test is met does the Article 27 appointment question arise.

Can a US company appoint its privacy adviser outside the EU?

Not as its Article 27 representative. The GDPR requires the representative to be established in a Member State where relevant data subjects are located. The appointment must be in writing. A company may seek advice elsewhere, but an adviser outside the Union does not fulfil that location condition merely by accepting a contract or forwarding messages.

Is occasional processing enough for the Article 27 exemption?

No. Article 27(2)(a) is a combined test. Processing must be occasional, must not include large-scale processing of Article 9 special-category data or Article 10 criminal-conviction data, and must be unlikely to create a risk to people's rights and freedoms. A company should record its reasoning on every condition instead of treating a low transaction count as a complete exemption.

Does an EU representative take over the company's GDPR liability?

No. The representative acts under a written mandate and serves as a point of contact for people and supervisory authorities. The EDPB limits direct liability for the representative to its own duties concerning processing records and access to information. The US controller or processor remains responsible for its own processing and for supplying accurate, current information to the representative.

Must the EU representative register with the Irish DPC?

The Irish Data Protection Commission's register FAQ says an EU representative need not be registered with it. The representative's identity and contact details must instead be provided to data subjects under Articles 13 and 14 and available to supervisory authorities. That answer concerns the DPC's register; it does not remove the written appointment or location tests in Article 27.

GDPR Article 27: when a US company needs an EU representative

Quick Answer: A US company not established in the Union needs an EU representative under GDPR Article 27 when processing data of people there relates to offering them goods or services or monitoring their behaviour there, unless an exemption applies. Website access alone is insufficient. Appoint the representative in writing in a Member State¹^,2^,3.

Summary in a mind map

GDPR Article 27: when a US company needs an EU representative
│
├─ Territorial scope first
│   ├─ Offer goods or services to people in the Union
│   └─ Or monitor their behaviour there
│
├─ A visit is not an offer
│   ├─ Website accessibility alone is insufficient
│   └─ Examine the actual processing activity
│
├─ Test both exceptions
│   ├─ Occasional and no specified large-scale data
│   ├─ Unlikely risk to rights and freedoms
│   └─ Or a public authority or body
│
└─ If appointment is needed
    ├─ Mandate in writing; relevant Member State
    ├─ Publish contact details; maintain records
    └─ Company retains its own responsibility

Start with the EU reach test

The practical first step is to identify an actual processing activity, not count visitors to a website. Article 3(2) applies to a controller or processor outside the Union when its processing concerns people who are in the Union and relates either to offering them goods or services or to monitoring their behaviour there. The person's location matters at the relevant time. The business's US incorporation does not settle this test¹.

Imagine a US software company taking subscriptions from people located in the Union. It should identify the service, the personal data processed to provide it, and the evidence that the offering is directed to those people. A separate activity that monitors their behaviour in the Union can also bring processing within Article 3(2). The two routes should be assessed separately, because a finding on one does not require pretending the other occurred¹.

The result is an activity-level answer. A business may have an EU-directed product and an unrelated product with no such activity. A company-wide label such as “has EU customers” hides which processing must be examined and which people the representative may need to serve. The appointment decision should therefore be recorded alongside the underlying processing activity¹^,2.

A website visit is not targeting

Website accessibility in the Union is not enough to show an intention to offer goods or services to people there. The EDPB says precisely that in its guidance on Article 3(2). A US firm's website can be visited from an EU address without its operator having directed an offering to that market. The visitor's location and the operator's intention answer different parts of the question².

The useful comparison is between a page that can be opened abroad and a service actually offered to people in the Union. The EDPB gives delivery to EU Member States as an indicator, assessed with the other circumstances rather than alone². For the latter, examine the company's own sales journey and the processing attached to it. For the former, record why accessibility alone is all the evidence shows. Neither a traffic dashboard nor a map of visitors is a substitute for the Article 3(2) analysis¹^,2.

Monitoring is a separate route. If a processing activity concerns behaviour of people in the Union, the company should test that route even if it makes no offer to them. Conversely, the existence of an accessible site does not prove monitoring either. The record should name the specific processing, the people concerned and the route relied upon¹.

Question	Evidence to examine	Article 27 consequence
Is the site merely accessible in the Union?	Accessibility alone	No Article 3(2) finding on that fact alone ²
Does processing relate to an offer to people there?	An EU delivery option, an order from a person in the Union and the subscription data processed to fulfil it²	Test Article 27 and its exemptions ¹
Does processing relate to monitoring behaviour there?	A US consultancy analyses customers' movements through Wi-Fi tracking in a French shopping centre².	Yes: the analysis monitors behaviour in the Union under Article 3(2)(b); test Article 27 and its exemptions ¹^,2.

Article 27 follows Article 3(2)

If Article 3(2) applies, Article 27(1) tells the controller or processor to designate a representative in the Union in writing, subject to the exemptions in Article 27(2). This is a second decision, made after territorial scope. It is not a substitute for determining whether the underlying processing is covered. Nor does selecting a contact person make otherwise uncovered processing fall within the GDPR¹.

The written designation matters because the representative acts under a mandate. The EDPB describes that representative as a natural or legal person established in the Union who facilitates communication with data subjects and supervisory authorities. An internal US mailbox may route messages, but it is not the same as appointing a person established in a relevant Member State under the statutory rule¹^,2.

For a business decision, put three findings on one page: the processing that meets Article 3(2), the Article 27 exemption analysis, and, if appointment is required, the written mandate. This order makes a later review possible without asking someone to infer territorial scope from the existence of a contract. It also prevents a generic supplier agreement from being mistaken for the representative's mandate¹^,2.

A written representative mandate follows a positive scope test unless an Article 27 exemption applies.

In words, the tree branches like this: if Article 3(2) does not cover the processing, Article 27 does not follow from that route. If it does, test both exemptions. Where neither applies, appoint a representative in writing in a Member State where relevant people are located¹.

The narrow occasional-use exemption

The private-sector exemption in Article 27(2)(a) has three conditions that must hold together. The processing must be occasional. It must not include large-scale processing of special-category data under Article 9(1) or criminal-conviction and offence data under Article 10. Considering its nature, context, scope and purposes, it must also be unlikely to create a risk to people's rights and freedoms. Failure on one condition defeats this exemption¹.

The EDPB interprets occasional processing as activity that is not carried out regularly and occurs outside the regular course of business². A continuing EU-facing subscription service forms part of the ordinary service; a small current subscriber count alone does not make its processing occasional². “Occasional” is therefore no shortcut. A small number of contacts may still require a risk analysis; a low-risk activity may still fail if it is not occasional. The business should write a conclusion for each limb and identify the activity to which it applies. Treating the exemption as a status of the whole company can conceal a separate, regular EU-facing service¹.

Article 27(2)(b) provides a different exemption for a public authority or body. A commercial US company should not merge that provision with the occasional-processing test. They are separate branches in the statute. The table gives the decision sequence without turning either exception into a broad “small business” exclusion¹.

Article 27(2) branch	What must be established	Result if it fails
Occasional processing	Occasional activity, no specified large-scale sensitive processing, and unlikely rights risk	Appointment remains required if Article 3(2) applies ¹
Public authority or body	The organisation has that status	Assess the first branch or appoint ¹

Place, notice and records

The representative must be established in a Member State where the relevant data subjects are. Article 27(3) ties the location to people whose data are processed in connection with an offer or whose behaviour is monitored. A convenient address elsewhere in Europe cannot simply be assumed to satisfy that wording. For a service involving more than one Member State, identify at least one state meeting the statutory condition before signing¹.

The representative's identity and contact details must reach people. The Irish DPC's register FAQ explains that Articles 13 and 14 require those details to be provided to data subjects and available to supervisory authorities. A written mandate kept only in a contract folder does not perform this communication function. The public-facing notice and the authority-facing contact route should agree with the signed appointment³.

The EDPB also explains the records relationship. The representative maintains Article 30 processing records, while the controller or processor supplies accurate and updated information and retains responsibility for the records' primary content. This is a practical handoff: the US company must be able to tell its representative when an EU-facing activity changes. Appointing someone who receives no current processing information does not satisfy the intended contact function².

Liability stays with the company

An EU representative is a contact and record-keeping point, not a transfer of the controller's or processor's underlying obligations. The EDPB limits the representative's direct liability to its own obligations under Articles 30 and 58(1)(a). The company remains responsible for the processing and the information it supplies. An appointment therefore cannot be described as outsourcing GDPR compliance².

This distinction matters when a person or authority asks about a specific processing activity. The representative can be addressed under the mandate, but the business must still give it a reliable answer and maintain the underlying records. A narrow mandate that leaves no path to the relevant staff will frustrate the role the EDPB describes. The company should be able to identify who supplies record changes and who answers requests routed through the representative².

This article cannot decide whether a particular sales page, service or behavioural activity meets Article 3(2) without the company's evidence. It also cannot decide whether a given activity meets all three limbs of the occasional-processing exemption from a transaction count alone. The correct conclusion is conditional on the real processing, the people affected and the documented risk¹^,2.

What to do next

Record the Article 3(2) decision for each EU-related activity, then document every Article 27 exemption limb. If appointment is required, choose a representative in a relevant Member State, sign a written mandate, publish its contact details and establish a route for current Article 30 information¹^,2^,3.

For the underlying records, GDPR Accountability Documentation creates a tailored record of processing where your questionnaire answers call for one.

For adjacent questions, read about automated decision-making under the GDPR, AI governance across UK GDPR and the EU AI Act, order-processing automation, and UK business email consent. Those topics have distinct territorial tests; this page's representative decision remains grounded in Articles 3 and 27 ¹.