Tools Hub/EU Representative Check

Do you need a GDPR EU representative?

Companies not established in the EU that offer services to, or monitor the behaviour of, people in the EU must designate a representative in the Union in writing under GDPR Art.27 and publish it in their privacy notice. The duty has applied since 25 May 2018 with no grace period, and it covers processors too — "we only do back-end processing for European clients" is not an exemption.

Three steps: territorial scope → exemption → the related UK representative duty. It gives a directional self-assessment as a starting point for your internal position and counsel review — not legal advice.

0 of 3 answered

Step 1 · Territorial scope

Do you have a branch, subsidiary or stable establishment in the EU, and does the relevant processing take place in the context of that establishment’s activities?

This is the decisive first question. If yes, you fall under Art.3(1) (establishment criterion) and do NOT need an Art.27 representative. Servers, cloud regions or a distributor alone are usually not an establishment — it turns on a stable arrangement of people and facilities.

Step 1 · Territorial scope

Do you offer goods or services (including free ones) to individuals located in the EU?

Art.3(2)(a). The test is people located in the EU, not citizenship. EU languages, euro pricing and EU-targeted marketing are evidence of intent. Free services count.

Step 1 · Territorial scope

Do you monitor the behaviour of individuals in the EU, as far as that behaviour takes place in the EU?

Art.3(2)(b). Includes web/app analytics, profiling, ad tracking and usage telemetry. AI product companies often trigger this without realising it.