Introduction

The Dutch data protection authority once fined a website 525,000 euros. There was no data breach and no hack. The only problem was that the company, based outside the EU, had not appointed a representative inside the EU. If your business is based outside the EU and you sell to people inside it, you very probably need one too. The good news is that this is a smaller task than many businesses fear. The bad news is that the exemption most companies rely on almost certainly does not cover them.

This article explains why EU data protection law reaches businesses far beyond Europe, why the exemption is so narrow, what a representative actually does, which similar-sounding roles are something else entirely, and how to put the right arrangement in place.

Why EU Law Reaches Businesses Outside Europe

The General Data Protection Regulation, usually called the GDPR, does not follow your company’s address. It follows the people whose data you handle. Under Article 3(2), the GDPR applies to a business established outside the EU that processes the personal data of people in the EU, where the processing relates to either of two activities:

• offering them goods or services,

• monitoring their behaviour.

Where your servers are, where your company is registered and how large your business is do not change this.

Offering goods or services counts even when the customer pays nothing, so a free trial, a free app or a free newsletter can all be enough. However, the fact that people in the EU can visit your website is not enough on its own. What matters is whether you clearly intend to serve people in the EU, and this usually shows in ordinary business choices. Examples include showing prices in euros, delivering to EU countries, offering your website in the language of an EU country other than your own, advertising to audiences in EU countries, or showing reviews from customers in EU countries.

Monitoring is even easier to trigger. You are monitoring people’s behaviour if you track, profile or retarget visitors located in the EU, or run behavioural analytics on them. The same rules apply in Norway, Iceland and Liechtenstein, which together with the EU form the European Economic Area.

Once Article 3(2) applies to you, Article 27 requires you to appoint a representative in the EU, in writing.

The Exemption Is Narrower Than You Think

Article 27 does contain an exemption, but it only applies if your processing meets all three of the following conditions at the same time.

1. It is occasional.

2. It does not involve large-scale processing of special categories of data, such as health information, biometric data or religious beliefs, or of data about criminal convictions and offences.

3. It is unlikely to result in a risk to people’s rights and freedoms.

The first condition is where most businesses fail. The European Data Protection Board, known as the EDPB, brings together the national data protection authorities. It says that processing is only occasional if it is not carried out regularly and takes place outside the normal course of the business. If you run an online shop, a subscription, an app or a platform, and customers from the EU use it week after week, that is not occasional. It is your business model.

Public authorities have their own separate exemption. Everyone else needs a representative, and that includes processors as well as controllers. A controller is a business that decides why and how personal data is used. A processor handles data on another business’s behalf. So a software provider that processes data for EU clients is not exempt just because its clients decide what the data is for.

What a Representative Does, and What It Does Not

Your representative is a person or company established in the EU that acts as your official point of contact there. It must be established in one of the EU countries where the people whose data you handle are located. If a large share of them are in one particular country, the EDPB recommends, as good practice, choosing a representative in that country. The representative must still be easy to reach from the other countries you serve, and it should be able to communicate in the languages used by the relevant authorities and individuals.

Data protection authorities can contact your representative. So can individuals who want a copy of their data, want it deleted or want to complain. The representative also keeps a record of your processing activities and must be able to show it to the authorities on request. Its name and contact details must appear in your privacy notice, because an appointment that nobody can find achieves nothing.

There are four things a representative is not.

• It is not just a mailing address. A name on a door that nobody answers is not compliance. It is evidence that you are not compliant.

• It is not a shield. Article 27 states clearly that appointing a representative does not prevent legal action against your business itself.

• It is not your data protection officer. The EDPB considers the two roles incompatible, because a representative acts on your instructions while a data protection officer must be independent.

• It is not your service provider. The EDPB also considers that a business which already processes data for you should not act as your representative, because of possible conflicts of interest.

Three Roles That Are Easy to Confuse

Several other appointments sound similar but are different roles under different laws, and none of them replaces your GDPR representative.

The GPSR responsible person. Under the EU General Product Safety Regulation, a consumer product sold in the EU needs a responsible business established in the EU. Its contact details must appear on the product, its packaging, the parcel or an accompanying document. This role deals with product safety, including technical documentation and recalls, not with requests about personal data. Do not assume it is irrelevant because you only sell software. The European Commission has taken the view that the regulation can also cover standalone software, including apps and games. Either way, a GPSR responsible person never covers your GDPR obligations.

The UK representative. After Brexit, the United Kingdom kept its own version of the representative rule. If you target people in the United Kingdom as well as in the EU, you need a second appointment there. This also works the other way round. A business based in the EU that targets people in the United Kingdom is the foreign business under UK law.

The Swiss representative. Switzerland’s revised data protection law has its own, narrower rule. A business based abroad needs a Swiss representative only if it targets or monitors people in Switzerland and, in addition, its processing is large-scale, regular and high-risk for the people concerned. Switzerland is outside the EU. A Swiss business with no establishment in the EU that targets or monitors people in the EU therefore still needs an EU representative under the GDPR.

One provider can hold several of these appointments for you. What it cannot do is hold one and treat it as covering the others.

Four Practical Steps

• Run the scope test honestly. Look at your traffic, your currencies, the countries you deliver to and your analytics. Write down whether you offer goods or services to people in the EU or monitor them. That written assessment is your defence if anyone asks.

• Choose the right country. Follow your customers, not the cheapest offer.

• Put it in writing. Agree a written appointment that says what the representative may do, which languages it will handle, and how it reaches you quickly when an authority or an individual makes contact. A request that goes unanswered soon becomes a complaint.

• Publish it. Add the representative’s name and contact details to your privacy notice, where people can find them easily.

The risk is not theoretical. Failing to appoint a representative can lead to fines of up to 10 million euros or 2 per cent of worldwide annual turnover, whichever is higher. In the Dutch case mentioned at the start, the company was fined 525,000 euros for this failure alone. The authority also ordered it to appoint a representative, backed by a penalty of 20,000 euros for every two weeks of delay, up to a maximum of 120,000 euros.

Conclusion

In summary, the GDPR follows your customers, not your company address. Offering goods or services to people in the EU, or monitoring their behaviour, brings you within its scope wherever you are based. The exemption from appointing a representative requires all three conditions at once, and regular commercial activity fails the first. Your representative must be established in an EU country where your users are, be reachable by authorities and individuals, and appear in your privacy notice. It is not a shield, not your data protection officer and not a letterbox, and roles such as the GPSR responsible person or the UK or Swiss representative never replace it.