When does the GDPR apply to a company outside the EU?
When your processing targets people in the Union. Article 3(2) of the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, checked October 2026, applies it to a controller or processor not established in the Union that processes data of people in the Union, where the processing relates to offering them goods or services, paid or not, or to monitoring their behaviour there.
Established in the Union, or not
The first test is article 3(1): processing in the context of an establishment in the Union is caught. Establishment implies the effective and real exercise of activity through stable arrangements, branch or subsidiary (recital 22). A company with a French subsidiary or branch, the routes compared in the guide to starting a business in France, answers to the GDPR through it; article 3(2) does not concern it.
Offering goods or services, paid or not
Article 3(2)(a) applies “irrespective of whether a payment of the data subject is required”: an app that charges nothing counts as much as a shop. The European Data Protection Board (EDPB), in its Guidelines 3/2018 on the territorial scope of the GDPR, version 2.1 adopted on 12 November 2019 and checked October 2026, adds that nationality does not matter and that the provision “is aimed at activities that intentionally, rather than inadvertently or incidentally, target individuals in the EU”.
A website merely accessible from the Union, an email address or the language of your own country is not enough (recital 23). Among the factors the EDPB weighs, possibly in combination:
- the Union or a member state named with reference to the goods or services;
- paid search referencing or advertising aimed at an EU country audience;
- a language or a currency of a member state, other than those of your own country;
- a domain such as “.de” or “.eu”, or delivery of goods in member states.
Monitoring behaviour in the Union
Article 3(2)(b) covers the monitoring of behaviour that takes place within the Union. Recital 24 points to tracking on the internet, including profiling. The EDPB lists behavioural advertising, geolocation for marketing, tracking through cookies or fingerprinting, and online health analytics.
What does article 27 require?
A representative in the Union, designated in writing. Under article 27(1) of the GDPR, where article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union. A company that fails to do so “would therefore be in breach of the Regulation”, the EDPB adds.
Who can be your representative
Any “natural or legal person established in the Union” designated in writing to represent you with regard to your obligations under the GDPR (article 4(17)). The EDPB names law firms, consultancies and private companies, under a service contract, and recommends a single individual as lead contact when an organisation takes the role.
In which member state
In one of the member states where the people whose data you process for your offer or your monitoring are (article 27(3)). Where a significant proportion of them are in one member state, the EDPB recommends, as good practice, a representative established there, easily accessible to people elsewhere. Where your servers sit is irrelevant, and one representative covers all your processing caught by article 3(2).
A representative in London does not meet article 27; the United Kingdom has its own rule, under which, the ICO says, a business based outside the UK, with no establishment there, that offers goods or services to people in the UK, or monitors them, must appoint a UK representative (last updated 15 January 2026, checked October 2026).
Processors are covered too
Article 27(1) names the controller or the processor. Where a controller targets people in the Union, “any processor instructed to carry out that processing activity on behalf of the controller will fall within the scope of the GDPR by virtue of Art 3(2)”, the EDPB considers. A provider working for clients established in the Union is bound indirectly, through the contract of article 28, according to the guidelines: the subject of the guide to the data processing agreement.
When can you do without a representative?
In two cases only. Article 27(2) exempts processing that is occasional, does not include large-scale processing of special categories of data or of criminal data, and is unlikely to result in a risk to people’s rights and freedoms; and it exempts public authorities and bodies.
An establishment in the Union takes you out of article 27: the GDPR applies through article 3(1). Without one, no offer and no monitoring in the Union means the GDPR does not apply on that ground. With either, only the exception stands between you and a representative in a member state where your users are.
Three conditions, all at once
- Occasional. Only if it “is not carried out regularly, and occurs outside the regular course of business or activity of the controller or processor”, for the EDPB.
- No large-scale sensitive or criminal data. The data of articles 9(1) and 10, such as health data; scale turns on the number of people, the volume, the duration and the geographical extent.
- Unlikely to result in a risk. Any risk, the EDPB stresses, not only a high one.
Under that reading, sales to the Union as part of your normal activity are not occasional. Public authorities, the second exemption (article 27(2)(b)), are a notion the EDPB leaves to national law.
Your situation, read against the text
| Your situation | Representative required? | Why |
|---|---|---|
| US online shop shipping to France, with a French site and prices in euros | Yes | Delivery, language and currency show the offer (EDPB, example 14); regular sales are not occasional |
| App developer outside the EU using the location of users in the Union for ads | Yes | Geolocation for marketing is monitoring under article 3(2)(b) (EDPB, example 9), and it is regular |
| SaaS company outside the EU selling subscriptions to French businesses, in euros | Assess, activity by activity | Its own accounts and marketing point to article 3(2)(a); for client data it hosts, the guidelines look first at the client’s establishment |
| Consultancy outside the EU with a few French business clients | Assess | The guidelines give no example of services to companies; if article 3(2) applies, regular client work is not occasional |
| US company reimbursing its employees during a business trip in France | No, on that ground | Human resources processing by an employer is not an offer of services (EDPB, example 13) |
| Company with a subsidiary or a branch in France | No representative under article 27 | The GDPR applies through article 3(1) to processing in the context of that establishment |
What does the representative do?
It is your address in the Union. Under article 27(4), supervisory authorities and data subjects can address it “in addition to or instead of the controller or the processor”, “on all issues related to processing”.
| Task | What it means | GDPR article |
|---|---|---|
| Point of contact | Authorities and data subjects can address it instead of you | Article 27(4) |
| Record of processing | It maintains the record and makes it available to the authority on request | Article 30(1), (2) and (4) |
| Cooperation | It cooperates with the supervisory authority, on request | Article 31 |
| Information orders | The authority can order it to provide any information it requires | Article 58(1)(a) |
The record of processing
Article 30 requires each controller “and, where applicable, the controller’s representative” to maintain a record of processing activities, and the same for processors. For the EDPB, you are responsible for its content and updates; the representative must be able to produce it when an authority asks. The exemption for organisations under 250 employees falls away when the processing is not occasional (article 30(5)).
Cooperation and rights requests
An authority contacts the representative on any compliance matter, and the representative facilitates the exchange with you, in principle in the language used by the authorities and the people concerned, the EDPB explains. It is not itself responsible for data subject rights, but must facilitate communication so that they are effective. Answering requests remains your duty.
What is a representative not?
Not a data protection officer, and not an establishment. Nor, for the EDPB, should it be your processor: the two roles for the same controller risk conflicts in enforcement proceedings.
Not a data protection officer
A data protection officer, or DPO, is required in the cases of article 37(1), such as large-scale regular and systematic monitoring, and receives no instructions on the exercise of its tasks (article 38(3)). The representative acts under your mandate, so the EDPB considers the two roles incompatible for an external DPO established in the Union. The CNIL’s practical guide for data protection officers, checked October 2026, says a representative cannot in principle be designated DPO of the same organisation, because that would be a conflict of interests.
Not an establishment, and no one-stop shop
“The presence of the representative within the Union does not constitute an ‘establishment’”, the EDPB states. Under article 56(1), the authority of the main or single establishment leads for cross-border processing; without an establishment, a company “cannot benefit from the one-stop shop mechanism provided for in Article 56 of the GDPR”. Each authority remains competent on its own territory (article 55(1)).
Who is liable, and what are the fines?
You are. Under article 27(5), the designation “shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves”.
What the guidelines say about the representative
“The GDPR does not establish a substitutive liability of the representative in place of the controller or processor it represents in the Union”, the EDPB writes. Yet recital 80 says the representative “should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”, and the guidelines read this as allowing authorities to address to it the corrective measures and fines imposed on you (articles 58(2) and 83).
Its own exposure is narrow: “The possibility to hold a representative directly liable is however limited to its direct obligations referred to in articles 30 and article 58(1) a of the GDPR”.
Fines, and the CNIL in France
Article 27 sits among articles 25 to 39, whose breach article 83(4)(a) of the GDPR exposes to fines up to 10,000,000 euros or, “in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher”. A privacy notice that leaves out the representative breaches transparency, the EDPB notes, and articles 13 and 14 fall under article 83(5)(b): up to 20,000,000 euros or 4 %.
For people in France, the authority is the CNIL, Commission nationale de l’informatique et des libertés, under article 8 of the French data protection law n° 78-17 of 6 January 1978 (Informatique et libertés), checked October 2026.
How do you appoint a representative in practice?
With a written mandate, a record of processing to hand over and a line in your privacy notice.
What the written mandate covers
Recital 80 requires the representative to be “explicitly designated by a written mandate”, which, for the EDPB, governs your relations. A workable mandate covers:
- Scope. The processing caught by article 3(2), the member states concerned and your role, controller or processor.
- Contacts. A postal and an email address in the Union, and the named lead contact.
- The record. How and when you supply the record of processing and its updates.
- Cooperation. How requests reach you, in which language and within what internal deadline.
Your privacy notice
Articles 13(1)(a) and 14(1)(a) require “the identity and the contact details of the controller and, where applicable, of the controller’s representative” in the information given to people. The EDPB places these details in the privacy notice and the information given at collection, easily accessible to authorities. No notification of the designation to an authority is required.
Concord’s GDPR compliance audit maps your data, builds the record of processing and tells you whether you need an EU representative, a DPO or an impact assessment. The privacy policy and cookie notice, in English and French, then names your representative where your users will see it. Tell us where your users are. Your other questions with French clients, from contracts to brand, are in the guide to doing business in France.