What does an EU representative actually do?
An EU representative is your point of contact in the EU under Article 27 GDPR. Here is the full mandate it carries under Articles 27 and 30 — and, just as importantly, the limits of the role.
The core mandate (Articles 27 & 30)
Under Article 27 GDPR, the representative is mandated to act on your behalf inside the EU. In practice that means five things:
- Receiving data subject requests (DSARs) on your behalf
- Receiving inquiries and communications from supervisory authorities
- Being named in, and keeping accessible, the record of processing activities (Art. 30)
- Cooperating with authorities during investigations
- Providing an EU address for the service of process
The representative is, in effect, the door that authorities and individuals in the EU knock on instead of trying to reach a company on another continent.
What the representative does not do
Three limits are worth stating plainly, because they are commonly misunderstood:
- It does not replace your data protection officer — those are two separate roles.
- It does not take legal responsibility off the controller or processor.
- It does not defend you against fines or litigate on your behalf.
Why “real” representation matters
The duties above only mean something if there is genuine substance behind the address. A forwarding mailbox cannot meaningfully cooperate with an authority or handle a request on a deadline. Real representation has:
- A physical address in an EU member state — not a virtual mailbox
- A named individual or entity that is accountable under EU law
- Documented professional liability insurance and continuity arrangements
That is the difference between an Article 27 designation an authority will recognise and a box-ticking exercise that falls apart on first contact.
How Usantis covers the mandate
Usantis provides the full mandate end to end: a real German address, a named representative, a hosted compliance page that publishes the contact details, intake and translation of DSARs, deadline tracking, and authority-inquiry handling. To see how that runs in practice, read the full overview or check whether you need representation with the compliance checker.
Frequently asked questions
Related guides
When a representative is required
The Article 27 triggers — offering goods/services to, or monitoring, people in the EU.
Penalties for non-compliance
How Article 83 fines apply and why a missing representative is an easy finding for a DPA.
Representative vs. DPO
Two different roles that are often confused. When you need one, the other, or both.
Last updated 2026-05-23.
Get your EU representative in about ten minutes
€99/month, fully self-service, with DSAR handling and a hosted compliance page included.