GDPR Article 27 representative for US SaaS and app companies

Article 3(2) GDPR applies the Regulation to companies outside the EU that offer goods or services to people in the EU or monitor their behaviour. Article 27 then requires such a company, if it has no EU establishment, to designate in writing a representative in the Union. A US SaaS with EU customers, or an app with EU users and analytics, is squarely inside this.

The exemption, and why it rarely applies

No representative is needed where processing is occasional, does not include large-scale processing of special categories or criminal data, and is unlikely to result in a risk to rights and freedoms. Continuous processing of customer accounts, payments or analytics is not occasional.

What the representative does

Acts as the contact point for supervisory authorities and data subjects; forwards every communication to you promptly; maintains the Article 30 record of processing on your behalf; is named in your privacy notice. The EDPB's guidelines on territorial scope confirm the representative is directly liable only for its own duties, not for your compliance.

What it is not

Not a data protection officer (Article 37 is a different role with different independence rules), not a legal adviser, not a shield: enforcement against you remains possible (Article 27(5)).

Prices

€299 a year up to 50 staff, €599 up to 250, €1,499 above. Malta is an EU member state with English as an official language, so the contract and all correspondence are in English.