What is an EU representative?
The EU representative (GDPR Art. 27) is the person or company a non-EU controller or processor must designate in the Union when it falls under GDPR’s extraterritorial scope (Art. 3(2)): offering goods or services to people in the EU or monitoring their behaviour: without an EU establishment. The representative is the local mailbox with teeth: the addressee for supervisory authorities and data subjects, keeper of the Art. 30 records, named in your privacy notice.
Who needs one: the Turkish startup test
The trigger is targeting, not mere accessibility: EU-currency pricing, EU-language marketing, EU app-store availability aimed at those markets, or analytics that tracks EU users’ behaviour. A Türkiye-based SaaS with German customers and no EU entity is the textbook case. The narrow exemption: occasional, low-risk processing without special categories at scale: rarely fits a data-driven product. Note the mirror duty: EU companies without a Turkish establishment face KVKK’s own representation mechanics for VERBİS registration; cross-border groups often need both directions covered.
Choosing and contracting the role
The market solved this with professional representative services; the real work is the mandate: scope of authority, information-flow duties (a representative who cannot reach your DPO in 24 hours is decorative), liability allocation: authorities can address the representative for the principal’s non-compliance, and termination mechanics. Put the representative’s identity in the privacy notice and keep the appointment letter in the diligence folder; buyers check Art. 27 as a cheap proxy for privacy maturity.
Is the representative the same as a DPO?
No: the DPO is an internal oversight function; the representative is an external point of contact for territorial reach. A company can need both, either, or neither.
What risk does the representative carry?
Regulators can enforce against the representative in respect of the principal’s breaches, which is why serious providers demand cooperation covenants and indemnities in the mandate.
Working on this? Vircon Legal advises on KVKK & GDPR Compliance and KVKK compliance guide. Talk to us →
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call