The European data protection regulation does not apply only to companies established in Europe. It follows the person whose data is being handled, not the address of the company handling it. If your shop takes an order from someone in Europe, if your newsletter reaches a European mailbox, if your app measures how a European visitor behaves, you are inside the text — without an office, without a European entity, and usually without anyone having mentioned it.
Who has to appoint a representative, and who is exempt
The mechanism is short. A controller established outside the Union that handles the personal data of people located in the Union, in the context of offering them goods or services — paid or free — or of monitoring their behaviour, must designate in writing a representative established in one of the member states where those people are. The designation is a mandate: a signed document that says what the representative does on your behalf, not a line added to a page. An exemption exists for handling that is occasional, does not involve sensitive categories at scale, and is unlikely to create a risk — a door much narrower than it sounds, and one that a shop selling continuously does not walk through.
- A shop that ships to European addresses. The order form alone puts you in scope: a name, an address, a phone number and a purchase history are personal data, and they are collected in the context of an offer made to a person in Europe.
- A site version in a European language, with local delivery and payment. These are the signs an authority reads to establish that the offer targets people in the Union, rather than being merely accessible from there.
- A newsletter with European subscribers. A list is a processing operation, with a lawful basis to document, a withdrawal to honour and a retention rule to write down.
- Analytics, advertising and retargeting tags. Following a European visitor across pages, or rebuilding an audience from that behaviour, is monitoring — the other trigger in the text, and the one exporters forget because the tag was installed by an agency.
- An account area and an after-sales channel. Tickets, returns, warranty claims and the messages attached to them form a customer file, held somewhere, accessible to someone, kept for some period — all of which has to be stated.
What the representative actually does
It is a contact point with legal consequences. The representative is addressed, in addition to or instead of you, by the supervisory authorities and by the people whose data you hold, on every question relating to your processing. It must keep the record of processing activities available and produce it when an authority asks — which means that record has to exist, and has to be accurate, before anyone accepts the mandate. It acts within the mandate and does not decide the processing: it transmits, answers, and holds documents. And enforcement can be directed at it, which is exactly why the text requires it.
Representative or data protection officer: not the same role
The confusion is almost universal, and it is expensive because the wrong appointment satisfies nothing. The data protection officer is an advisory function, internal or external, mandatory only when certain conditions are met — a public body, large-scale systematic monitoring, sensitive categories handled at scale. It must be independent, report to the highest level of management, and cannot be instructed on how to do the job or penalised for doing it. The representative is the opposite in nature: a mandated presence on the territory, acting for you, on instruction, and it may be a company rather than a person. Precisely because it acts on instruction, it cannot also be your officer. Appointing one does not relieve you of the other, and most exporters need the representative and not the officer.
Where the name of the representative has to appear
In the privacy notice, at the moment the data are collected: the identity and contact details of the controller and, where applicable, of its representative, available before the first field is filled in. Also on the legal page of the site, in the record of processing activities, in the agreements signed with your processors, and in the answer given to anyone exercising a right. The contact details have to be usable rather than decorative: a postal address in the member state, a mailbox that someone reads, and a language in which a customer or an authority can write. A representative named in the mandate but absent from the public notice is, from the outside, a representative who does not exist.
Why its absence is one of the easiest failures to observe from outside
Nothing has to be investigated. The privacy notice is public, and the absence of a named representative is visible to a customer who complains, to a consumer association, to a competitor, and to an authority running a sweep across a sector. The gap is also self-aggravating: with no representative there is no address to write to, so the first letter goes unanswered, and an unanswered letter turns a formality into a file with a history. The commercial cost arrives earlier than the regulatory one — marketplaces, payment providers and large B2B buyers now ask for the representative's name during onboarding, and an empty field stalls the account before any authority has looked at you.
Write the record of processing activities before you appoint anyone: the representative has to hold it, and a serious one will refuse the mandate without it. Then sign a mandate naming an entity rather than an individual, established where the bulk of your customers are, with a monitored mailbox and a real postal address. Publish identity and contact in the privacy notice in the local language and in the site footer, and settle in the mandate who forwards what to whom, and who drafts the answer, before the first letter arrives rather than during it.
Where to read it yourself
Official pages, opened and checked on 15 October 2026. Where a rule changes, these are the addresses that change with it — this article does not.