A reachable presence inside the Union, as Article 27 requires.

01Who it is for

Controllers and processors not established in the Union who offer goods or services to people in the EU, or monitor their behaviour — and who therefore fall within Article 3(2). In practice: technology and e-commerce businesses outside the EU with European customers, and groups that restructured after Brexit and have no remaining EU establishment.

02The problem

“We have European customers but no European entity. We are told we need a representative, we do not want to create a subsidiary for it, and we do not want a mailbox service that forwards letters we cannot read.”

03Scope

Designation in writing as representative under Article 27; acting as the point of contact for supervisory authorities and data subjects on all questions relating to the processing; maintaining the record of processing activities under Article 30(1); and a protocol governing what is answered directly and what is routed to you.

04Method

Scope and appointmentWe confirm that Article 27 applies and that no exemption under Article 27(2) is available, agree the scope of the mandate in writing, and are designated as representative in Portugal.
Point of contactA dedicated address and a named lawyer are published in your privacy notice and notified where required. Supervisory authorities and data subjects can reach the representative in Portuguese and in English.
Records under Article 30The representative maintains the record of processing activities of the controller or processor, which the Regulation places expressly in the representative's hands.
Handling contactCommunications from supervisory authorities and from data subjects are received, assessed, routed to you with an initial legal view, and answered within the agreed protocol. Nothing is answered on your behalf without instruction, save where the mandate provides otherwise.
Annual reviewWhether the appointment is still required, whether the scope has changed, and whether the record still reflects what you do.

05Deliverables

The designation itself, in writing, as Article 27(1) requires
A dedicated contact route for supervisory authorities and data subjects
The Article 30 record of processing activities, maintained on your behalf
A protocol setting out what the representative answers directly and what is routed to you
Annual review and report

06What the appointment does and does not do

Article 27(4) mandates the representative to be addressed in addition to or instead of the controller or processor, in particular by supervisory authorities and by data subjects, on all questions relating to the processing. That is the point of the appointment: a reachable presence inside the Union.

Article 27(5) is equally clear, and we say so at the outset: designating a representative does not preclude legal action against the controller or processor themselves. The appointment creates a point of contact. It does not transfer liability, and any provider who implies otherwise is misdescribing the role.

07When it is not required

Article 27(2) exempts public authorities and bodies, and processing that is occasional, does not involve large-scale processing of special categories of data or of data relating to criminal convictions and offences, and is unlikely to result in a risk to the rights and freedoms of natural persons.

The exemption is narrower than it reads. “Occasional” is doing a great deal of work in that sentence, and an ongoing offering of goods or services to people in the EU is rarely occasional. We give a view on the exemption before accepting a mandate, and we say so where the appointment is not in fact required.

Why Portugal. Article 27(3) requires the representative to be established in a Member State where the data subjects are. For an organisation offering services across the Union, that leaves a choice — and Portugal is an EU member state with a competent supervisory authority, in the euro area, working in English, at a fraction of the cost of the same appointment in Dublin or Frankfurt.

Expertise beyond Law & Technology

Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.