EU representative under GDPR Article 27 and DSA Article 13
Two different laws can require a company outside the EU to name a representative in the Union. They apply to different businesses and are handled as separate mandates.
GDPR Article 27
Applies to controllers and processors outside the EU that offer goods or services to people in the EU, or monitor their behaviour (Article 3(2) GDPR). Article 27(2) exempts occasional, low-risk processing that does not involve special categories of data at large scale, and public authorities.
The representative is the contact point for data protection authorities and for people exercising their rights, and keeps a copy of the records of processing.
DSA Article 13
Applies to providers of intermediary services outside the EU that offer those services in the EU: hosting, online platforms, marketplaces, search engines and similar. A shop that sells only its own products is not an intermediary service.
The legal representative can be held liable for non-compliance with the Digital Services Act, so the mandate requires a full review of how the service operates.
What we do
- Check whether either regime applies to you, and whether an exemption is available.
- Sign the mandate for the regime that applies, with an operator established in Spain.
- Publish the representative details where the law requires them.
- Receive and route authority and user requests in English, Spanish or Mandarin Chinese (中文服务).
Work with us
Describe your product, users and data flows through the contact page or WhatsApp.
Next step
Tell us what you sell or run, and where
We confirm whether the obligation applies to you, what we would do and the price before any work starts. Service in English, Spanish and Mandarin Chinese (中文服务).