Who really needs a GDPR representative — and why some companies choose to be named publicly for it

 There's a line in the GDPR that quietly applies to thousands of companies that have never read it. It says that if you sit outside the European Union and reach people inside it, someone established in the Union has to be reachable on your behalf — a named point of contact for authorities and individuals. It's called an Article 27 representative. The United Kingdom, after Brexit, added its own mirror version under the UK GDPR. And most companies that need one have no idea they do.

This piece isn't a sales pitch. It's an attempt to answer, plainly, the questions people actually ask when they first stumble onto this obligation — and to explain one thing that surprises almost everyone: why some companies, far from hiding the fact that they're represented, choose to be listed publicly for it.

"Does this even apply to me?"

The obligation doesn't care about your size or your turnover. It follows one thing: reach. If you're a controller or processor established outside the EU, and you offer goods or services to people in the Union or monitor their behaviour, Article 3(2) brings you into scope. There's no revenue threshold. In practice that catches a lot of companies that never think of themselves as "EU-facing" — the US software product with European sign-ups, the app with users in France or Germany, the processor handling European data for its own clients. And it's no longer only companies: sole traders and marketplace-only sellers, the people running an Amazon or Etsy store with no website of their own, fall under the same logic the moment they reach EU customers.

"Isn't this the same as a DPO?"

No, and it's the most common confusion. A representative is your external point of contact inside the Union under Article 27. A data protection officer is an internal advisory role under Articles 37 to 39. They're different jobs, and one entity can't properly be both for the same company.

"EU or UK — which do I need?"

It depends on where your people are. If you reach individuals in the EU, you need an EU representative. If you reach individuals in the UK, you need a UK one. If you reach both — and many businesses do — you need both, because they're two separate legal duties, not one. The honest answer is that plenty of companies need the pair and only discover the second half late.

Why "security" here means "verifiability"

When people ask whether a representative arrangement is "secure," they usually mean something specific: can I trust it's real, current, and provable — not a PDF someone emailed me once and forgot? That question matters because Article 27 isn't only about satisfying a regulator anymore. It's about satisfying a buyer. When a company runs due diligence on a supplier, "who is your EU representative, and can I verify it?" is now a normal line item. A static document that could say anything doesn't survive that conversation. A designation you can check against a live register does. That verifiability — a certificate with a code anyone can scan to confirm it's active right now — is what "security" really means in this context.

The part that surprises people: choosing to be seen

Being represented under Article 27 is, by design, a public fact. Your representative's name has to appear in your own privacy notice anyway. Some companies take that a step further and consent to being listed publicly on the representative's side too. Why would anyone volunteer that? Because here, visibility and trust point in the same direction. For the represented company, appearing publicly is a small, verifiable signal to its own customers and partners — yes, we've done this properly, and here's where you can confirm it. It only ever happens with consent; nobody is listed who hasn't agreed. But when a company does agree, the whole arrangement becomes more transparent, which is exactly what Article 27 was trying to achieve in the first place.

Where the seven-day trial fits

Here's the practical bit, and the reason this obligation is less daunting than it sounds. You don't have to decide blind. You can start with a free seven-day trial, no credit card, and actually see what being represented looks like — the signed designation, the certificate, the live verification badge — before committing to anything. For a duty built entirely on transparency, being able to inspect it before you buy feels like the point, not a perk. The site even installs on your phone like an app, so your status and request desk travel with you rather than living in a drawer.

The honest boundaries

Two things worth stating plainly. A representative is a contact point, not a shield: Article 27(5) is explicit that authorities can still act against you directly, and naming one doesn't create an EU establishment or move your tax residence. And it isn't legal advice. Anyone describing it as immunity is describing something the regulation doesn't contain.

The takeaway is quieter than a sales pitch. Article 27 is a broad, ordinary obligation that catches ordinary businesses the moment they have European users. Its whole logic is transparency — a reachable, verifiable point of contact anyone can confirm. The companies that treat it that way, including those that choose to be named publicly, aren't buying protection. They're making something checkable.

So a genuine question, for anyone who's dealt with a supplier's compliance: when they told you they were "GDPR-compliant," did you actually check whether they had an EU representative — or did "we're compliant" turn out to be enough? I'd like to know how often anyone really looks 👇