Do US companies need an EU GDPR representative?
A US company may need an EU representative when Article 3(2) GDPR applies to its processing and no Article 27(2) exception applies.
Article 27 can require a controller or processor not established in the EU to designate a representative in the Union when its processing falls within Article 3(2). This commonly matters when a US business intentionally offers goods or services to people in the EU or monitors their behaviour there.
What should you do next?
If you are unsure whether Article 27 applies to your organisation, use the EURepNow eligibility assessment before purchasing representation.
Primary legal reference: Regulation (EU) 2016/679 — Articles 3 and 27. Official text.