Set by the law · GDPR Art. 27(1)
Representative of a controller not established in the EU
In plain English
Controllers and processors outside the EU that target people in the EU must appoint an EU representative in writing, except public bodies and occasional, low-risk processing without large-scale sensitive or criminal data.
The official text
Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
The obligation laid down in paragraph 1 of this Article shall not apply to: (a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or (b) a public authority or body.
26 decisions on Fino cite Article 27 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.