EU representative vs. Data Protection Officer

Two roles that are easy to confuse

The EU representative and the data protection officer (DPO) are both GDPR roles with the word “contact” attached, which is why they get mixed up. They are, however, entirely separate — different legal bases, different triggers, and different jobs. You may need one, the other, or both.

What the EU representative does

The EU representative under Article 27 is your designated point of contact inside the EU. It exists so that supervisory authorities and data subjects have someone in their own jurisdiction to address instead of a company on another continent. It receives requests and inquiries, is named in your privacy policy, and cooperates with authorities.

What the DPO does

The data protection officer under Articles 37–39 is an advisory and oversight role. A DPO informs and advises the organisation on its GDPR obligations, monitors compliance, acts as a contact point for the supervisory authority, and must be able to operate independently without instruction on how to perform the role.

A DPO is mandatory only when you meet specific criteria:

• You are a public authority or body, or
• Your core activities require large-scale, regular and systematic monitoring, or
• Your core activities involve large-scale processing of special-category data

Side by side

One, the other, or both?

A non-EU SaaS company with EU users but no large-scale sensitive processing typically needs a representative and no DPO. A non-EU health platform doing large-scale special-category processing may need both. An EU-established company may need a DPO and no representative. The two questions are independent — answer them separately.

To check whether the representative obligation applies to you, see when a representative is required.