Choose an EU representative location and prepare public contact information
Choose the representative’s location against the people whose relevant data are processed, not the hosting server’s address. Article 27 and EDPB guidance connect location with affected Member States; the guidance recommends the main affected state where appropriate and discusses accessible communication. Prepare privacy-contact publication and coverage separately from choosing an address.
Evidence retrieved 2026-10-07. Source versions and topic-specific limits are listed below.
Sourced criteria · EU · GDPR
What changes the service scope?
Decision or task
What the source describes
What to prepare
Permitted location and recommended location
The guidance separates establishment in an affected Member State from its good-practice recommendation where a significant share of affected people are located. The recommendation is not a universal single-country rule. [2][4]
Compare the stated example/criterion with the evidence tasks below; retain any factual differences.
Processing location is different
The guidance says the location of processing or a processor is not the relevant factor for choosing the representative’s establishment. [2]
Compare the stated example/criterion with the evidence tasks below; retain any factual differences.
Public contact and communication
The guidance describes informing people of the representative identity/contact and effective communication across affected states. Articles 13 and 14 separately contain transparency information requirements. [1][3][5][6]
Compare the stated example/criterion with the evidence tasks below; retain any factual differences.
The EDPB document is Guidelines 3/2018, version 2.1, adopted 12 November 2019. Its worked examples are guidance and dated assumptions, not a new law or a conclusion about your organisation. EU scope is assessed here; UK and Swiss rules require separate evidence. Novel or disputed scope/role interpretations need specialist legal review.
Prepare the evidence and engagement scope
Use this checklist to gather your business or product details before speaking with a specialist. The items below explain what to record and suggest useful supporting documents. You can add your own answers in the editable project brief.
Map affected people by activity
Record affected Member States for the relevant offering/monitoring, with uncertain cases retained; separate this from server and processor locations.
Useful evidence: An affected-location matrix with scope rationale.
Check the proposed representative coverage
Ask where the representative is established and how people and authorities in other affected states can reach and communicate with them.
Useful evidence: An establishment confirmation and communication/coverage schedule.
Prepare the public information handoff
Agree the verified name/contact information and which notices or collection journeys need review and updates.
Useful evidence: A reviewed privacy-information inventory and publication/change checklist.
Work packages and dependencies
Conditional: EU representative scope and engagement — Review the specific evidence task and unresolved territorial/role facts. Where appointment applies, agree the mandate, communication and handoff; justify additional privacy services separately.
Questions for providers
Which differences between our actual facts and the cited example change your scope conclusion?
Which processing activity and legal entity does your conclusion cover, and which facts remain unresolved?
Which appointment and evidence-handoff deliverables are included, and which additional services are separately justified?
Sources and data dates
Read the official document in context. The audit details identify the precise locators and preserved versions used for this page.
