Article 27 GDPR
Representatives of administrators or processors who do not have an organisational unit in the Union

1. Where Article 3(2) applies, the controller or processor shall designate a representative in the Union in writing.

2. The obligation established in paragraph 1 of this Article shall not apply in the case of:

(a)

*

processing that is occasional in nature, does not involve, on a large scale, the processing of special categories of personal data referred to in Article 9(1), nor the processing of personal data relating to criminal convictions and offenses referred to in Article 10, and is unlikely, by virtue of its nature, context, scope, and purposes, to result in a risk to the rights or freedoms of natural persons; or

(b) a public authority or body.

3. The representative must be based in the Member State where the data subjects reside, whose personal data is processed in connection with offering them goods or services or whose behavior is monitored.

4. The representative shall be authorized by the controller or processor so that, for the purposes of ensuring compliance with this Regulation, he or she may be addressed, in addition to or instead of the controller or processor, in particular by supervisory authorities and data subjects on all matters related to the processing.

5. The appointment of a representative by the controller or processor is without prejudice to proceedings that may be brought against the controller or processor itself.