In addition to or in the place of the controller or processor the representative is instructed by the controller or processor to act as a contact point – especially for supervisory authorities and persons concerned – for all matters relating the data processing, in order to ensure compliance with the GDPR. The representative is authorized to receive legal documents, see – inter alia – § 44 BDSG (Federal Data Protection Act of Germany).

The appointed representative must be located in one of the EU member states, where the processing takes place. He must be a natural person or legal entity, appointed in written form by the controller or processor in accordance with Article 27 GDPR. A legal entity is an association of individuals or a special-purpose asset, that is endowed with rights and subject to obligations. The representative doesn’t have to be a lawyer or a data-protector.
However, as the representative is obliged to communicate with supervisory authorities and persons concerned on a variety of issues, it would be beneficial for the representative to have a good knowledge of the GDPR rules. In addition, your GDPR representative should ideally have a good understanding of your company’s data services – what and how your company uses data. The GDPR representative ideally has professional experience working with authorities in the sectors of regulation and compliance.

You have to authorize the representative in written form. The power of attorney should contain the tasks of the representative. Currently, you don’t have to inform the supervisory authorities. However, you have to name the representative in your information for the data subject (Art. 13, 14 GDPR) – typically your data protection declaration – and in your records of processing activities (Art. 30 GDPR).

In principle, only one GDPR-representative is required for the EU, even if your company has branches in several EU countries. However, depending on the size of your company and the extent of data processing, it may make sense to appoint more than one representative. Different languages and cultural and legal particularities in each EU Member State can create additional difficulties.

Failure to comply with this regulation may result in heavy fines (Art. 83 GDPR) of up to 10 million euros. It can also be considered as unfair competition (this is disputed), if you don’t comply with the regulations, which can lead to expensive legal actions in Germany or other EU countries.

LHR represents companies that are not located in the EU – in particular US companies – in accordance with Art. 27 GDPR.