We are certified under the Data Privacy Framework. Do we still need an EU representative?

Possibly, yes. The Framework concerns transfers of personal data; Article 27 concerns representation. Certification does not answer the Article 27 question in either direction.

Do we need to set up an EU subsidiary?

Not necessarily, and rarely as a first step. Representation, establishment, importation, distribution, tax and employment are separate questions that get conflated. A subsidiary answers some of them and leaves others untouched.

Our European revenue is small. Does that change anything?

The GDPR has no turnover or volume threshold. What matters is whether you offer goods or services to people in the Union, or monitor their behaviour.

United States

How can a US company enter the EU market without setting up an EU entity?

Data Privacy Framework certification does not remove the Article 27 representative obligation. What a US company actually needs before selling into Europe.

All EU market entry mandates

The pitfall

Certification is not representation

The most common misunderstanding we see from US companies runs like this: the organisation has self-certified under the EU-US Data Privacy Framework, and concludes it is covered. The Framework addresses the transfer of personal data from the Union to the United States. It says nothing about whether you must designate a representative established in the Union. Two separate questions, two separate provisions — and answering the first does not answer the second.

State privacy laws create the same false comfort. Compliance with California, Colorado or Virginia requirements does not map onto the GDPR, and unlike those laws the GDPR sets no revenue or volume threshold to clear before it applies.

Why can't our US counsel handle this?

They can, and usually should, keep the strategy. But several of these obligations require a person or entity established in the Union. That is a question of establishment, not of competence — no US firm can satisfy it from the United States.

Scope

Services most likely to apply

GDPR Article 27 representation
AI Act authorised representative
SaaS and commercial contracts under EU law
EU trade mark filing
DSA legal representative where a platform is involved

Relevant mandates

Working together

The role of your existing US counsel

Your current advisers keep the relationship and the strategy. We take the European-side mandate and report back in English. Where you would rather we deal with the company directly, we do that instead — it is settled before we start, not afterwards.

For foreign law firms

Preparation

What to prepare before we speak

Your privacy notice. Your record of processing, if one exists. A description of the activity that reaches the Union. The Member States you target. Whether any EU entity, importer or reseller already exists. And whatever prompted the question — a customer questionnaire, a marketplace notice, a letter from an authority.

FAQ

Frequently Asked Questions

Start with a scope review

EU market entry assessment

This page describes how these obligations generally work. Whether one applies to you depends on facts a web page cannot capture — your supply chain, your contracts and the role you actually play in them.