A non-EU controller targets EU users and has no establishment in the Union. Subject to applicable exceptions, which obligation is characteristically linked to that territorial-scope situation?
Select an answer to reveal the explanation.
Short Explanation
If you sell into the neighbourhood without renting a local shop, privacy law often still wants a named local contact on the doorbell. That is the Article 27 representative idea for many non-EU controllers in scope. An FTC filing or a household label is not that doorbell.
Full Explanation
Where Article 3(2) brings a non-EU controller or processor into GDPR scope and no establishment exists in the Union, Article 27 generally requires appointment of a representative in the Union, subject to exceptions (for example certain occasional processing that excludes special-category/criminal-data large-scale processing, or public authorities). The representative is a contact and accountability bridge for data subjects and supervisory authorities—supporting people in the Union who otherwise lack a local counterpart.
Incorporating a subsidiary in every Member State is not the only lawful option. Registering only with the US FTC does not replace Article 27. The household exemption does not apply merely because the controller is incorporated abroad.
Exam caveat: know that representatives do not shift controller liability wholesale; they facilitate communication and may be addressed by authorities. Exceptions are narrow—do not invent them for routine targeting businesses.
Operational check: assess Article 27 applicability, appoint a written-mandate representative in an appropriate Member State when required, publish representative contact details in notices, and verify the mandate covers supervisory and data-subject communications.