The appointment of an EU representative is necessary for controllers or processors who are not established in the EU but who process the personal data of EU citizens, regardless of whether the processing takes place online or offline.

The framework for the tasks and related requirements for the representative in the EU is provided by Article 27 GDPR. ‍

1. Accessibility: The EU representative must be easily accessible by data subjects and the data protection authorities of the Member States.
2. Representing the person responsible or order processor: The EU representative acts as a point of contact for data subjects and supervisory authorities with regard to the obligations of the controller or processor under the GDPR.
3. Representation for processing activities subject to the scope of the GDPR: The representative is responsible for processing activities that fall within the scope of the Regulation in accordance with Article 3 of the GDPR and for which the controller or processor for whom the representative was appointed is not based in the EU.
4. Representing the controller or processor with regard to its obligations: The EU representative acts on behalf of the controller or processor with regard to certain obligations under the GDPR, in particular with regard to cooperation with supervisory authorities and the fulfillment of requests from data subjects.

The Hamburg Commissioner for Data Protection and Freedom of Information has addressed this issue in his Activity report 2018 stating that neither own personnel nor own premises are required. However, it must be ensured in any case that smooth communication and a personal meeting on-site are possible. Most representatives are therefore likely to use a shared office with meeting rooms, for example.