Short answer: An EU-established company normally does not need an Article 27 GDPR representative in Spain simply because it offers services to people in Spain. Article 27 concerns controllers and processors not established in the Union. The company may still need a DPO, Spanish privacy advice or a clear local contact depending on its processing, Spanish operations and sector.
This distinction matters for companies established in France, Germany, Ireland, Italy, the Netherlands or another EU country that are expanding into Spain. They may search for a “GDPR representative in Spain” when the real requirement is different: checking their establishment, assessing DPO duties and documenting how Spanish data subjects can exercise their rights.
If the company is actually established outside the EU, the analysis changes. See our GDPR representative service in Spain for companies outside the EU.
Do you need a representative, a DPO or Spanish privacy support?
We separate the Article 27 test from DPO duties and local operational requirements before you choose a service.
Why an EU company usually does not need a Spanish representative
Article 27 is directed at a controller or processor not established in the Union when the territorial scope of Article 3(2) applies. If the company has a genuine establishment in an EU Member State and that establishment is relevant to the processing, the company is not in the same position as a US, UK or other non-EU company with no EU establishment.
Serving Spanish customers from another EU Member State does not automatically create a requirement to appoint a representative in Spain. The company should still identify the competent supervisory authority, its establishments, the processing context and the channels through which Spanish individuals can exercise their rights.
Company established in France
It may serve Spanish customers without appointing an Article 27 representative in Spain, subject to the real establishment and processing analysis.
EU group opening a Spanish branch
The branch, the group controller and the DPO arrangements should be mapped. A representative is not a substitute for that governance work.
Company outside the EU
If it has no relevant EU establishment and targets people in Spain, Article 27 may require a representative in the Union.
When could a DPO be relevant in Spain?
A DPO is a different figure from an Article 27 representative. Under Article 37 of the GDPR, designation is required in specific cases, including public authorities, large-scale regular and systematic monitoring, or large-scale processing of special categories of data or criminal-conviction data. Spanish law also lists additional situations in which a DPO must be designated.
The need for a DPO does not automatically mean that the DPO must be physically located in Spain. The DPO must have the required expertise, independence, resources and accessibility. Where the activity is subject to the Spanish supervisory framework or includes a Spanish establishment, the company should also check notification and communication requirements with the AEPD.
Representative, DPO or local counsel?
| Need | Likely question | What to verify |
|---|---|---|
| Article 27 representative | Is the company outside the EU and within Article 3(2)? | Establishment, affected individuals, offer/monitoring, exceptions and written mandate. |
| DPO or DPD | Does the processing trigger Article 37 or Spanish mandatory cases? | Nature, scale, systematic monitoring, special-category data, independence and notification. |
| Spanish privacy counsel | Does the expansion require local legal implementation? | Contracts, notices, cookies, employment, sector rules, marketing and dealings with the AEPD. |
| Local operational contact | Can Spanish customers exercise rights effectively? | Language, response process, records, escalation and controller/processor roles. |
Questions to answer before entering Spain
- Where is the controller or processor established and which entity signs with Spanish customers?
- Is there a real EU establishment involved in the processing, or only an external distributor?
- Are Spanish individuals offered services or monitored, and which entity decides the purposes and means?
- Does the activity fall within mandatory DPO cases under the GDPR or Spanish law?
- Who receives access, deletion, objection and other rights requests in Spanish or English?
- Are the contracts, privacy notice, cookies and international transfers aligned with the actual model?
- If the company is outside the EU, has the Article 27 representative been appointed in writing?
What can go wrong when the figures are confused?
An EU company may buy a representative service it does not need while leaving its DPO obligations or rights workflow unresolved. A non-EU company may do the opposite: appoint a DPO or local adviser and assume that the Article 27 designation is covered. The remedy is a short written scope analysis that records the establishment, processing activity, legal roles and required contact points.
Frequently asked questions
Does a German or French company need a GDPR representative in Spain?
Not usually merely because it serves people in Spain. If the company is established in the EU, Article 27 is not normally the relevant obligation. The exact establishment and processing structure still needs review.
Does an EU company need a DPO located in Spain?
Not automatically. The DPO obligation depends on the processing and applicable law, while the DPO must be accessible and independent. Physical location in Spain is not a universal requirement.
Can a Spanish lawyer act as the DPO?
Potentially, if the person or organisation meets the expertise, independence, availability and conflict-of-interest requirements. Legal advice and DPO functions should be separated where the roles could conflict.
When would an EU company need an Article 27 representative?
The Article 27 question normally arises for a controller or processor not established in the Union and subject to Article 3(2), subject to the exceptions in Article 27(2).
Official sources
- Regulation (EU) 2016/679 on EUR-Lex, Articles 3, 27 and 37–39.
- AEPD guidance on appointing a Data Protection Officer, including Spanish mandatory cases and notification.
- EDPB Guidelines 3/2018 on the territorial scope of the GDPR.
Choose the right GDPR role for your Spanish expansion
We help EU and international companies separate representative, DPO and local compliance needs.