Art.27 Representatives of controllers or processors not established in the Union
Where the Regulation applies under Article 3(2) to a controller or processor not established in the Union, designate a representative in the Union in writing, established in one of the Member States where the data subjec
5
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The Article 3(2) applicability assessment covering the offering of goods or services to, and the monitoring of behaviour of, data subjects in the Union · SIEM / log platform
governing documentDocuments that govern the control
- The written mandate appointing the representative, with scope covering supervisory authorities and data subjects on all processing issues · Policy repository / GRC workspace
- The representative's contact details as published in the privacy information and otherwise made available to data subjects · Policy repository / GRC workspace
- The reasoning where the Article 27(2) exemption is relied on, addressing occasional, large scale and risk in turn · Policy repository / GRC workspace
- Evidence the representative can access records and respond, such as an escalation procedure and actual response records · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- A representative appointed in a Member State chosen for administrative convenience rather than where the data subjects are
- The appointment made but the contact details never published, so no data subject can actually use it
- A group entity named as representative with no written mandate defining what it is authorised to receive
- The occasional processing exemption claimed for a continuously available online service, which is not occasional
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet