What evidence do auditors commonly ask for on Art.27 Representatives of controllers or processors not established in the Union?

The Article 3(2) applicability assessment covering the offering of goods or services to, and the monitoring of behaviour of, data subjects in the Union; The written mandate appointing the representative, with scope covering supervisory authorities and data subjects on all processing issues; The representative's contact details as published in the privacy information and otherwise made available to data subjects; The reasoning where the Article 27(2) exemption is relied on, addressing occasional, large scale and risk in turn; Evidence the representative can access records and respond, such as an escalation procedure and actual response records.

What is the most common gap auditors find on Art.27?

A representative appointed in a Member State chosen for administrative convenience rather than where the data subjects are

GDPR · Chapter IV - Controller and Processor

`Art.27` Representatives of controllers or processors not established in the Union

Where the Regulation applies under Article 3(2) to a controller or processor not established in the Union, designate a representative in the Union in writing, established in one of the Member States where the data subjects whose data is processed in relation to the offering of goods or services, or whose behaviour is monitored, are located. Mandate the representative to be addressed, in addition to or instead of the controller or processor, by supervisory authorities and data subjects on all issues related to processing. The obligation does not apply to processing which is occasional, does not include large scale processing of special category or criminal offence data and is unlikely to result in a risk to the rights and freedoms of natural persons, nor to a public authority or body. Designating a representative is without prejudice to legal actions against the controller or processor themselves.

Source: GDPR, Art.27. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

hard

to go live

Policy repository / GRC workspace

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Evidence the representative can access records and respond, such as an escalation procedure and actual response records · Policy repository / GRC workspace

governing documentDocuments that govern the control

The Article 3(2) applicability assessment covering the offering of goods or services to, and the monitoring of behaviour of, data subjects in the Union · Policy repository / GRC workspace
The written mandate appointing the representative, with scope covering supervisory authorities and data subjects on all processing issues · Policy repository / GRC workspace
The representative's contact details as published in the privacy information and otherwise made available to data subjects · Policy repository / GRC workspace
The reasoning where the Article 27(2) exemption is relied on, addressing occasional, large scale and risk in turn · Policy repository / GRC workspace

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

A representative appointed in a Member State chosen for administrative convenience rather than where the data subjects are
The appointment made but the contact details never published, so no data subject can actually use it
A group entity named as representative with no written mandate defining what it is authorised to receive
The occasional processing exemption claimed for a continuously available online service, which is not occasional

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.26 Joint controllers · Art.28 Processor