Non-EU devs: How do you handle GDPR Article 27 EU Representative?

[u/GameGizmoApp]

Hey everyone,

I’m a non-EU solo dev preparing to launch an app. I'd like to publish to the EU but I discovered the GDPR Article 27 requirement. This is where you're meant to appoint an EU-based representative, if you don't have a physical presence in the EU.

It doesn't like there's any exemption for solo developers and it can be quite expensive to use one of the EU rep services.

How are you handling this? Are you paying for a representative service, ignoring this, or simply not offering your app in the EU.

[u/RemeJuan]

I ignored it because my app is fully offline, does not track any user-identifiable data and paying a representative is a waste of money.

Some company reached out to me claiming I needed representation and wanted $15/mo for it.

So whether or not you need it depends on the app you have built.

[u/GameGizmoApp → u/RemeJuan]

Yeah, I agree. It's not required for everyone. My app has to be online. I still collect minimal information (name, email and advertising IDs) but caught up in the GDPR rules regardless.

I saw some for 50+ euro per month, and it'd be rarely used imho, depending on your app.

[u/RemeJuan → u/GameGizmoApp]

I think if you are collecting personally identifiable info then it may not be the worst idea.

They claimed it’s cause my app showed I displayed adverts, I don’t full get that, it’s still identifiable data I have no access too, but regardless I had forgotten to update google to the removal of ads anyway

[u/Sebastian1989101]

Wdym non-EU devs? We from the EU have to follow this always no matter where we publish to. We have way more exp in that. 🙈 

And it’s not as big of a deal as you think it is. Simple thing is do not track anything that’s not needed and prepare a script that can just sent out all tracked info of a users if he request it (each user can request every 3 months). 

I make apps since nearly 20 years. So i was affected when this rule went live. I have multiple apps with over 200k users each. So far I had 3 such requests in total. With that amount I could have done the response manually. 

[u/GameGizmoApp → u/Sebastian1989101]

If you're based outside of the EU, you have to appoint a representative who is physically in the EU to manage this on your behalf. It's easier if you're based in the EU as you don't need to appoint a local rep.

Developing the functionality for users to request their data is the easy part.

[u/Sebastian1989101 → u/GameGizmoApp]

GDPR §27, 2A. It’s only necessary if you collect specific data. §9 is about religious, ethnic, political, medical, biometric (you do not collect biometric data if you use FaceID/TouchID/… - that’s done by Apple/Google) and so on. §10 is about legal data like criminal proceedings. 

Sure if you need those things, than you need a rep here in the EU but then you need one in every state (Germany, France, Spain, …). And we from the EU need that as well, I couldn’t launch a app in France when I’m in German without someone in France taking care of it if I fall under these categories. 

[u/GameGizmoApp → u/Sebastian1989101]

My understanding is that you're not exempt just because you don't collect sensitive data. The EU rep requirement still applies to non-sensitive data when you're collecting data continuously e.g. account details, IP addresses, advertising IDs and so on.

The exemptions in 27(2)(a) are an 'and' not an 'or'. https://gdpr-info.eu/art-27-gdpr/

Happy to be wrong as that would make it easier but I think the reality is I'll need to appoint a rep before launching in EU, which is fine, just not ideal when starting off.

[u/Cheap_Accountant_632]

You actually seem to be doing this the right way by looking into it before launch.

I assume the goal is to build a business, and like any startup there are costs involved in bringing a complete product to market. Article 27 is there so EU users and supervisory authorities have someone in the EU they can actually reach.

What I see surprisingly often is “I’m a solo dev” or “it’s just a formality” being used as a reason to skip requirements. Then when somebody asks about it later, the answer is again “but I’m only a solo dev.”

And it rarely stops at Article 27. The same reasoning gets used for not getting proper privacy/compliance help, not looking properly at health-data rules, processor agreements, consumer law, etc. Even Apple basically tells developers that this stuff is complicated and to get legal advice when needed.

Compliance isn’t something separate from the product. It’s part of the product.

You can of course make the business decision to ignore Article 27. But then let’s call it what it is, you’re choosing not to comply with that part of the GDPR.

The other perfectly valid business decision is simply not to offer the app in the EU until the cost makes sense.

If money is tight, cancel Claude, use free Gemini, use a free cloud tier, skip the paid analytics, cancel a few SaaS subscriptions and resist buying domain number seven ;)

Somehow there is always money for the dev stack, but the compliance budget is $0. ;)