A company must appoint an EU representative pursuant to Article 27 (1) GDPR if this company (i.e., the represented party) offers goods or services within the EU to data subjects or monitors their behaviour in the EU in accordance with the marketplace principle laid down in Article 3 (2) GDPR, but does not have an establishment in the EU, i.e., within the scope of the GDPR, but instead is established in a third country.
Accordingly, there must be a targeted processing of personal data of data subjects located in the EU, regardless of their nationality/legal status (Recital 14) and
the specific data processing must relate to the offering of goods or services (including free of charge) or behavioural monitoring in the EU.
Exceptions only apply in the case of occasional processing of personal data with low sensitivity, which does not result in a risk to the rights and freedoms of natural persons, or if the company is a public authority or body. If these exceptions do not apply, the designation of an EU representative is mandatory by law and therefore required. If the designation is not made despite the existence of the above-mentioned requirements, the competent supervisory authority may impose an administrative fine on the company in question.