The GDPR applies to a company with no EU office if it offers goods or services to people in the EU, or monitors their behaviour there (Article 3(2)). A company caught this way must also appoint a representative in the EU under Article 27, unless a narrow exemption applies. Both rules have applied since 25 May 2018.
This guide is for compliance and data protection leads in GCC companies that sell to, or track, people in Europe.
When does the GDPR reach a company with no EU office?
The GDPR is Regulation (EU) 2016/679. Article 3(1) covers processing linked to an EU establishment. Article 3(2) covers companies with none, such as a business based only in Dubai or Riyadh.
The European Data Protection Board (EDPB) reads Article 3(2) as a two-step test in its Guidelines 3/2018 on territorial scope, adopted in final form on 12 November 2019. First, does the processing concern people who are in the Union? Second, does it relate to offering them goods or services, paid or free, or to monitoring their behaviour there?
Many pages say the GDPR protects "EU citizens". That is the wrong test. Nationality and residence do not decide. What counts is where the person is at the moment you make the offer or monitor them.
Processing data of someone in the EU is not enough on its own. The offer must be intentional, not incidental. Recital 23 says a website reachable from Europe, an email address or content in your home language does not show that intention. An EU language or currency with the option to order in it, or mention of EU customers, can.
Monitoring means tracking people online, including profiling to predict their preferences or behaviour (Recital 24). The EDPB lists behavioural advertising, geo-localisation for marketing, cookie tracking and CCTV. Scope is assessed per activity, so you can be in scope for your app and out of scope for your payroll.
Which situations are caught, and which are not?
These EDPB worked examples are closest to Gulf situations.
| Situation | GDPR applies? | Why | EU representative needed? |
|---|---|---|---|
| Turkish photo-album website in English, French, Dutch and German, taking euros and delivering to France, Benelux and Germany | Yes | Languages, currency and delivery show an offer to people in the EU | Yes |
| US company tracking shoppers' movements in a French mall by Wi-Fi | Yes | Monitoring of behaviour in the EU | Yes |
| Swiss university advertising a summer course at German and Austrian universities | Yes, for that course | Targeted offer. Its general worldwide recruitment is outside scope | Yes, unless the Article 27(2) exemption applies |
| Non-EU processor serving a controller that targets people in the EU | Yes, for that processing | The processing relates to the controller's offer or monitoring | Yes, unless the Article 27(2) exemption applies |
| Australian news app offered only in Australia, used by a subscriber travelling in the EU | No | No intention to target people in the EU | No |
| Taiwanese bank serving German nationals who live in Taiwan | No | The customers are not in the EU | No |
Guides in this series
- When a DPIA is required under the GDPR
- GDPR records of processing activities (ROPA)
- When a Data Protection Officer is mandatory
- GDPR 72-hour breach notification
- GDPR cookie banners for online stores
What does this mean for a company in the UAE or Saudi Arabia?
Typical Gulf triggers match the EDPB factors: a checkout in euros or an EU language, delivery to EU states, ads aimed at an EU country, and hotel or tour packages marketed to Europeans. Apps tracking users' location or behaviour in the EU are caught too.
These do not catch you on their own: a website reachable from Europe, home-market content, a German expat banking with you in Dubai, or a European tourist using a UAE-only service.
Two points are often missed. Without an EU establishment you cannot use the one-stop shop, so you have no single lead authority. And the GDPR applies on top of your home law, not instead of it.
Gulf laws also reach foreign companies, on their own triggers. Saudi PDPL Article 2(1) covers processing of data of people residing in the Kingdom by any party outside it, so residence counts there in a way it does not under the GDPR. UAE Federal Decree-Law 45 of 2021, Article 2(1), reaches controllers and processors outside the State that process data of people inside it. Our guide to Saudi PDPL enforcement covers the Saudi side.
Transfers are a separate question. EDPB Guidelines 05/2021 say data a customer in the EU types into your website is not a "transfer", because it comes straight from the person. Data an EU business sends you is. No GCC state, DIFC or ADGM is on the Commission's list of adequacy decisions, so those transfers need a safeguard such as the standard contractual clauses of Decision (EU) 2021/914.
What does an EU representative do, and what does it not do?
Article 27(1) requires you to designate a representative in writing. Article 27(3) says it must be established in a Member State where the people you target or monitor are. The EDPB suggests the Member State where a significant share of them are. Authorities and individuals can contact the representative instead of you, or as well as you (Article 27(4)).
The representative can be a law firm, a private company or an individual under a service contract. The EDPB considers the role incompatible with being your external DPO or your processor. Appointing one does not create an EU establishment and does not shield you, because action can still be taken against your company (Article 27(5)).
The exemption in Article 27(2)(a) is narrow. Processing must be occasional, must exclude large-scale special-category or criminal-offence data, and must be unlikely to result in a risk. All three conditions must be met.
On 12 May 2021 the Dutch authority fined Locatefamily.com EUR 525,000 for having no EU representative. Its decision against Clearview AI, final on 16 May 2024, totalled EUR 30,500,000 and included the same failure among others. Both are Dutch cases, not a measure of how often this happens.
Which GDPR duties apply once you are in scope?
The core duties match an EU company's. You need a lawful basis for each activity (Article 6), privacy notices that name your representative (Articles 13 and 14), and answers to rights requests within one month, extendable by two (Article 12(3)). You also need processor contracts (Article 28), security (Article 32) and records of processing (Article 30).
Your representative must hold a copy of your record of processing and give it to an authority on request. Organisations under 250 employees are exempt from records only if processing is occasional, unlikely to be risky and excludes special-category and criminal-offence data.
Breaches go to the authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk (Article 33). DPIAs (Article 35) and a DPO (Article 37) apply in defined cases.
Two changes are proposed, not in force. Under COM(2025) 501, as agreed with the Council in June 2026, organisations under 1,000 employees would keep records only for activities likely to be high risk or that require a DPO. Parliament's plenary vote is indicated for 23 November 2026. COM(2025) 837, the Digital Omnibus of 19 November 2025, proposes notifying only high-risk breaches, within 96 hours.
Fines run on two tiers. A missing representative or record sits in the tier of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. The EUR 20 million or 4% tier covers principles, rights and transfers.
What will an authority or EU client ask to see?
Authorities and EU clients will ask questions like these:
- Why do you say the GDPR does or does not apply? Show a written scope assessment per activity, using the two-step test.
- Who is your representative, and where? Show the written mandate and the named lead contact.
- If you have none, why not? Show an Article 27(2) assessment covering all three conditions.
- Does your privacy notice name the representative, and can the representative produce your record of processing today?
- How do people in the EU exercise their rights? Show the procedure and the request log.
- Which processors and group companies receive EU data? Show Article 28 contracts and a transfer map.
Security evidence often comes from an ISMS. Our guides to ISO/IEC 27001:2022 and ISO/IEC 27701 explain how those systems produce it.
How AGS can help
Three kits cover this topic in editable Microsoft Word and Excel files, with PowerPoint in the training package. None appoints a representative.
- EU GDPR Core Management System: 26 documents. Its Scope and Applicability volume holds an Article 3(2) assessment and an EU representative assessment.
- EU GDPR & ISO/IEC 27001:2022 Integrated Management System: 72 documents, with a GDPR and ISO/IEC 27001 traceability matrix.
- EU GDPR Privacy & Data Protection Awareness Training Package: 337 documents, including 18 slide decks.
Frequently asked questions
Does paying our staff on EU business trips bring us into scope?
No. The EDPB treats an employer's salary and expense processing as outside "offering goods or services" (Examples 13 and 15 of Guidelines 3/2018).
Do we have to register our EU representative with an authority?
There is no duty to notify the appointment. You must give the representative's identity and contact details to individuals in your privacy notice.
Do we need a separate representative for each in-scope activity?
No. The EDPB says one company needs only one representative, even with several in-scope activities.
AGS provides independent documentation toolkits. This guide and the referenced kits are not affiliated with, endorsed by or approved by the European Commission, the European Data Protection Board or any supervisory authority. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
