EU/UK data-subject exposure but no Article 27 representative named

GDPR (General Data Protection Regulation) Article 27 requires certain non-EU businesses that offer goods or services to, or monitor, people in the EU or UK to appoint and name a local representative in their privacy policy. This check looks at whether the site targets or mentions EU/UK users while being based outside the EU/UK, and whether a representative is named. On this site, EU/UK exposure was found, but no representative is named in the policy. This is one of the most commonly missed GDPR obligations for non-EU businesses, precisely because it only applies when a business isn't physically based in the EU or UK but still serves people there. Without a named representative, the business has no formal contact point for EU/UK regulators or data subjects, which is exactly the kind of gap a compliance review or enterprise customer's due diligence process would flag. If the business genuinely has EU or UK customers, your privacy lawyer should appoint a formal EU representative, and a UK one too since UK GDPR is separate, and name them, along with a contact address, in the privacy policy. Several services offer this as a low-cost ongoing subscription rather than requiring an in-house appointment, so this is typically about a day to set up.