# Standards and Regulatory References

## Primary Legislation

### GDPR Article 27 -- EU Representative
- **Art. 27(1)**: Non-EU controllers/processors subject to Art. 3(2) must designate a representative in writing.
- **Art. 27(2)**: Exemptions: occasional processing without large-scale special category data and unlikely risk; public authorities.
- **Art. 27(3)**: Representative established in a Member State where affected data subjects are located.
- **Art. 27(4)**: Representative is the contact point for supervisory authorities and data subjects.
- **Art. 27(5)**: Designation does not affect legal proceedings against the controller/processor itself.

### GDPR Article 3(2) -- Territorial Scope
GDPR applies to non-EU entities when processing relates to offering goods/services to EU data subjects or monitoring their behaviour within the Union.

## Regulatory Guidance and Enforcement

- **EDPB Guidelines 3/2018 on Territorial Scope (adopted 12 November 2019)**: When Art. 3(2) applies and when an EU representative must be appointed.
- **Clearview AI (Multiple DPAs, 2021-2022)**: Non-EU company fined without EU representative by Italian, Greek, French, and UK authorities.

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: Privacy Information Management System extending ISO 27001/27002 with privacy-specific controls aligned to GDPR.
- **ISO/IEC 27001:2022**: Information Security Management System providing security foundation for GDPR compliance.