One publicly documented European decision has turned on a missing representative alone: the Dutch supervisory authority fined Locatefamily.com EUR 525,000 in a decision published on 12 May 2021. Everywhere else there is a statutory framework but no precedent — and the German figures are far lower than the 6% DSA ceiling usually quoted.
Each figure below traces to an official decision or a penalty provision. Where no case exists, this page says so — absence of enforcement is not a safe harbor.
Has anyone actually been fined for not appointing an EU representative?
One documented decision, and it is a GDPR case: the Autoriteit Persoonsgegevens fined Locatefamily.com EUR 525,000 for failing to designate a representative in the Union, published on 12 May 2021. It added a penalty payment of EUR 20,000 for every two weeks without one, capped at EUR 120,000.
The company had until 18 March 2021; the missing representative in the Union was itself the breach.
The case usually cited alongside it belongs elsewhere. The Italian Garante ordered Clearview AI on 10 February 2022 to designate a representative in the European Union within thirty days (Article 58(2)(d) GDPR); its fine answered several infringements together, as did the Dutch decision against the same company of 16 May 2024. Neither is a figure for Article 27.
| Regime | Provision | Statutory range | Documented case | Date (decision / applicability) | Source |
|---|---|---|---|---|---|
| GDPR | Art. 27; fine under Art. 83(4)(a) | up to EUR 10 m or 2% of turnover | Locatefamily.com, EUR 525,000 + penalty payment | decision 10 December 2020 · published 12 May 2021 | Autoriteit Persoonsgegevens (NL) |
| GDPR (order) | Art. 58(2)(d) | designation within 30 days | Clearview AI — order (IT); Art. 27 also among several infringements in the Dutch decision | 10 February 2022 · 16 May 2024 | Garante (IT) · AP (NL) |
| DSA (Germany) | Art. 13; § 33(5) no. 2, (6) no. 2(b), (8) DDG | up to EUR 100,000; 1% above EUR 10 m | none published | DSA 17 February 2024 · DDG 14 May 2024 | DDG |
| AI Act | Art. 22; fine under Art. 99(4)(b) | up to EUR 15 m or 3% of turnover | none published | from 2 December 2027 / 2 August 2028 | Reg. (EU) 2024/1689, 2026/1744 |
| NIS2 (Germany) | Art. 26(3); § 60(3), §§ 33, 34, 65 BSIG | up to EUR 500,000 (registration) | none published | since 6 December 2025 | BSIG |
| Data Act | Art. 37(11)–(13); Art. 40 | national; no EU ceiling | none published | since 12 September 2025 | Reg. (EU) 2023/2854 |
How high can a GDPR fine for a missing representative go?
Article 83(4)(a) GDPR covers, among others, infringements of Articles 25 to 39, and Article 27 sits inside that range. The ceiling is EUR 10 million, or 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher. That is a ceiling, not a tariff.
The amount follows the Article 83(2) criteria.
What does Germany impose for a missing DSA representative?
Up to EUR 100,000; where total turnover exceeds EUR 10 million, up to 1% of it instead. The offence is section 33(5) no. 2 of the German implementing act (Digitale-Dienste-Gesetz, DDG), read with section 33(6) no. 2(b) and section 33(8). The 6% figure from Article 52 DSA does not apply to it.
Article 52(3) DSA does set a 6% ceiling for DSA infringements, and section 33(7) DDG implements it — but its list of covered cases does not include the missing representative.
No published decision has yet turned on Article 13 alone. The notification duty in Article 13(4), backed by section 33(5) no. 4 DDG, makes the gap visible to the Digital Services Coordinator (Koordinierungsstelle für digitale Dienste) at the Bundesnetzagentur in Bonn. There is no size threshold — see duties and liability under Article 13 DSA.
Can the representative itself be fined under the AI Act?
Yes, but not yet. Article 99(4)(b) makes the Article 22 obligations of authorised (US: authorized) representatives a fineable infringement, at up to EUR 15 million or 3% of worldwide annual turnover — from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Article 99(4) sets no ceiling for Article 54.
The deferral comes from Regulation (EU) 2026/1744. Once Article 22 applies, the representative becomes an addressee in its own right. The Article 54 duty for general-purpose AI has applied since 2 August 2025, but Article 99(4) lists no ceiling for it; Chapter V is enforced by the Commission alone (Article 88(1)), which since 2 August 2026 can fine the provider up to EUR 15 million or 3% of worldwide turnover (Article 101).
What happens under NIS2 and the Data Act?
Under NIS2 the fine ceilings in Article 34(4) and (5) attach to Articles 21 and 23, not to the representative duty in Article 26(3). German law penalizes the registration instead: sections 33(1) and 34(1) BSIG, with a ceiling of EUR 500,000 under section 65. Under the Data Act, competence simply spreads.
In force since 6 December 2025, the BSIG requires registration within three months; section 34(1) nos. 3 and 4 put the representative’s address in that filing. Section 60(3) is a lever, not a penalty: appoint in Germany and the BSI becomes competent.
Article 37(13) of the Data Act is blunter: until a representative is designated, the entity falls under the competence of all Member States, and any may impose penalties set nationally (Article 40) — unless another competent authority is already proceeding on the same facts. Applies since 12 September 2025.
What is the real exposure of not appointing one?
For most companies it is not the fine. Without a representative there is no address in the Union for an authority to use, the Data Act opens all 27 Member States, NIS2 hands jurisdiction to every Member State you serve, and the DSA notification duty leaves a visible gap.
Whether any of them applies to you: which EU representative duty applies to your business. The steps: how to appoint an EU representative.
Close the gap, or have the exposure assessed
Have Regingada UG act as your EU representative →Appointment itself is handled by Regingada UG (haftungsbeschränkt), a legally separate company owned by the attorney; legal assessment is a separate mandate with the law firm.
Already contacted by an authority? Discuss the case with the attorney.
Replies within one business day · CET/CEST (UTC+1/+2)
Frequently asked
Is the 6% of global turnover figure wrong?
Not as a description of the DSA in general — Article 52(3) DSA does set that ceiling for DSA infringements. It is wrong for this particular breach in Germany: section 33 DDG puts the missing legal representative in the EUR 100,000 bracket, with 1% of total turnover above EUR 10 million.
Was Clearview AI fined for not having an EU representative?
No. The Italian Garante ordered Clearview AI on 10 February 2022 to designate a representative in the European Union within thirty days. The fine in that decision covered several infringements together. It should not be quoted as the figure for a missing Article 27 representative.
Can a fine be sent to the representative instead of to us?
Under the GDPR the European Data Protection Board takes the view that corrective measures and fines imposed on the non-EU controller can be addressed to the representative, while the representative’s own direct liability is limited to Articles 30 and 58(1)(a). The DSA goes further: Article 13(3) allows the representative to be held liable in its own right.
Does a fine end the obligation?
No. The Dutch decision attached a penalty payment of EUR 20,000 for every two weeks without a representative, capped at EUR 120,000, which is the usual construction: the fine answers the past, a periodic penalty answers the continuing failure.
We have no EU entity. Does appointing a representative create one?
No — Article 13(5) DSA says so expressly, and the European Data Protection Board takes the same view for the GDPR; whether a duty reaches you at all is set out in which EU representative duty applies to your business.
Do we need a data protection officer as well?
Possibly, but the triggers are unrelated. The two roles are compared in EU representative vs. data protection officer.
- Regulation (EU) 2016/679 (GDPR), Articles 27, 58, 83 — data.europa.eu/eli/reg/2016/679/oj
- Autoriteit Persoonsgegevens, fine of EUR 525,000 on Locatefamily.com, published 12 May 2021 — autoriteitpersoonsgegevens.nl
- Garante per la protezione dei dati personali, Clearview AI, order of 10 February 2022, doc-web 9751362 — garanteprivacy.it
- Autoriteit Persoonsgegevens, decision on Clearview AI of 16 May 2024 (Article 27 among several infringements) — edpb.europa.eu
- EDPB, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), Version 2.1, 7 January 2020, section 4(d), pp. 27–28 — edpb.europa.eu
- Regulation (EU) 2022/2065 (Digital Services Act), Articles 13, 52 — data.europa.eu/eli/reg/2022/2065/oj
- Digitale-Dienste-Gesetz (DDG), §§ 12, 14, 33 — gesetze-im-internet.de/ddg
- Regulation (EU) 2024/1689 (AI Act), Articles 3(8), 22, 54, 88, 99, 101 — data.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 (OJ of 24 July 2026, in force 27 July 2026) — data.europa.eu/eli/reg/2026/1744/oj
- Directive (EU) 2022/2555 (NIS2), Articles 26(3), 34 — data.europa.eu/eli/dir/2022/2555/oj
- BSI-Gesetz (BSIG 2025), §§ 33, 34, 60, 65 — gesetze-im-internet.de/bsig_2025
- Regulation (EU) 2023/2854 (Data Act), Articles 37(11)–(13), 40 — data.europa.eu/eli/reg/2023/2854/oj