Obligation Checker

Do I Need a Representative in Europe?

Use this page to identify which representative mandates may apply to your organisation, based on where your users and data subjects are located and where multiple European obligations may arise at the same time.

Representative Scope

Identify which mandates may apply to your organisation

Use this table to identify which representative obligations may apply to your organisation. This is a non-binding orientation tool, not legal advice. Your obligation is triggered by where your customers and data subjects are located, not where your organisation is headquartered.

Try the guided self-check tool →

Coordinated Coverage

Where multiple representative obligations overlap

This table is a starting point. Multiple obligations often apply simultaneously — for example, a non-EU SaaS company offering services to EU and UK users may need EU GDPR, UK GDPR, DSA and NIS2 representatives. Lionheart can hold all of these under a single coordinated mandate.

Regulation

EU GDPR (Art. 27)

Key question

Are you not established in the EU, but offer goods or services to individuals there - or monitor their behaviour - as a controller or processor?

If yes

EU GDPR representative

Regulation

UK GDPR (Art. 27)

Key question

Are you not established in the UK, but offer goods or services to individuals there - or monitor their behaviour - as a controller or processor?

If yes

UK GDPR representative

Regulation

Swiss FADP (Art. 14)

Key question

Are you a data controller not established in Switzerland, but regularly process personal data of individuals there?

If yes

Swiss FADP representative (controllers only)

Regulation

Serbian PDPL (Art. 44)

Key question

Are you not established in Serbia, but offer goods or services to individuals there - or monitor their behaviour - as a controller or processor?

If yes

Serbian PDPL representative

Regulation

DSA (Art. 13)

Key question

Do you provide intermediary services (hosting, marketplaces, app stores, search, social platforms) to users in the EU and are not established there?

If yes

DSA legal representative

Regulation

EU AI Act (Arts. 22 & 54)

Key question

Do you place high-risk AI systems or general-purpose AI models on the EU market and are not established in the EU?

If yes

AI Act authorised representative

Regulation

NIS2 EU (Art. 26)

Key question

Do you provide in-scope digital services (cloud, DNS, CDN, managed ICT, online marketplaces, social platforms) to EU users and are not established in the EU?

If yes

NIS2 representative (Sm./Med. and above only)

Regulation

NIS UK (Reg. 14A)

Key question

Do you provide online search, marketplace or cloud computing services to UK users and are not established in the UK?

If yes

UK NIS representative

Regulation

CSR UK (coming 2026)

Key question

Do you provide in-scope digital services in the UK, as defined in the forthcoming Cyber Security Resilience Act?

If yes

UK CSR representative (service in preparation)

Regulation

TCOR (Art. 17)

Key question

Are you a non-EU hosting service provider whose services can be used to disseminate content to the public in the EU?

If yes

TCOR legal representative

Regulation

e-Evidence (Dir. 2023/1544)

Key question

Do you operate a non-EU online platform or communications service with EU users that may receive cross-border data production orders?

If yes

e-Evidence representative (from 18 Aug 2026)

Regulation

DGA (Arts. 11.3 & 19.3)

Key question

Are you a non-EU data intermediation service provider (DISP) or recognised data altruism organisation (RDAO) offering services in the EU?

If yes

DGA legal representative

Regulation	Key question - does this apply to you?	If yes - you likely need a
EU GDPR (Art. 27)	Are you not established in the EU, but offer goods or services to individuals there - or monitor their behaviour - as a controller or processor?	EU GDPR representative
UK GDPR (Art. 27)	Are you not established in the UK, but offer goods or services to individuals there - or monitor their behaviour - as a controller or processor?	UK GDPR representative
Swiss FADP (Art. 14)	Are you a data controller not established in Switzerland, but regularly process personal data of individuals there?	Swiss FADP representative (controllers only)
Serbian PDPL (Art. 44)	Are you not established in Serbia, but offer goods or services to individuals there - or monitor their behaviour - as a controller or processor?	Serbian PDPL representative
DSA (Art. 13)	Do you provide intermediary services (hosting, marketplaces, app stores, search, social platforms) to users in the EU and are not established there?	DSA legal representative
EU AI Act (Arts. 22 & 54)	Do you place high-risk AI systems or general-purpose AI models on the EU market and are not established in the EU?	AI Act authorised representative
NIS2 EU (Art. 26)	Do you provide in-scope digital services (cloud, DNS, CDN, managed ICT, online marketplaces, social platforms) to EU users and are not established in the EU?	NIS2 representative (Sm./Med. and above only)
NIS UK (Reg. 14A)	Do you provide online search, marketplace or cloud computing services to UK users and are not established in the UK?	UK NIS representative
CSR UK (coming 2026)	Do you provide in-scope digital services in the UK, as defined in the forthcoming Cyber Security Resilience Act?	UK CSR representative (service in preparation)
TCOR (Art. 17)	Are you a non-EU hosting service provider whose services can be used to disseminate content to the public in the EU?	TCOR legal representative
e-Evidence (Dir. 2023/1544)	Do you operate a non-EU online platform or communications service with EU users that may receive cross-border data production orders?	e-Evidence representative (from 18 Aug 2026)
DGA (Arts. 11.3 & 19.3)	Are you a non-EU data intermediation service provider (DISP) or recognised data altruism organisation (RDAO) offering services in the EU?	DGA legal representative

Need a Clearer Mandate Map?

One coordinated relationship across overlapping obligations

This table is a starting point. Multiple obligations often apply simultaneously - for example, a non-EU SaaS company offering services to EU and UK users may need EU GDPR, UK GDPR, DSA and NIS2 representatives. Lionheart can hold all of these under a single coordinated mandate.