GDPR EU representative for iOS apps: who needs one in 2026

Who can act as the representative, what the mandate must say, how it differs from App Store trader status and what regulators have fined companies for.

A developer with no office in the European Union must appoint an EU representative under Article 27 of the GDPR once its iOS app processes the personal data of people in the EU to whom it is offered or whose behaviour it monitors.

Why an iOS app falls under the GDPR

Both tests come from Article 3 of the GDPR. For an iOS app the first turns on choices made in App Store Connect. Regulators look for concrete signs of targeting, such as an interface in the language of an EU country, prices in euros or a mention of customers in Europe. Selecting EU countries in App Store Connect and localising the app into German, French or Italian is exactly that.

The second test is often met too. If the app's App Privacy details list data used to track you, or the app asks for permission through App Tracking Transparency, it follows people across apps and websites for advertising, and European regulators treat that as monitoring. The European Data Protection Board gives an example shaped like an app: a US start-up with no presence in Europe offers a city map for tourists that works in Paris and Rome. That is offering a service in the EU, and once the start-up uses location data for targeted ads, it monitors behaviour as well.

For any developer that is not a public authority, the only exemption is narrow. Processing must be occasional, must not involve health, biometric or other sensitive data on a large scale, and must be unlikely to put people's rights at risk, all at the same time. An app that serves European customers every day fails the first condition.

Who can be your EU representative

The representative is a natural or legal person established in one of the EU countries where your users are. In practice the role goes to law firms, consultancies and specialised companies, and a company of your own group registered in the EU can serve as well: what matters is a written mandate and a real address in the Union. When the representative is a company, the European Data Protection Board recommends naming one individual in charge of your file.

The board advises choosing the country where a significant share of your users live. Two roles are off limits: the representative cannot also be your external data protection officer or a processor that handles data for you, because both create a conflict of interest.

A representative in the United Kingdom no longer counts for the EU. Spain's data protection authority sanctioned an advertising network in 2025 because its representative sat in Northern Ireland, which left the company with no representative in the Union at all; that part of the fine was set at $57,000 (€50,000), cut by 40% once the company admitted liability and paid early.

What the written mandate must cover

The mandate authorises regulators and users to deal with the representative in addition to the developer or instead of it, on every question about the processing. It should also spell out the duties the GDPR places on the representative directly: keeping the record of processing activities and producing it on request, cooperating with the supervisory authority and handing over any information the authority orders.

The developer's own liability does not move: authorities can still act against the company itself. Enforcement, however, can run through the representative, including corrective orders and fines imposed on the developer. That is why a serious representative reviews the client's privacy policy and record of processing before signing.

The mandate should name Article 27 of the GDPR explicitly. In 2022 Italy's data protection authority, the Garante, fined Senseonics, the maker of the Eversense glucose-monitoring app, $51,000 (€45,000) for a set of breaches that included this one: the company had an authorised representative under EU medical device law and assumed it covered data protection too.

Where the representative appears in your iOS app

Apple requires every app to link to a privacy policy, both in the App Store Connect metadata and inside the app. Under the GDPR that policy must give the identity and contact details of the controller and of its EU representative: a name, a postal address in the EU and a working email.

The Garante fined Clubhouse $2.3 million (€2 million) in 2022, and two of the faults concerned the representative. The privacy policy gave its postal address but no email, and the representative's own page, linked from the policy, presented it as a mere facilitator, while the law makes it the real counterpart acting for the company. The developer had first argued that a listing in the two major app stores did not mean it targeted Italy, then stopped contesting that the GDPR applied, and the authority enforced it.

Test the mailbox you publish. A representative's address that sends messages to spam means a lost request from a user or a regulator.

Trader status on the App Store is a different obligation

Apple requires every developer to declare whether it is a trader under the Digital Services Act. Since 16 October 2024 an update without the declaration cannot be submitted for review, and since 17 February 2025 such apps have been removed from the App Store across the EU. A trader's address, phone number and email appear on the app's product page in all 27 EU countries, and Apple confirms the phone and email with two-factor verification. These details tell customers who sells the app. They appoint no one to answer for your data processing and do not replace an Article 27 representative.

For a solo developer the declaration raises a practical problem: the address shown to European customers. Apple accepts a P.O. box instead of a home address only with a document that links it to the developer. A company's listing shows the address tied to its D-U-N-S number, the route we cover in our guide to an Apple Developer Program membership for a company.

Apps that need a second representative under the DSA

An iOS app that stores and shows content uploaded by its users, such as posts, photos, reviews, listings or shared files, is an intermediary service under the Digital Services Act, which has applied to all providers since 17 February 2024. A provider with no establishment in the EU must then appoint a legal representative in writing in a member state where it offers the service. Small companies get no exemption, and the EU text treats availability in a country's app store as a sign that a service targets that country. An app with only its own content, such as a game without user uploads or a utility, does not need this second mandate.

The DSA representative carries more weight than the GDPR one. Its name, postal address, email and phone number go to the national Digital Services Coordinator and must be public, and the representative itself can be held liable for the provider's failures. Without one, every EU country may supervise and sanction the provider, with fines of up to 6% of global annual turnover.

British users need a UK representative

The United Kingdom has its own storefront in App Store Connect and its own version of the GDPR. Article 27 of the UK GDPR, which stayed in force after Brexit, obliges a developer with no establishment in the United Kingdom that offers an app to people there or monitors their behaviour to appoint a representative based in the United Kingdom in writing, under the same narrow exemption. The fines for a missing representative mirror the EU ones. Your EU representative cannot answer for British users, so apps sold on both sides of the Channel need two appointments.

Security reporting under the Cyber Resilience Act

The Cyber Resilience Act treats commercial apps, including free ones that earn money, as products with digital elements. Since 11 September 2026 their makers must report actively exploited vulnerabilities and severe security incidents: an early warning within 24 hours, a notification within 72 hours and a final report within 14 days of a fix for a vulnerability or within a month of the notification for an incident. The act's other requirements apply from 11 December 2027, and under it a representative in the EU is optional rather than mandatory.

What a missing representative has cost online services

A breach of Article 27 is punishable by a fine of up to $12 million (€10 million) or 2% of worldwide annual turnover, whichever is higher. The Dutch authority fined Locatefamily.com $590,000 (€525,000) for having no EU representative at all and ordered it to appoint one within twelve weeks or pay $23,000 (€20,000) for every two weeks of delay. The case began with complaints from people who could not get their data removed from the site.

In July 2026 the Garante fined Character Technologies, the US developer of a role-play chat app, $180,000 (€158,000) for five breaches. One of them was a representative appointed in May 2025, more than a year after the service launched in Italian, and the authority rejected the argument that processing for an Italian-language service was occasional.

How Murblz sets up your EU representative

We handle it end to end.

1. We check whether Article 27 applies to your app: storefronts, languages, the data you collect and the SDKs you embed.
2. We appoint your representative and draw up its written mandate.
3. We add the representative to your privacy policy, ready for App Store Connect.
4. We prepare the record of processing activities and keep it current as the app changes.
5. We set up the representative's mailbox and the forwarding of requests from users and regulators to you.
6. For apps with user content, we arrange the legal representative under the Digital Services Act.
7. If you prefer a structure of your own, we register an EU company of your group to serve as your representative.

FAQ