Australian businesses increasingly sell directly to customers in Germany and the European Union: wine and food exporters with EU online shops, fashion and outdoor brands, SaaS companies, and education providers recruiting students from Europe. English is the business language on both sides, but the GDPR applies to the EU-related part of the business under Art. 3(2) GDPR, and Art. 27 GDPR requires a representative in the EU if the company has no establishment there. Kanzlei Matutis, a German data protection law firm, acts as EU representative for Australian companies for 350 EUR per year.
Does a company from Australia need an EU representative?
Yes, if it has no establishment in the EU and its processing of personal data relates to offering goods or services to people in the EU or to monitoring their behaviour there (Art. 3(2) in conjunction with Art. 27(1) GDPR). Examples: a Melbourne skincare brand with an EU web shop and prices in EUR; a Sydney SaaS company with customers in Germany; a Perth university pathway provider whose website tracks prospective students in the EU for remarketing. A Australian company that already has a subsidiary, branch or office in an EU Member State does not need a representative; that EU entity is the point of contact. The exceptions of Art. 27(2) GDPR (occasional, low-risk processing without large-scale sensitive data; public authorities) are narrow and rarely apply to a business that actively markets to the EU. The full criteria are explained on the page What is the legal situation?.
The Australian Privacy Act and the GDPR
Australian privacy law is set out in the Privacy Act 1988 and the 13 Australian Privacy Principles, supervised by the Office of the Australian Information Commissioner (OAIC); the Act was substantially reformed in 2024. There is no EU adequacy decision for Australia under Art. 45 GDPR, so EU companies that transfer personal data to Australian providers need standard contractual clauses. This matters for Australian processors serving EU clients. For the question of the EU representative it is irrelevant: an Australian company that targets people in the EU falls under the GDPR by virtue of Art. 3(2) GDPR, and the representative under Art. 27 GDPR is required whether or not an adequacy decision exists. The small-business exemption of the Australian Privacy Act (annual turnover below AUD 3 million) has no counterpart in the GDPR; a small Australian company targeting the EU is fully subject to the GDPR.
What we do as EU representative for Australian companies
Rechtsanwaltskanzlei Matutis is a German law firm in Potsdam, near Berlin, specialised in data protection law. Under a written mandate pursuant to Art. 27(1) GDPR we act as your point of contact in the EU for all supervisory authorities of the Member States and for data subjects. Letters and emails addressed to us are checked, scanned and forwarded to your contact person without undue delay; we point out deadlines, such as the one-month period for data subject requests under Art. 12(3) GDPR. With a time difference of eight to ten hours, mail received in Potsdam during our working day is forwarded by email and waits in your inbox the next morning; urgent deadlines are flagged in the subject line. We communicate in English and German. We do not replace your Data Protection Officer and do not take over your compliance decisions; the difference is explained on the page EU representative vs. Data Protection Officer.
Cost for companies from Australia
The annual flat fee is 350 EUR. Because the service is provided by a German law firm to a business customer outside Germany, German VAT is not charged (reverse charge), so net equals gross. We invoice in EUR; payment by international transfer or by credit card or PayPal is possible. Forwarding of scanned mail by email is included; postal forwarding of originals is charged at 2 EUR per item plus postage. Full details: What does it cost and what is included?
Next step
Send us your company name, website and a short description of your activities in the EU via the inquiry form. We confirm whether a representative is required in your case and send you the contract and written mandate. The complete process is described on the page How to appoint an EU GDPR representative. Other countries: EU representative by country.