Article 11 of the Law on measures of network and IT system security requires the digital service providers that are not established in the EU but offer services to EU operators of essential services to designate a representative in the Union. Under Article 27 of the GDPR, representatives of controllers or processors not established in the EU must be established in one of the Member States.