Article 4 of the Cybersecurity Act requires that a digital service provider who offers online marketplace, online search engine or cloud computing services in Estonia but who is not established in the European Union shall designate a representative in Estonia or in another Member State of the European Union where they provide services (Directive (EU) 2016/1148, Article 18(2)).Under Article 27 of the GDPR, representatives of controllers or processors not established in the EU must be established in one of the Member States.