Firms based outside the EEA and/or the UK without an establishment in the EEA and/or the UK but offering services to individuals in the EEA and/or the UK (e.g. provision of a website in an EU language) or monitoring behaviour (e.g. cookie profiling), need to appoint a Representative in the EEA and/or the UK according to Article 27 of the GDPR.

The GDPR extends its territorial scope beyond the territory of the EEA and of the UK and
therefore can be enforced on firms outside of Europe with potential fines of EUR 20 million or 4% of turnover whichever is greater.

Under GDPR, you are expected to maintain privacy framework of which the core elements are: privacy notice (art. 13 and 14 GDPR);  records of processing activities (art.30 GDPR); employee training and internal policies and procedures ensuring compliance with the core principals of GDPR.

Controllers and processors are exempt from the requirement to have a representative if all of the following criteria are met:

• Personal data is only processed occasionally (this is expected to be interpreted narrowly).
• The processing does not include large-scale data processing of special categories of personal data or personal data relating to criminal convictions and offences.
• The processing is unlikely to result in a risk to the rights and freedoms of the data subject.

Note that in practice it would be difficult for a business to claim that personal data is processed ‘occasionally’ as according to European Data Protection Board’s guidelines* occasionally means that it may happen more than once, but not regularly, and would occur outside the regular course of actions.
*https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_2_2018_derogations_en.pdf