[dingaling]

> Just complying with the regulation ought to be enough as the first step, especially for start-ups.

It is enough; most start-ups won't need a representative.

That requirement only applies to large-scale processing of special categories ( i.e. sensitive ) of data or that relating to criminal convictions and offences.

Article 27 applies: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE...

It's basically to prevent big data processors from claiming 'we don't have an EU presence so you can't fine us'.