Article 27 GDPR · the procedure
How to appoint an EU representative, step by step
The rule says designate one in writing. It does not say how, and that silence is where companies lose a fortnight arguing about a document that takes an hour. Here is the whole procedure, what each step is for, and the three places people go wrong.
Before you start: four things to decide
None of these need a lawyer, but getting them wrong means reissuing the mandate later.
01
Which entity is represented
The legal person that decides why and how data is processed. Not the brand, not the app: the company that would be named in a complaint. If two entities share a website, each needs its own designation.
02
Controller or processor
Both must appoint. The distinction changes the wording and what the representative is asked for: a controller receives complaints from individuals, a processor mostly receives questions from its clients’ auditors.
03
Which member states you target
Article 27(3) ties the establishment to where the people are. In practice one establishment covering all 27 is accepted and is what everyone does, but the mandate should say so rather than leave it blank.
04
Who signs
Someone able to bind the company. A marketing manager signing a designation is a designation that fails the first time it matters.
The procedure
Complete the designation form
Legal name, registration number, registered address, the person signing and their role, plus a plain description of what you process and for whom. Five minutes with your company details to hand.
Sign the mandate
You receive the written designation naming the territory covered and the tasks under Article 27(4), and sign it electronically. Nothing is posted and nothing is translated at this stage.
We countersign
A director accepts the mandate on our side. Acceptance matters: a designation the representative has not accepted is not a designation, and this is the step cheap providers skip.
Publish the name where people can find it
Your privacy notice must carry the representative’s identity and contact details. We send the exact wording to paste, in the language of the notice.
Keep the proof reachable
You receive a certificate and a verification code that resolves on a public register, so an authority or an enterprise customer checks it without writing to you.
What the designation must contain
A mandate missing any of these gets challenged in practice, usually by an enterprise customer’s procurement team rather than by an authority.
| Element | Why it is there |
|---|---|
| Identity of both parties | Registration numbers, not just trading names, so the entity is unambiguous |
| Explicit acceptance | A one-sided appointment binds nobody |
| Territory covered | Article 27(3) ties the establishment to where the data subjects are |
| Tasks under Article 27(4) | The representative is addressed in addition to or instead of you |
| Access to records | The representative maintains the record of processing on your behalf |
| Duration and termination | Cover with no end date cannot be verified as current |
| Contact channel | An address a data subject can actually write to, inside the Union |
Three ways this goes wrong
Naming a law firm on retainer
A retainer is not a designation. If the firm has not accepted the mandate in writing and its details are not published in your notice, you have paid for advice, not for a representative.
Signing but never publishing
The most common failure. The mandate sits in a drawer, the privacy notice never changes, and nobody can reach the representative — which is the entire point of the article.
Letting it lapse quietly
Cover ends, the notice still names the old provider, and a data subject writes to an address nobody reads. A designation that cannot be checked is indistinguishable from one that has expired.
Questions asked during the procedure
Do we need to incorporate a company in Europe?
No. The representative is established here on your behalf under a mandate. Incorporating would make you established in the Union, which changes your obligations entirely and costs far more.
Does the designation have to be notarised or apostilled?
No. Article 27 requires it in writing. An electronic signature under eIDAS satisfies that, which is why the whole procedure fits in a day.
Can one representative cover several group companies?
Each legal entity needs its own designation, because each is separately accountable. They can be issued the same day under one account, and we price them as a group.
What if we already published a different name?
You update the notice when the new designation is live. Overlapping for a few days is normal, and better than a gap — a gap is what an authority would see if it looked on the wrong day.
How fast can this be done?
The designation is issued the same working day the form and payment are complete. The slow part is usually deciding who signs on your side.
Appoint an EU representative today
From €290 for the first year, less on renewal. Issued the same working day, with a code anyone can check.
See the plans Which one do I need?