Two obligations, one common confusion
You were told you need an EU representative. Which one?
Two European rules ask a company outside the Union to name someone inside it. They sound identical in an email from a marketplace or a customer, and they are not interchangeable. One is about the personal data you hold. The other is about the physical goods you ship. Plenty of companies need both, and buy only one.
The line between them
The simplest test is what crosses the border. If what reaches Europe is information about people — an email address, an order history, an IP address — you are in Article 27 territory. If what reaches Europe is a box, you are in Article 16 territory. A webshop that ships kettles to Germany does both at once: it collects the buyer's address and it puts a kettle on the market.
| Article 27 GDPR | Article 16 GPSR | |
|---|---|---|
| What it protects | Personal data of people in the EU | Safety of consumer products sold in the EU |
| Who must appoint | Controllers and processors outside the EU that target or monitor people here | Manufacturers, importers and sellers placing non-food consumer goods on the EU market |
| Where the name appears | Privacy notice, and on request to authorities | On the product, its packaging, the parcel or the instructions |
| Who comes asking | Data protection authorities, and individuals | Market surveillance authorities, customs, marketplaces |
| What is held for you | Records of processing activities | Declaration of conformity and technical documentation |
| Typical trigger | A subject access request, or a complaint | A blocked listing, or goods stopped at the border |
| Practical failure mode | A fine, usually after a complaint | The listing disappears, before anyone writes to you |
| Our price | From €290 a year | From €190 a year |
Which one applies to you
Four questions settle it in under a minute. Answer them about your own company, not your supplier's.
You answered yes to data only
Software, apps, agencies, marketplaces, anything sold as a download or a login. You need Article 27 and nothing else — until you start shipping something in a box.
You answered yes to goods only
Rare, but real: a manufacturer selling to EU wholesalers who handle every customer directly. You need Article 16. The moment you sell to consumers yourself, the first question turns yes too.
What each one actually does when something happens
A representative is judged on the day a letter arrives, not on the day you sign. The two roles behave differently under pressure, and knowing how is what tells you whether a provider is real.
Article 27, day one
A person asks for a copy of their data, or a supervisory authority forwards a complaint. The representative acknowledges, notifies you, and keeps the record of processing available. The clock is one month, and it is your answer that counts — the representative carries it.
Article 16, day one
An authority asks for the declaration of conformity, or a marketplace suppresses a listing. The responsible person hands over the documentation, informs the authority of any risk, and cooperates on corrective action. The clock is set by the authority, and it is short.
The mistake that costs the most
Buying one and assuming it covers the other. It happens in a specific way: a company appoints an Article 27 representative for its webshop, publishes the name in the privacy notice, and considers Europe handled. Two years later a marketplace asks for the responsible person under the product safety rules, the privacy name does not fit the field, and every listing goes dark in a week.
The reverse also happens. A manufacturer buys a responsible person because Amazon demanded it, then receives a data request from a European customer and has nobody named for it.
Questions people send us before buying
Can the same company hold both roles?
Yes, and it is usually cheaper. We hold both under separate written mandates, because the obligations are separate: one names us to supervisory authorities, the other names us on your packaging. Our Multi plan covers Article 27 and Article 16 together.
Does a UK representative cover the EU?
No. The UK GDPR representative answers to the ICO for the United Kingdom, and the EU representative answers to European authorities. A company selling into both needs two, and neither substitutes for the product safety role.
We already have a lawyer in Europe. Is that enough?
Only if they accept the mandate in writing and their name and address are published where the rule requires. A retainer is not a designation. Under Article 16 the name must be on the product itself, which most law firms will not agree to.
Is the representative liable for us?
Under Article 27 the representative is a contact point, and the obligations under the GDPR remain yours. Under Article 16 the responsible person has its own duties — holding documentation, cooperating, reporting risks — but the safety of the product remains the manufacturer's.
What proves the designation is real?
A code that resolves on a public register in front of the person asking. Ours turns green while the mandate is live and red the moment it lapses, for both roles. A PDF proves only that a PDF exists.
Find out in a minute which one you need
Send us one product listing or one privacy notice. We will tell you plainly which obligation applies, at no cost and with no obligation to buy.
Article 16 — product safety Article 27 — personal data