REP27 · Changing representative
Article 27 GDPR · Changing provider
Switching is straightforward and rarely goes wrong for the reason people expect. The paperwork is easy; the risk is the day in between. A designation that ends before the next one begins leaves a window in which Article 27(1) was not satisfied, and that window is dated, documented and easy for anyone to establish afterwards.
With an effective date earlier than the end date of the old one. A day of overlap costs nothing; a day of gap costs the whole point of the exercise.
Articles 13(1)(a) and 14(1)(a) wording, in every language your site publishes. An outdated notice sends people to an entity that no longer acts for you.
The outgoing representative holds it under Article 30(1) and has no reason to keep it afterwards. Ask in writing and keep the reply.
Everything handled, with references and dates, plus anything still open. This is the item most often forgotten and the hardest to reconstruct later.
Keep the revocation letter. It is the document that dates the end of the old cover, which matters if the period is ever examined.
| Reason | What to check in the new provider |
|---|---|
| Per-request fees became unpredictable | Whether requests are included, and up to what volume |
| Requests were forwarded slowly, or not at all | A stated response time, and same-day for authorities |
| Nobody answered in the customer's language | How many languages the desk actually staffs |
| The provider held no Article 30 record | That the new one holds and produces it |
| Renewal price jumped after year one | The year-two figure, in writing, before signing |
| Buyers could not verify the designation | A certificate with a public verification code |
The failures we see are never dramatic. They surface half a year after the switch, when something arrives that needs a history nobody kept.
An authority writes about a complaint made to the previous representative in March. You have no reference number, no copy of what was sent and no record of when it was forwarded, because the outgoing provider was never asked for the log and deleted it when the mandate ended. The complaint itself may have been trivial; the inability to show what happened to it is not.
Or the Article 30 record turns out never to have been held at all. The old provider was a forwarding address that took an annual fee, and the question of who kept the record was never raised. Discovering that during an authority request is an uncomfortable way to learn what you were buying.
Both are avoided by asking two questions before signing anywhere: who holds the record, and what happens to the log when the mandate ends. Providers that hold neither will say so if pressed, and that answer is itself the information you needed.
Yes. A designation is a mandate, revocable at will, and there is no minimum term imposed by the GDPR. The only requirement is that a valid designation exists at all times while you are within Article 3(2).
A gap. If the old mandate ends on the 1st and the new one starts on the 5th, there were four days during which the designation required by Article 27(1) did not exist. Sign the new one first and revoke afterwards.
The Article 30 record is kept on your behalf, so yes — ask for it in writing, along with the log of requests handled and anything still open. A provider that refuses is telling you something about how it held them.
The same day the new designation takes effect. Until it does, your public notice points data subjects at an entity that no longer acts for you, which is worse than naming nobody.
They should not. Open requests transfer with the log. This is the part that most often goes wrong, because the outgoing provider has no incentive to chase it.
There is no general notification duty for changing representative. The obligation is to keep the published information accurate, which the notice update does.
We do not charge one, and we start the new designation before your existing cover ends so there is no gap. Whether your outgoing provider refunds the unused period is a matter for their terms.
We start the new designation before your current cover ends, and give you the notice wording to publish the same day.
Move to REP27