Article 27 GDPR · Article 27 UK GDPR · combined
Since Brexit the same company can need two separate representatives: one established in the Union under Article 27 GDPR, one established in the United Kingdom under the UK GDPR. They are different statutes, different regulators and different designations — a single provider cannot merge them into one piece of paper. What a provider can do is issue both on the same day, against one invoice, expiring on the same date. This page is the arithmetic.
€390 combined Base€590 Standard€990 MultiTwo certificatesOne renewal date
Two providers charge two subscriptions. That is the whole comparison, and it is worth seeing as a picture before reading the feature lists.
| Plan | Union only | United Kingdom only | Both |
|---|---|---|---|
| Base | €290 | €290 | €390 |
| Standard | €490 | €490 | €590 |
| Multi | €890 | €890 | €990 |
| Renewal, Base | €240 | €240 | €320 |
Two designations means two of everything that matters, issued in one pass rather than two onboardings.
Signed by Europe Services, SE, Na Čečeličce 425/4, Praha 5, IČO 03571785, active since 2018 and covering data subjects in all 27 Member States.
Signed by REP27 LTD, company number 17385889, Unit 82a James Carter Road, Mildenhall, Suffolk IP28 7DE.
The UK certificate carries no Czech data and the EU certificate carries no British data. Each stands on its own in front of its own regulator.
A single invoice and a single expiry date, so a designation never lapses because two suppliers renewed in different months.
A US, Indian, Chinese or Hong Kong company selling to consumers in both territories. This is the standard case and it is not optional in either.
A British company selling into the Union. It is established in the UK already, so it needs an EU representative and no UK one.
An EU-established company selling to British consumers, in the mirror image of the case above.
A company with a genuine establishment in both territories, carrying out real activity through stable arrangements rather than a mailbox.
The invoice is only the visible part. The rest shows up in the weeks around each renewal, and it is the reason companies consolidate after the first year rather than the third.
The same corporate documents, signatories and processing description assembled twice, for two suppliers with different forms.
The most common cause of a lapsed designation is not refusal to pay: it is an invoice arriving in a month nobody was watching.
Each provider gives its own wording. Two edits a year to the same paragraph is where inconsistencies appear.
A client checking your compliance has to be sent to two portals, which is exactly the moment procurement starts asking questions.
A designation is a continuing relationship, so the renewal price matters more than the first invoice. Ours is lower than the entry price rather than higher, and moving an existing designation from another provider is priced as a switch rather than as a new appointment.
| Situation | Base | Standard | Multi |
|---|---|---|---|
| First year, one territory | €290 | €490 | €890 |
| First year, both territories | €390 | €590 | €990 |
| Renewal, one territory | €240 | €390 | €690 |
| Renewal, both territories | €320 | €470 | €790 |
| Coming from another provider | €240 | €390 | €690 |
A representative is a defined statutory role, and the fastest way to be disappointed by one is to expect it to be a compliance department. Here is the line we draw before you pay rather than after.
The designation itself, the certificate, the privacy notice wording, the record of processing activities, and a request desk that receives and forwards everything addressed to the representative.
Writing your privacy policy, running a data protection impact assessment, negotiating your processor contracts or acting as your DPO. Those are advisory services and we do not pretend the designation covers them.
Taking on your liability. Article 27(5) prevents it, in the Union and in the United Kingdom alike, and any provider implying otherwise is describing something the law does not allow.
The Article 16 GPSR responsible person, for companies shipping physical consumer goods, which is a different regulation and a different designation again.
Company details, the territories you need, and a short description of what you process and for whom. Ten minutes, not a questionnaire.
One naming Europe Services, SE for the Union, one naming REP27 LTD for the United Kingdom, each drafted under its own law.
Both are countersigned together. Approving one of a pair approves the other, by design, so they cannot drift apart.
Each carries a verification code on a public page, so a client or an authority can confirm it without contacting you.
You paste the two supplied paragraphs into your privacy notice. That publication is what makes the designation useful to a data subject.
From completed form to two published contact points, the whole exercise is a working day. The part that takes longer is deciding, which is what this page is for.
Because since Brexit the EU GDPR and the UK GDPR are separate instruments. Falling under both means designating in both territories; there is no single appointment that satisfies the two.
No, and any provider claiming otherwise is describing a group structure rather than one entity. Europe Services, SE signs for the Union; REP27 LTD signs for the United Kingdom. They are issued as a pair.
Two full subscriptions, commonly around €780 a year at entry level, with two contracts and two renewal dates. The combined plan starts at €390.
The UK GDPR applies there, so the UK designation is the one you need. Product safety in Northern Ireland follows a different arrangement and is a separate question.
Buy the UK designation alone. If you later move the EU one across, the switch price applies rather than the full one.
Approving one designation of a pair approves the other, so both certificates issue together and cannot drift apart over time.
It is the contact point for the ICO and for UK data subjects, in the same way the EU representative is for supervisory authorities in the Union.
Both, each under its own heading: Europe Services, SE for data subjects in the Union and REP27 LTD for data subjects in the United Kingdom. We supply the wording for both.
Yes. The pair renews together on a single invoice, which is the main reason clients consolidate after a year of managing two suppliers.
By law. The UK GDPR carries its own Article 27, and a controller outside the United Kingdom that targets or monitors people there designates a representative established in the UK.
Buy the missing territory now and move the second one at renewal, at the switch price. Nothing is gained by cancelling a paid year early.
Yes. Each carries its own code and its own verification page, and neither page displays data belonging to the other territory.
Yes, that is what the Multi plan covers: the Article 27 representative and the Article 16 responsible person on one onboarding and one renewal date.
Related: how the paired designation works · what Brexit changed
Both designations signed within 24 hours of a completed form, each with its own certificate and verification code, on a single invoice and a single renewal date.
See the combined plans