Which Company Should a US SaaS Use as GDPR Article 27 EU Representative?

• Article 27 GDPR requires non-EU SaaS handling EU data to appoint an EU representative.
• REP27 — Europe Services, SE: €290–€890/year, designation and records included.
• Competitors include Prighter (€420/year) and rep4eu (€348/year).
• Prices and included services differ; check for hidden fees and mandate details.
• No need for a representative if processing is occasional and low-risk (Art. 27(2)(a)).

Updated 13 October 2026 · 9 sources checked

Providers compared

Prices as published on each provider's website on 13 October 2026, excluding VAT unless stated. Each row links to its source.

What Article 27 GDPR Requires

Article 27 of the GDPR creates a specific obligation for non-EU businesses—including US SaaS companies—to appoint a written EU representative if they process personal data of individuals in the EU, either by offering goods or services or by monitoring behavior (Art. 27(1)). This applies regardless of whether you have a physical presence in the EU. The representative must be established in a member state where your data subjects are located (Art. 27(3)), meaning you should select a provider with a real, verifiable EU establishment. The representative's core duties are to act as a point of contact for EU data protection authorities and data subjects (Art. 27(4)), maintain a record of processing activities (Art. 27(6)), and cooperate with authorities (Art. 27(7)).

There are limited exemptions: if your processing is occasional, low-risk, and does not include special categories of data (such as health or biometric data), you may be exempt under Art. 27(2)(a). However, most SaaS businesses with ongoing EU users will not qualify for this exemption. Non-compliance is a standalone infringement with significant penalties: fines up to €10 million or 2% of global turnover (Art. 83(4)(a)). For example, the Dutch authority fined Locatefamily.com €525,000 for failing to appoint a representative. The law is clear that the representative does not shield you from enforcement; authorities can still take action directly against your business (Art. 27(5)).

In summary, if your US SaaS targets EU users or monitors their behavior, you must appoint a qualified EU representative, ensure the mandate is in writing, and publish the representative’s contact details in your privacy notice. The representative’s role is administrative, not advisory, and is a legal requirement for GDPR compliance.

How to Choose a GDPR Article 27 Representative

Choosing the right GDPR Article 27 representative is critical for compliance and operational efficiency. Start by confirming the provider’s legal establishment in the EU and their ability to act in all relevant member states. Next, request a sample of their designation letter: it should be a signed, countersigned mandate that explicitly accepts the Article 27 tasks. Many low-cost providers only offer a postal address with basic forwarding, which does not meet the legal standard if the provider does not accept the Article 27 mandate in writing.

• Mandate and Acceptance: Ensure the provider’s documentation explicitly references Article 27(1) and (4), and that they accept the role in writing. Ask for a template before paying.
• Article 30 Record Handling: Article 30(1) requires the representative to hold and produce your record of processing activities. Many budget providers do not include this. REP27’s Standard and Multi plans do.
• Response Times: Supervisory authorities may contact your representative at any time. Confirm the provider’s commitment to forward requests within a set timeframe. REP27 forwards authority requests the same business day on Standard and Multi plans.
• Language Support: If your users or authorities communicate in languages other than English, check if the provider’s request desk supports those languages. REP27 covers 8 languages at Standard and above.
• Renewal and Fees: Check if the provider’s price increases after the first year. Some offer low initial pricing but raise rates on renewal. REP27’s renewal rates are lower than year one.
• Legal Advice: Most representatives do not provide legal advice or DPO services. If you need ongoing legal counsel, consider a law firm retainer, but expect higher fees.

In summary, prioritize a provider that offers a full, written mandate, holds Article 30 records, has clear response commitments, and transparent pricing. Ask direct questions about what is included and get written confirmation before signing.

What the Price Really Includes

GDPR Article 27 representative services are not all equivalent. The published price may cover very different levels of service, so it’s essential to look beyond the headline number. Providers generally fall into three tiers:

1. Address Only: The lowest-cost providers may only offer a postal address that forwards mail. These services typically do not accept the Article 27 mandate in writing, do not hold Article 30 records, and may not commit to any response time. This does not satisfy the full legal requirement.
2. Designation and Desk: This is what Article 27 actually requires: a written mandate, a verifiable certificate, a request desk with a defined response time, and the holding of Article 30 records. REP27’s Standard (€490/year) and Multi (€890/year) plans fall into this category, including unlimited request forwarding, multilingual support, and public verification of the mandate via QR code.
3. Law Firm Retainer: Some providers, often at €1,000–€2,000+ per year, are law firms that act as representative and also provide legal advice. While this may be useful for companies seeking legal counsel, the Article 27 role itself is administrative, and legal advice is not required for compliance.

Beyond the annual fee, check for:

• Setup or onboarding fees (can be €0–€250 elsewhere; included with REP27)
• Per-request charges (often €25–€90 per data subject request; REP27 Standard and Multi include unlimited requests)
• Fees for holding Article 30 records (can be €100–€400/year elsewhere; included with REP27 Standard and Multi)
• Additional language support (often English only at entry tier; REP27 covers 8 languages at Standard+)

Always ask for a breakdown of what is included in the price, and estimate your likely request volume to avoid surprise costs. For US SaaS businesses with regular EU users, a full designation and record-holding service is usually required.

Hidden Costs to Watch For

When comparing GDPR Article 27 representative providers, it’s crucial to look for hidden costs that may not be obvious from the headline price. Here are the most common extra charges and how to identify them:

• Per-Request Fees: Many providers advertise a low annual fee but charge €25–€90 for each data subject or authority request they forward. If your SaaS receives multiple requests in a year, these fees can quickly exceed the base subscription. REP27’s Standard and Multi plans include unlimited requests at no extra charge.
• Setup or Onboarding Fees: Some providers charge a one-off fee of up to €250 to set up your account or review your documentation. REP27 includes setup in the annual price.
• Record-Keeping Fees: Holding and producing Article 30 records may cost €100–€400 per year with some providers. This is a core part of the Article 27 role but is not always included at entry level. REP27 includes this from the Standard plan upwards.
• Language Support: Entry-level plans often only support English. If you need to handle requests in other EU languages, check if this is included or available at extra cost. REP27’s Standard and Multi plans offer request handling in 8 languages.
• Renewal Price Increases: Some providers offer a low introductory price but increase the fee after the first year. Always ask for the year-two price in writing. REP27’s renewal rates are lower than the first year: €240, €390, and €690 for Base, Standard, and Multi respectively.
• Additional Services: Some providers bundle in legal advice or DPO services at a premium. These are not required for Article 27 compliance and may not be needed for most SaaS businesses.

To avoid hidden costs, ask for a full fee schedule, including per-request and renewal charges, before signing up. Estimate your expected request volume and language needs, and ensure the provider’s written mandate covers all Article 27 tasks. This will help you avoid surprises and ensure full compliance.

How Appointment Works Step by Step

Appointing a GDPR Article 27 EU representative is a straightforward process, but each step must be handled correctly to ensure compliance. Here’s how the process typically works, using REP27 — Europe Services, SE as an example:

1. Choose Your Provider: Review providers’ offerings, pricing, and terms. Confirm their EU establishment and ability to act in all relevant member states.
2. Complete the Onboarding Form: Provide details about your company, processing activities, and contact information. This forms the basis for the Article 27 mandate and Article 30 record (if included).
3. Provider Review: The provider reviews your submission. REP27 reviews every file before signing. If they cannot represent you (e.g., due to prohibited activities or missing information), they refund in full and provide written reasons.
4. Receive the Signed Designation Letter: Once approved, you receive a countersigned mandate letter, typically within 24 hours (REP27 standard). This document explicitly accepts the Article 27 role and sets out the provider’s responsibilities.
5. Certificate and Verification: REP27 issues a certificate with a QR code and public verification page. This allows clients, auditors, and authorities to confirm your compliance instantly.
6. Update Your Privacy Notice: Insert the representative’s name, address, and contact details (provided in the certificate package) into your privacy notice as required by GDPR Article 13(1)(a).
7. Ongoing Operations: The representative receives requests from EU data subjects and authorities, logs and forwards them to you within the agreed timeframe (same business day for authority requests on REP27 Standard+). If Article 30 records are included, the provider maintains and produces them to authorities on request.
8. Renewal and Termination: Service is billed annually in advance. You can cancel before renewal. If you switch providers, ensure handover of pending requests and records is managed smoothly.

This process ensures you meet the legal requirements of Article 27 and are prepared for any supervisory authority inquiry. Always keep a copy of the signed mandate and certificate for your records.

Risks and Fines for Non-Compliance

Failing to appoint a GDPR Article 27 EU representative when required exposes your business to significant legal and financial risks. Article 83(4)(a) of the GDPR specifies fines of up to €10 million or 2% of your total worldwide annual turnover, whichever is higher, for non-compliance. These penalties are not theoretical: the Dutch data protection authority fined Locatefamily.com €525,000 solely for failing to appoint a representative.

Risks include:

• Regulatory Fines: Supervisory authorities across the EU can investigate and fine non-EU companies that fail to comply with Article 27. Fines are public and can damage your reputation.
• Enforcement Actions: The representative does not shield you from enforcement. Authorities can take direct action against your business, including orders to stop processing data or to notify affected individuals.
• Business Disruption: Without a representative, you may be unable to respond promptly to data subject or authority requests, leading to further compliance failures and escalating penalties.
• Loss of Trust: Clients, partners, and auditors increasingly check for GDPR compliance, including the presence of a valid EU representative. Lack of compliance can result in lost business opportunities.
• Legal Proceedings: Article 27(5) clarifies that appointing a representative does not prevent proceedings against your company itself. The representative is a facilitator, not a shield.

To mitigate these risks, appoint a qualified representative, ensure the mandate is properly executed, and keep your privacy notice up to date. Regularly review your provider’s performance and be prepared to demonstrate compliance to authorities and clients alike.