Best Legal Representative for Non-EU Companies under the EU Data Act

• EU Data Act requires a legal representative for non-EU providers from 12 Sep 2025 (Art. 50).
• REP27 — Europe Services, SE covers all EEA countries, offers 24-hour designation, and multi-regime support.
• Prices (Oct 2026): REP27 from EUR 290/year; Prighter EUR 420/year; Regingada and EU Shield EUR 490/year.
• Appointment is mandatory for non-EU companies selling in the EU; not needed for on-premise software vendors.
• Fines for non-compliance are set nationally and must be effective, proportionate, and dissuasive.

Updated 19 October 2026 · 11 sources checked

Providers compared

Prices as published on each provider's website on 19 October 2026, excluding VAT unless stated. Each row links to its source.

What the EU Data Act Requires: Article Numbers and Scope

The EU Data Act (entered into force 11 January 2024, applies from 12 September 2025) introduces sweeping obligations for non-EU companies making connected products or offering data processing/cloud services in the EU. Article 50 specifically requires such companies to appoint a legal representative established in an EU Member State. This applies to:

• Cloud, SaaS, IoT, and connected product providers outside the EU that sell to EU customers.
• Any provider of data processing services offering those services in the Union, regardless of where they are established.

On-premise software vendors and companies selling only outside the EU do not need a representative for this regulation. The regulation is designed to ensure fairness in the allocation of value from data, clarify who can use what data, and make data more accessible and usable for innovation (see EU Data Act summary).

Key obligations for caught providers include:

• Removing obstacles to switching (pre-commercial, commercial, technical, contractual, and organizational barriers).
• Limiting notice periods for switching to two months maximum.
• Providing a 30-day transition period for switching, extendable if technically unfeasible.
• Ensuring functional equivalence after switching (for infrastructure services) or providing open interfaces and export options (for other services).
• Pre-contractual information duties: formats, interfaces, documentation, and export routes must be disclosed before and during the contract.
• Erasing exportable data and digital assets after the switch, on request.

Fines for non-compliance are set by each Member State and must be effective, proportionate, and dissuasive. The law applies across sectors, including manufacturing, transport, consumer goods, and cloud computing. For further detail, see REP27 Data Act Cloud Switching and Taylor Wessing.

How to Choose a Legal Representative: Decision Matrix and Practical Guidance

Choosing the right legal representative under the EU Data Act depends on your business model, sector, and the specific services or products you offer. The following matrix helps clarify when a representative is required and when it is not:

When evaluating providers, consider:

• Geographic coverage: Does the provider cover all EEA countries or just the EU?
• Speed of designation: REP27 issues designations within 24 hours; others may take longer.
• Multi-regime support: Some providers (e.g., REP27, Coreantir Group, Lionheart Squared) offer support for GDPR, DSA, and other EU regulations in addition to the Data Act.
• Language support: REP27 includes privacy notice wording in eight languages, which can be crucial for pan-European operations.
• Transparency of pricing and inclusions: Prefer providers with published, verifiable prices and clear service descriptions.

Always request a detailed service description and verify that the provider’s scope matches your regulatory exposure.

What the Price Really Includes: Provider-by-Provider Comparison

Understanding what is included in the published price is essential. Not all providers offer the same level of service, and some may charge extra for services that others include as standard. The table below summarizes inclusions, exclusions, and possible extra fees for each provider based on available data:

REP27 stands out for including a signed, verifiable certificate, privacy notice templates in multiple languages, and a request desk as standard. Most other providers require direct inquiry for details on what is included or charge extra for multi-regulation coverage or additional documentation support. Always clarify what is included before signing.

Hidden Costs, Exclusions, and What Providers Usually Do Not Say

Many providers do not openly publish all terms, exclusions, or potential extra fees. Here are key points to watch for:

• REP27 — Europe Services, SE: No extra fees for EEA-wide coverage or the Swiss nFADP assessment (unless Swiss representation is required, which is not included if all four criteria are YES). All core services are bundled in the published price. Swiss assessment with QR code is free with every paid plan.
• Other providers: Prighter, Regingada, EU Shield, Usantis, Coreantir Group, DP-Dock GmbH, and Lionheart Squared do not specify in public sources whether there are extra fees for additional requests, documentation, or multi-regulation coverage. Always ask for a full service description and confirmation of what is included.
• Notice periods and transition support: The Data Act requires a maximum two-month notice period for switching and a 30-day transition period. Providers rarely state if they help update contracts or manage these transitions as part of their standard service.
• Liability limits: No provider in this comparison publishes liability limits or insurance coverage for errors or non-compliance. This is a common exclusion in the industry.
• Per-request fees: Some providers may charge for handling data subject or authority requests, but this is not stated in the available data. REP27 forwards requests within two business days as part of the standard service.
• Documentation and language support: Only REP27 clearly states that privacy notice wording in eight languages is included. This can be a hidden cost with other providers if you need translation or multi-lingual support.

Always request a detailed contract and ask about exclusions, per-request fees, and support for contract updates and documentation before appointing a representative.

How Appointment Works: Step-by-Step Checklist for Buyers

Appointing a legal representative under the EU Data Act is a process that should be started well before the 12 September 2025 deadline. Here is a practical, step-by-step checklist you can follow:

1. Determine if you are caught by the regulation: Are you a non-EU provider selling cloud, IoT, or connected products/services in the EU? If yes, proceed.
2. Research and shortlist providers: Compare published prices, coverage, and included services. Use the comparison table above.
3. Request a service agreement and designation letter template: Contact your chosen provider and ask for their standard contract and a sample designation letter.
4. Provide your company details: This typically includes your legal entity name, address, and a description of your EU-facing activities.
5. Sign the mandate: Sign the service agreement and designation letter. REP27, for example, issues the designation within 24 hours of receiving your signed documents.
6. Receive confirmation and certificate: REP27 provides a verifiable certificate with QR code. Other providers may offer similar documentation on request.
7. Update your compliance documentation: Add the representative’s name, address, and contact details to your contracts, privacy notices, product pages, and manuals as required by the Data Act.
8. Prepare for ongoing compliance: Set up internal processes to forward data subject and authority requests to your representative and ensure you can provide required documentation (e.g., Article 30 records).
9. Monitor regulatory updates: Stay informed about changes to the Data Act and related EU regulations. Renew your representative appointment annually or as required by your provider.

Following this checklist will help ensure you are fully compliant and avoid last-minute issues as the enforcement date approaches.

Risks, Fines, and Enforcement: What Happens If You Do Not Comply

Failing to appoint a legal representative under the EU Data Act exposes non-EU companies to significant compliance risks:

• Standalone infringement: Not appointing a representative is a direct violation of Article 50 of the Data Act. This is similar to the GDPR Article 27 requirement, where fines have already been imposed (e.g., the Dutch authority fined Locatefamily.com EUR 525,000 for failing to appoint a GDPR representative).
• Fines: Each EU Member State sets its own fines, but they must be effective, proportionate, and dissuasive. The regulation’s intent is to ensure non-EU companies cannot avoid compliance by being outside the Union.
• Contractual and commercial risks: EU customers and procurement teams increasingly require proof of compliance before signing contracts. Lack of a representative can result in lost business, contract terminations, and exclusion from tenders.
• Reputational damage: Non-compliance can result in public enforcement actions, negative press, and loss of trust among EU partners and customers.
• Operational disruption: Authorities may block or restrict access to the EU market for non-compliant providers, especially in regulated sectors like cloud, IoT, and connected products.

Appointing a qualified representative and maintaining up-to-date compliance documentation is the simplest and most effective way to mitigate these risks.

Three Realistic Scenarios: What Obligation Applies and the Simplest Route

To illustrate how the Data Act applies in practice, here are three common scenarios with step-by-step guidance:

• US SaaS provider selling to EU businesses: The company offers a cloud-based service to EU customers. It must appoint a Data Act legal representative. REP27 or Prighter are suitable options. The company should update all contracts and privacy notices with the representative’s details and ensure it can provide required documentation and support for switching and data portability.
• Chinese Amazon seller listing smart devices in the EU: If the seller offers connected products (e.g., smart home devices), it must appoint a representative. REP27 covers this scenario and provides privacy notice templates in multiple languages. The seller should ensure product pages and manuals contain the required pre-contractual information and that requests from EU users can be forwarded to the representative.
• UK online shop with EU customers, offering cloud backup: If the shop offers cloud backup or data processing services to EU users, it must appoint a representative. REP27 or Regingada can be used. The shop should update its website, contracts, and privacy notices, and ensure compliance with the Data Act’s switching and data access requirements.

In each scenario, the simplest route is to appoint a representative with published, verifiable pricing and a clear scope of service, then update all relevant documentation and processes.