Can I Get Both EU and UK GDPR Representation from One Provider?

• Separate EU and UK GDPR representatives are legally required for non-EU/UK companies (Art. 27 EU & UK GDPR).
• REP27 issues both designations in one order, with two certificates and privacy notice lines.
• Combined pricing from €390/year (REP27), with renewal discounts.
• Other providers include Privacy Core Services, Representa, Euverify, and The DPO Centre.
• Who needs both: companies outside EU/UK selling or monitoring in both territories.

Updated 17 October 2026 · 9 sources checked

Providers compared

Prices as published on each provider's website on 17 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article 27 EU & UK GDPR

Article 27 of the EU GDPR (source) and UK GDPR (source) impose a clear legal obligation: if your company is established outside the EU and/or UK but offers goods or services to, or monitors the behavior of, individuals in those territories, you must appoint a representative in each. These representatives act as the official point of contact for data subjects and supervisory authorities. The requirements are distinct for each regime, especially since Brexit. The EU representative must be established in an EU member state where affected data subjects are located. The UK representative must be established in the UK. Failing to appoint a representative is a standalone infringement, subject to fines up to €10 million or 2% of annual global turnover (EU GDPR Art. 83). The Dutch authority fined Locatefamily.com €525,000 for failing to appoint an EU representative. Adequacy decisions (allowing data transfers) do not remove this obligation. A single representative cannot cover both territories unless they are legally established in both. This is why providers like REP27 operate with separate legal entities in the EU and UK, issuing two designations, two certificates, and two lines of privacy notice wording. This strict separation is essential: a privacy notice naming only one entity is non-compliant for the other territory. Providers must ensure that each designation meets the legal requirements of its respective regime, and that your documentation is correct for both regulators.

How to Choose a Combined EU & UK GDPR Representative

Choosing a provider for combined EU and UK GDPR representation is a strategic compliance decision. The first step is to confirm that the provider is legally established in both the EU and the UK. This is not just a formality: only entities with a real establishment in the relevant territory can act as your Article 27 representative. REP27, for example, operates Europe Services, SE in Prague for the EU and REP27 LTD in Suffolk for the UK, issuing both designations in one process. Privacy Core Services and Representa also claim establishments in both regions. Euverify and The DPO Centre are UK-based but offer EU representation, so check if their EU establishment meets your needs.
Next, examine the onboarding process. A good provider will offer a single, coordinated onboarding for both territories, reducing administrative duplication. REP27 uses one form for both, ensuring consistent answers and eliminating the risk of contradictory documentation. Privacy Core Services advertises coordinated onboarding and reporting.
Consider what is included in the price: do you receive two signed designations, two certificates, and privacy notice wording for both regimes? Is there a request desk for data subjects and authorities? Are records of processing (Article 30) held and produced on request?
Finally, review the renewal process. Synchronizing renewal dates for both territories avoids the risk of accidental lapses. REP27 offers one invoice and one renewal date, with discounted rates from the second year.
Included / Not Included / Extra Fees Table:

What the Price Really Includes: Features and Value

Understanding what you actually receive for the published price is crucial. Combined representation should deliver two legally valid designations—one for the EU, one for the UK—each signed by a local entity, plus two certificates and privacy notice wording for both regimes. REP27’s Base plan (€390/year) includes both designations, two certificates (with QR code and public verification), privacy notice wording in multiple languages, and a request desk for both territories. Standard and Multi plans add unlimited requests, records of processing held and produced on request, and multilingual support. Renewal prices are discounted from year two (€320/year for Base). Euverify offers a monthly plan (£41/month), which includes digital compliance tools like a request tracker and verification badge, but does not specify if onboarding is unified or if there are extra fees for requests. Privacy Core Services, Representa, and The DPO Centre require a quote for pricing and do not publish details about included features or possible extra fees.
Key points to check:

• Are both designations legally valid and signed by entities established in the EU and UK?
• Is privacy notice wording provided for both regimes?
• Are request forwarding and records maintenance included, and are there limits or per-request fees?
• Is there a single renewal date and invoice?
• Are there onboarding or document review fees?

REP27 is explicit about what is not included: legal advice, DPO services, and compliance audits are not part of the package. This is typical for most providers, who act only as the statutory representative, not as compliance consultants. Always clarify what is and is not included before appointing a provider.

Hidden Costs and What Providers Usually Do Not Say

When comparing providers, it is important to look beyond the headline price. Hidden costs and exclusions can significantly affect the total cost of compliance and your operational risk.
Common hidden costs and exclusions:

• Per-request fees: Some providers may charge extra for handling or forwarding data subject or authority requests. REP27 includes up to 10 forwarded requests per year in the Base plan; unlimited requests are included in higher tiers. For other providers, this information is not always published—ask directly.
• Onboarding/document review fees: Some providers may charge for initial onboarding or for reviewing your documentation. REP27 does not state any such fees.
• Renewal synchronization: If you use two separate providers for EU and UK, renewal dates can fall in different months, increasing the risk of accidental lapses. REP27 synchronizes renewals for both territories.
• Privacy notice errors: Many companies incorrectly name only one representative for both regimes, which can trigger compliance issues. REP27 provides two lines of privacy notice wording to avoid this.
• Exclusions: Most providers, including REP27, do not offer legal advice, DPO services, or compliance audits as part of the representative role. They forward requests but do not answer on the merits.
• Notice periods and liability: Providers may have specific notice periods for termination or limits on liability—always review the terms before signing.

Always request a full list of included services, limits, and any potential extra charges before appointing a representative. This will help you avoid unexpected costs and ensure you remain compliant in both territories.

How Appointment Works: Step by Step Guidance

Appointing a combined EU and UK GDPR representative is a process that should be straightforward if you choose the right provider. Here’s how it typically works, using REP27 as an example:

1. Eligibility check: Confirm your company is established outside both the EU and UK and that you offer goods/services to or monitor individuals in both territories.
2. Provider selection: Choose a provider with legal establishments in both the EU and UK.
3. Onboarding: Complete a single form covering both territories. REP27’s process takes about five minutes and asks for your company and processing details once, not twice.
4. Document review: A staff member reviews your file. Both mandates are drafted from the same answers, ensuring consistency and eliminating contradictions.
5. Designation and countersignature: The EU designation is signed by Europe Services, SE (Prague); the UK designation by REP27 LTD (Suffolk). Each is a separate legal document.
6. Certificates and privacy notice wording: You receive two certificates (one for each regime) and two lines of privacy notice wording. Each certificate is verifiable online and carries a unique code (R27- for EU, UK27- for UK).
7. Implementation: Update your privacy notice and internal records with the new information.
8. Renewal: Both designations renew on the same date, with discounted rates from the second year. You receive a single invoice for both.

This process ensures legal compliance, reduces administrative burden, and minimizes the risk of errors. Other providers may have similar steps but always confirm the details, especially regarding onboarding, documentation, and renewal synchronization.

Decision Matrix: Do You Need Both, One, or Neither?

Determining whether you need an EU representative, a UK representative, both, or neither depends on your company’s location and activities. Use the matrix below to clarify your obligations:

Key points:

• Having a real, stable establishment (not just a mailbox) in a territory removes the need for a representative there.
• Marketplace sellers (Amazon, Etsy, eBay) outside the EU/UK must appoint representatives if they sell to customers in those territories.
• B2B and B2C companies are both covered if they target or monitor individuals in the EU/UK.
• Companies with no activity in the EU or UK do not need a representative.

Checklist: Steps to Appoint a Combined Representative Today

1. Assess your business activities: Do you offer goods/services to or monitor individuals in the EU and UK?
2. Confirm you are not established in the EU or UK (if you are, you do not need a representative for that territory).
3. Research providers with legal establishments in both territories (see comparison table above).
4. Prepare your company and processing details (privacy notice, data flows, contact information).
5. Complete a single onboarding form for both regimes (REP27 and some others offer this).
6. Review and approve the draft designations and privacy notice wording provided by the representative.
7. Receive two signed certificates and two lines of privacy notice wording.
8. Update your website and documentation with the new information.
9. Set reminders for synchronized renewals to avoid lapses.
10. Monitor for any changes in your business activities that might affect your obligations (e.g., expansion to new markets).

This checklist ensures you remain compliant with both EU and UK GDPR Article 27 requirements with minimal administrative effort.

Risks, Fines, and Real-World Scenarios

Non-compliance with Article 27 can lead to significant financial and reputational risks. The most direct risk is regulatory fines: under EU GDPR Article 83, fines can reach up to €10 million or 2% of annual global turnover, whichever is higher. The Dutch authority fined Locatefamily.com €525,000 for failing to appoint an EU representative. The UK ICO has similar enforcement powers under the UK GDPR.
Other risks include:

• Privacy notice errors: Naming only one representative for both regimes can result in non-compliance and regulatory scrutiny.
• Renewal lapses: Using two providers with unsynchronized renewal dates can lead to accidental lapses, leaving you temporarily non-compliant.
• Administrative burden: Managing two separate providers increases the risk of inconsistent documentation and missed obligations.

• Scenario 1: US SaaS company selling to both EU and UK — Needs both EU and UK representatives. REP27 offers both in one order, with synchronized onboarding and renewal.
• Scenario 2: Chinese Amazon seller shipping only to EU — Needs only an EU representative, as there is no UK activity. REP27 and others offer EU-only plans.
• Scenario 3: UK online shop selling to EU — Needs only an EU representative, as the business is already established in the UK. The reverse applies for EU companies selling to the UK.

Choosing a combined provider reduces these risks by ensuring legal compliance, administrative simplicity, and correct documentation for both regimes.