How to Compare GDPR Representative Prices for EU and UK

• Article 27 GDPR and UK GDPR require separate representatives for EU and UK
• Prices and services vary: always check what is included and hidden costs
• Some providers offer both mandates in a single order
• Watch out for setup fees, request limits, renewals, and excluded services
• Not all companies need the service: verify your situation

Updated 20 October 2026 · 9 sources checked

Providers compared

Prices as published on each provider's website on 20 October 2026, excluding VAT unless stated. Each row links to its source.

Legal Requirements: Article 27 GDPR and UK GDPR

Article 27 GDPR states that any data controller or processor not established in the EU but offering goods or services to people in the EU or monitoring their behavior must appoint a representative in the Union in writing. This rule also applies to the UK via Article 27 UK GDPR. The representative must be a natural or legal person genuinely established in the territory and formally accept the mandate. The designation must be indicated in the privacy notice, including the representative's identity and contact details. Failure to appoint is an autonomous violation, punishable by fines up to €10 million or 2% of global turnover, as per Article 83 GDPR. A concrete example: Locatefamily.com was fined €525,000 by the Dutch authority for failing to appoint a representative.

Since 2021, after Brexit, companies processing data of both EU and UK citizens must appoint two separate representatives, one for each territory, as regulations are now distinct. The existence of an adequacy decision (such as between EU and UK) does not remove this obligation: adequacy concerns data transfers, not legal representation for data subject rights or authority requests.

How to Choose the Right GDPR Representative

Choosing the most suitable GDPR representative depends on several practical and strategic factors. First, check if your company needs representation in both the EU and the UK: many non-EU/UK companies selling or monitoring users in both areas must appoint two separate representatives. Some providers, like REP27, offer both mandates in a single order, simplifying management and reducing costs compared to separate purchases.

Carefully consider:

• Territorial coverage: is the provider genuinely established in the EU and/or UK?
• Published price: consider both annual cost and any setup, renewal, or extra request fees.
• Included services: check if request management, multilingual privacy notices, Art. 30 record keeping, and verifiable certificates are included.
• Ease of onboarding and renewal: a single process for both territories reduces errors and missed deadlines.
• Language support and request desk: essential for companies operating in multiple European countries.

The best choice depends on your business model, presence in multiple markets, and the need to simplify compliance across jurisdictions.

What the Price Really Includes: Watch the Details

Published prices from providers can vary greatly not only in amount but especially in what they actually include. Some providers charge high setup fees (up to €2,000), others limit the number of requests forwarded without extra costs (Janus Compliance: 50/year, then £8 each). REP27 offers, with every paid plan, a free Swiss assessment under the new federal law (nFADP), with a signed exemption declaration if a Swiss representative is not required.

It is essential to verify:

• Number of requests included in the plan
• Real multilingual support (e.g., privacy wording in 8 languages with REP27)
• Management of Art. 30 records: some providers only hold them in advanced plans
• Publicly verifiable certificates and badges
• Renewal costs lower or higher than the first year

A practical example: buying separate EU and UK representatives can double the cost (e.g., REP27: €290 + €290 = €580), while the combined plan starts at €390. GDPR Gateway applies a setup fee up to €2,000, which must be considered in the first year's calculation.

Summary table:

Hidden Costs and Conditions: What Providers Often Don’t Say

Many providers do not highlight certain costs and conditions that can significantly impact expenses and compliance management. For example, GDPR Gateway charges a setup fee up to €2,000, added to the annual fee. Janus Compliance limits requests to 50/year, with an extra £8 for each additional request. REP27 clearly states some activities are not accepted (sensitive data, minors, high-risk activities, data brokerage, gambling, crypto, weapons, consumer medicines, activities requiring licenses not held by the client).

Other aspects to consider:

• Automatic renewals: most providers auto-renew services, often with a 30-day notice period (REP27) or unspecified.
• Limited liability: the representative does not replace the DPO, does not respond substantively to requests, but forwards them to the client.
• Record management: not all providers hold Art. 30 records, or only in advanced plans.
• Excluded services: legal advice, audits, handling complex requests or special data categories are often excluded.

Before choosing, always request a written list of what is included, limits, exclusions, and check renewal and termination policies.

How Appointment Works: Step by Step

1. Check your situation: Are you established outside the EU/UK and offering goods/services or monitoring users in these territories? If yes, appointment is mandatory.
2. Choose the provider: Review the price and service table. If you need both mandates, verify the provider offers them together.
3. Fill out onboarding form: Some providers (e.g., REP27) offer a single form for both territories, reducing errors and time.
4. Review and sign: The provider verifies data, drafts mandates, and signs digitally (REP27 uses eIDAS electronic signature).
5. Receive certificates: You get two distinct certificates, with QR codes and public verification pages.
6. Update privacy notice: Insert the two lines of text provided by the provider, one for EU and one for UK, in required languages.
7. Request management: The provider forwards authority and data subject requests within set times (e.g., REP27: within 2 business days, priority in Standard/Multi).
8. Renewal: A single expiration date and invoice simplify management. Watch the notice period for cancellation.

Practical checklist:

1. Identify target countries and verify representation need
2. Compare prices and services via table
3. Check limits, hidden costs, and excluded services
4. Prepare company documents required by provider
5. Complete appointment form
6. Receive and archive certificates
7. Update privacy notice
8. Monitor requests forwarded by representative

Risks and Penalties: What Happens If You Don’t Appoint a Representative

Failing to appoint a representative when required exposes the company to real risks and heavy penalties. Article 83 GDPR provides fines up to €10 million or 2% of global turnover, whichever is higher. Failure to appoint is an autonomous violation: a data breach is not necessary for sanctions. A real case: Locatefamily.com was fined €525,000 by the Dutch authority just for not appointing a representative.

Besides fines, there can be:

• Orders to suspend data processing
• Obligation to appoint immediately within tight deadlines
• Reputational damage: sanction publication is common
• Loss of customers and business partners requiring compliance

Authorities can act on user or competitor reports. Formal compliance is essential not only to avoid sanctions but also to maintain market trust.

Practical Scenarios: Which Obligation and Solution to Choose

• US SaaS with clients in EU and UK: Must appoint two separate representatives, one for EU and one for UK. The most efficient solution is to choose a provider offering both mandates in a single order (e.g., REP27, GDPR Gateway, Prighter). This reduces costs, time, and risks of different deadlines.
• Chinese seller on Amazon EU: If selling to EU consumers, must appoint an EU representative. If also selling in the UK, a UK representative is needed too. Savings possible by choosing a combined plan rather than two separate contracts.
• UK online shop selling in France: Must appoint only the EU representative, since the company is already established in the UK. No UK representative needed if not offering goods/services or monitoring UK users.

Decision matrix:

These scenarios help quickly identify the obligation and most efficient solution.

What Providers Usually Don’t Say: Exclusions, Limits, and Liability

Many providers do not highlight important conditions:

• Activity exclusions: REP27 does not accept clients processing sensitive data (Art. 9), criminal data (Art. 10), services aimed at under-16s, large-scale monitoring or profiling, data brokerage, gambling, crypto, weapons, consumer medicines, or activities requiring licenses not held by the client.
• Liability limits: The representative does not provide legal advice, is not a DPO, does not respond substantively to requests but forwards them to the client. Substantive compliance remains the company’s responsibility.
• Notice period for termination: REP27 requires written cancellation at least 30 days before expiry. Other providers do not always specify clear terms.
• Costs for extra requests: Janus Compliance charges £8 per request beyond 50 included. Other providers do not declare limits or extra fees.
• Art. 30 management: Not all providers hold records; some only in advanced plans.

Before signing, always ask for a complete list of exclusions, limits, and renewal/termination conditions.