Do I Need Both EU and UK GDPR Representatives?

• Separate representatives are required for EU and UK if targeting both.
• Article 27 GDPR (EU) and Article 27 UK GDPR are distinct legal obligations.
• Combined services can reduce admin and cost versus separate providers.
• Fines for non-compliance can reach €10 million or 2% of global turnover.
• Companies established in the EU or UK are exempt for their own territory.

Updated 18 October 2026 · 7 sources checked

Providers compared

Prices as published on each provider's website on 18 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article 27 EU and UK GDPR

Article 27 of the EU GDPR and UK GDPR impose a clear obligation: if your company is not established in the EU or UK but offers goods or services to, or monitors the behavior of, individuals in those territories, you must appoint a representative established in each relevant region. This applies to both controllers and processors. The representative acts as a local point of contact for data subjects and supervisory authorities, and their details must be included in your privacy notice.

After Brexit, the UK GDPR became a separate regime. This means an EU representative cannot act for the UK, and vice versa. Each requires a separate appointment, in writing, to an entity physically established in the relevant jurisdiction. The representative must be able to answer requests from individuals and authorities, and may be required to hold your Article 30 record of processing activities. Failure to appoint a representative is a standalone infringement, with fines up to €10 million or 2% of global turnover (Art. 83 GDPR).

Exemptions exist: companies with a real establishment (not just a mailbox) in the EU or UK do not need a representative for their own territory. For example, a UK company selling to the EU needs an EU representative, but not a UK one. Conversely, an EU company selling to the UK needs only a UK representative. Companies with genuine establishments in both regions are exempt from both requirements for their own territories.

How to Choose a GDPR Representative: Key Factors

Choosing the right GDPR representative is critical for compliance and operational efficiency. Here are the main factors to consider:

• Jurisdictional Coverage: The provider must be legally established in the EU for EU representation and in the UK for UK representation. Combined services (like REP27) can issue both designations in one order, saving time and reducing risk of administrative errors.
• Service Scope: Assess whether the provider offers only the statutory minimum or includes value-added services such as privacy notice wording, multilingual request handling, and Article 30 record-keeping. For example, REP27 includes privacy notice wording in 8 languages and a QR-verifiable certificate, while Janus Compliance sets a correspondence limit and charges extra for additional items.
• Renewal and Administration: Combined providers synchronize renewal dates and documentation, reducing the risk of accidental lapses. Separate providers mean separate onboarding and renewal processes, which increases administrative burden and the chance of missing a renewal.
• Transparency of Fees: Look for clear pricing and disclosure of any extra fees (e.g., per-request charges, onboarding fees, or charges for additional languages or certificates).
• Exclusions and Limitations: Most providers exclude legal advice, DPO services, and compliance audits. Some, like REP27, also exclude special category data, children under 16, and large-scale monitoring or profiling.

Included / Not Included / Extra Fees Table

What the Price Really Includes (and Excludes)

Understanding what you get for your fee is crucial. Providers differ not only in price but in what is included in their annual subscription:

• REP27 — Europe Services, SE: For €390/year (Base), you receive both EU and UK Article 27 designations, two certificates (one for each territory), privacy notice wording in multiple languages, QR code verification, a request desk, and a Swiss assessment (to determine if a Swiss representative is needed). The Base plan includes up to 10 forwarded requests per year; unlimited requests and Article 30 record-keeping are available in higher plans. There are no per-request fees in the Standard or Multi plans. Legal advice, DPO services, and compliance audits are not included.
• Janus Compliance: Charges are per territory: £349/year for UK and €449/year for EU. Each plan includes 50 items of correspondence per year (excluding ICO correspondence); each additional item is £8. Combined EU+UK coverage requires two separate subscriptions, and there is no combined discount. Legal advice and unlimited correspondence are not included.
• Euverify: £490/year for either EU or UK representation (Startup plan), with features such as GDPR representative, ROPA Builder, GDPR Rep Certificate, DSR Unified Inbox, Trust Badge, Audit Trail, and DSR Translation. Combined coverage requires two subscriptions. Details on extra fees are on request.
• Gabsor: $948/year (Essential plan) for both EU and UK representation, including a compliance dashboard, Trust Center, privacy policy snippet, badge, ROPA builder, DSAR management, and audit trail. Details on extra fees or limits are on request.

Always check if the published price covers both regions or just one. Most providers do not include legal advice, DPO services, or compliance audits. Some exclude high-risk processing or services aimed at children. Be sure to review the provider’s exclusions and terms before purchasing.

Hidden Costs and What Providers Usually Do Not Say

While headline prices may look similar, hidden costs and operational risks can add up. Here’s what to watch for:

• Per-request fees: Janus Compliance includes 50 items of correspondence per year, but charges £8 for each additional item. REP27’s Base plan includes up to 10 requests per year, with unlimited requests in higher plans. Some providers do not clearly state their per-request policy, so always confirm before committing.
• Separate onboarding and renewals: Using two providers for EU and UK means double the onboarding paperwork and two different renewal dates. This increases the risk of a lapsed designation, which itself is a breach of Article 27. Combined services (like REP27) synchronize renewals and reduce admin.
• Exclusions: Most providers exclude legal advice, DPO services, and compliance audits. REP27 specifically excludes special category data, children under 16, large-scale monitoring, data brokerage, adult content, gambling, cryptoassets, weapons, and pharmaceuticals. If your business falls into any of these categories, you may not be able to appoint certain providers.
• Notice periods: REP27 requires written notice at least 30 days before expiry to cancel. Always check the cancellation policy to avoid unwanted renewals.
• Liability limits: None of the providers in this comparison publish their liability caps in the available data. Always request and review the provider’s contract for liability and indemnity clauses.

Be aware that some providers may not include privacy notice wording, multilingual support, or QR-coded verification as standard. These omissions can lead to non-compliance or extra work for your team.

How Appointment Works: Step-by-Step Checklist

Appointing a GDPR representative is a process that must be documented and verifiable. Here is a practical, step-by-step checklist to ensure compliance:

1. Assess your obligations: Determine if your business offers goods/services to or monitors individuals in the EU, UK, or both.
2. Choose a provider: Select a provider established in the required territory (or both for combined service). Review their exclusions and included features.
3. Complete onboarding: Fill out the provider’s onboarding form. Combined services like REP27 use a single form for both territories, saving time and reducing the risk of inconsistent answers.
4. Provider review: The provider reviews your submission and drafts the designation(s). For combined services, both mandates are drafted from the same answers, ensuring consistency.
5. Signatures: The provider’s EU entity signs the EU designation; the UK entity signs the UK designation. You receive two separate, signed documents.
6. Receive certificates and wording: You receive two certificates (one for each territory), each with a unique verification code, and privacy notice wording for both. REP27 provides QR codes and public verification pages.
7. Update your privacy notice: Insert both lines of wording into your privacy notice. Using only one line for both is incorrect and may be flagged by regulators.
8. Maintain compliance: Ensure your representative is able to respond to requests from data subjects and authorities. Renew annually, and keep records of all correspondence.
9. Swiss assessment (if applicable): With REP27, you also receive a free Swiss assessment to determine if a Swiss representative is needed. If so, you are notified immediately.

Following this checklist minimizes compliance risk and ensures you meet the requirements of both Article 27 GDPR and UK GDPR.

Decision Matrix: Do You Need an EU, UK, or Both Representatives?

Use this decision matrix to quickly determine your obligations based on your company’s location and activities:

This matrix covers B2B, B2C, and marketplace sellers (Amazon, Etsy, eBay). If your business is established in neither the EU nor UK but targets both, you must appoint representatives in both regions. If you are established in one, you only need a representative for the other. If you are established in both, you do not need a representative for either.

Realistic Scenarios: Which Obligation Applies?

• US SaaS company selling to EU and UK: A US-based SaaS provider with customers in both the EU and UK must appoint both an EU and a UK GDPR representative. REP27 can issue both designations in one order for €390/year, providing two certificates and privacy notice wording for both territories. This simplifies compliance and reduces administrative overhead compared to using separate providers.
• Chinese Amazon seller shipping to Germany and UK: A Chinese seller listing products on Amazon.de and Amazon.co.uk and shipping to both Germany and the UK is required to appoint both EU and UK representatives. Combined services are the simplest route, ensuring both obligations are met and reducing the risk of inconsistent documentation or missed renewals.
• UK online shop selling only to UK customers: A UK-based online retailer that does not target or monitor EU residents does not need an EU representative. Since the company is established in the UK, it is exempt from appointing a UK representative. No Article 27 representative is required.
• EU-based company selling to UK only: An Irish or German company selling to UK consumers must appoint a UK GDPR representative but does not need an EU representative for its own territory.
• Marketplace sellers (Amazon, Etsy, eBay): Non-EU/UK sellers using these platforms to reach EU or UK customers must appoint the relevant representatives. Some providers, like REP27, offer combined services specifically for marketplace sellers, simplifying compliance.

Risks and Fines for Non-Compliance

Non-compliance with Article 27 GDPR or UK GDPR can have serious consequences. Supervisory authorities have the power to impose administrative fines of up to €10 million or 2% of global annual turnover, whichever is higher (GDPR Article 83). For example, the Dutch authority fined Locatefamily.com €525,000 for failing to appoint a representative. In addition to financial penalties, authorities may order you to stop processing personal data or restrict your business activities in the EU or UK.

Risks are not limited to fines. If your representative lapses due to missed renewal, or if your privacy notice does not correctly name both representatives, you may be found in breach of the law. This can lead to investigations, reputational damage, and loss of customer trust. Using a combined provider reduces the risk of administrative errors and ensures that both designations are kept up to date and verifiable.

Finally, failure to respond to data subject or authority requests in a timely manner can also be considered a breach. Ensure that your provider offers a reliable request desk and that you have internal processes to handle forwarded requests within statutory deadlines.