Do I Need a Legal Representative for My Online Platform if I'm Based Outside the EU?

• GDPR Article 27 and DSA Article 13 require most non-EU platforms to appoint an EU representative.
• Obligation applies if you offer services to or monitor users in the EU.
• Fines for non-compliance can reach €10 million or 2% of global turnover (GDPR).
• Marketplaces (Amazon, Etsy, eBay) enforce compliance before allowing sales.
• Some exemptions for occasional, low-risk processing (GDPR only).
• Providers differ in price, coverage, and included services—compare carefully.

Updated 22 October 2026 · 10 sources checked

Providers compared

Prices as published on each provider's website on 22 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: GDPR Article 27 & DSA Article 13

Non-EU online platforms and service providers face two main EU legal obligations if they offer services to users in the EU or process their data: appointing a GDPR Article 27 representative and/or a Digital Services Act (DSA) Article 13 legal representative. These obligations are distinct and can apply together or separately depending on your business model.

• GDPR Article 27: Applies to non-EU data controllers or processors who offer goods or services to, or monitor the behavior of, EU residents. This includes SaaS, e-commerce, apps, and any platform collecting or analyzing data from EU users. Exemptions exist if processing is only occasional, not large-scale, and unlikely to risk data subjects' rights.
• DSA Article 13: Applies to non-EU providers of intermediary services (marketplaces, platforms, hosting, cloud, social networks, app stores, VPNs, DNS, CDN) offered in the EU. If your platform allows user-generated content or third-party sales and is accessible to EU users, you must appoint a DSA legal representative in an EU country where your service is offered.

Failure to comply with these requirements can result in severe penalties. Under GDPR, fines can reach €10 million or 2% of global annual turnover (Article 83(4)(a)). Under the DSA, platforms may suspend your account or block listings, and authorities may impose further penalties. Marketplaces like Amazon, Etsy, and eBay enforce these requirements before allowing non-EU sellers to list products.

Included / Not Included / Extra Fees Table

In summary, if you are a non-EU business targeting or serving EU users, you must carefully assess which obligations apply and ensure you appoint the correct representative(s). Failing to do so risks fines, account suspension, or loss of market access.

How to Choose a Legal Representative: Practical Considerations

Choosing the right EU legal representative is crucial for compliance and operational efficiency. Here are key factors to consider, based strictly on provider data and legal requirements:

• Coverage: Does the provider cover all EU/EEA states? For example, REP27 covers the entire EEA (EU27 plus Norway, Iceland, Liechtenstein) at no extra cost. Some providers may only cover specific countries.
• Speed of Designation: REP27 issues designations within 24 hours. Others may take longer—important if you need to go live quickly or respond to a compliance request.
• Verification and Documentation: Look for a provider offering a verifiable certificate (REP27 provides a QR code and public verification page), signed designation, and clear privacy notice wording in multiple languages (REP27: 8 languages).
• Authority Notification: Some providers (REP27) notify the relevant EU authority (e.g., Digital Services Coordinator) on your behalf, which is required under the DSA.
• Price Transparency: Are all costs and included services clearly stated? REP27 and Engage Compliance publish prices; others require a quote. Watch for hidden fees for extra requests or multi-country coverage.

Decision Matrix

Always confirm the provider's ability to support your specific business model and EU countries of operation. For example, REP27 can only act as your DSA representative if your service is also offered in the Czech Republic.

What the Price Really Includes: Comparing Providers

Provider pricing and included services can vary widely. Understanding exactly what you get is essential to avoid gaps in compliance or unexpected costs. Here’s a detailed comparison based on published data:

• REP27 — Europe Services, SE: EUR 390/year for DSA representation; EUR 290–890/year for GDPR Article 27, depending on plan. Includes signed designation, notification to authorities, certificate with QR code, request desk, privacy notice wording in 8 languages, EEA-wide coverage, and a Swiss assessment (with GDPR plan). No set-up fee, cancel any time, and no extra cost for multi-country coverage.
• Engage Compliance: EUR 1200/year for DSA Legal Representative (price verified on source). Details on included services are not specified on the source page.
• EU Shield: €490/year for GDPR Article 27 representation, covering all 27 EU member states. Includes EU contact address, record-keeping support, and correspondence forwarding.
• DilicheckRep: €29–€149/month (plan-dependent) for GDPR Article 27 rep, including formal designation, EU address, forwarding, and documentation.
• Formiti, EDPO, OSTRAI: Prices on request. Services include GDPR representation, regulatory liaison, and, for some, multilingual support and tailored arrangements.

Some providers may charge extra for additional requests, multi-country coverage, or language support. Always request a full breakdown before appointing. For example, REP27 includes EEA-wide coverage and privacy notice templates in 8 languages at no extra cost, but does not act as a Swiss representative if all Swiss triggers are YES (instead, a declaration of exemption is provided).

When comparing, consider not just price but also speed, documentation, and the ability to support your specific compliance needs.

Hidden Costs and What Providers Usually Do Not Say

Many buyers overlook hidden costs and exclusions until after appointment. Here’s what to watch for, based strictly on provider disclosures:

• Notice Periods and Cancellation: REP27 allows cancellation at any time with no notice period. Other providers may require advance notice or impose penalties for early termination (not specified in available data for others).
• Per-Request Fees: Some providers may charge extra for handling data subject or authority requests, especially if requests are frequent or complex. REP27 does not state any per-request fees; for others, this information is not disclosed.
• Liability Limits: Providers may limit their liability for compliance failures or restrict their role to forwarding communications only. REP27 does not act as a Swiss representative if all Swiss triggers are YES and does not act as a product authorized representative unless the GPSR plan is chosen. Always check the contract for such exclusions.
• Multi-Country Coverage: Some providers may charge extra for each additional EU country. REP27 and EU Shield include all EU/EEA states in their base price; others may not.
• Language Support: Privacy notice templates and authority communications may only be available in certain languages. REP27 provides templates in 8 languages; others may offer fewer or charge extra.

Always review the provider’s terms for exclusions, renewal conditions, and what happens if you miss a renewal. Ask specifically about per-request charges, liability, and how quickly they forward requests from authorities or data subjects.

How Appointment Works: Step-by-Step Checklist

1. Assess Your Activities: Determine if you offer goods/services to or monitor individuals in the EU (GDPR) or provide an intermediary service (DSA) without an EU establishment.
2. Identify Applicable Laws: Use the decision matrix above to confirm if you need a GDPR Article 27 representative, DSA representative, or both.
3. Choose a Provider: Compare providers based on coverage, speed, price, included services, and transparency. Confirm they can act in all relevant countries (e.g., REP27 requires your service to be offered in the Czech Republic for DSA representation).
4. Sign Up and Pay: Complete the provider’s onboarding process, submit company and service details, and pay the fee (REP27 accepts card, SEPA, PayPal; AWS billing also available).
5. Receive Documentation: Obtain the signed designation, certificate, and privacy notice wording. REP27 provides a verifiable certificate with QR code and public verification page.
6. Publish Details: Add the representative’s details to your privacy notice (GDPR) or terms (DSA) as required by law.
7. Authority Notification: Ensure your provider notifies the relevant EU authority (e.g., Digital Services Coordinator for DSA). REP27 handles this for you.
8. Maintain Compliance: Keep your representative’s details up to date, renew the mandate annually, and respond promptly to requests from authorities or data subjects forwarded by your representative.

Following these steps ensures you remain compliant and avoid fines or service suspensions.

Risks and Fines for Non-Compliance

Failing to appoint a required EU legal representative exposes your business to significant risks and penalties. Here are the key consequences, based on official sources and real enforcement actions:

• GDPR Article 27: Non-EU companies that do not appoint a representative can be fined up to €10 million or 2% of total worldwide annual turnover, whichever is higher (Article 83(4)(a)). For example, the Dutch supervisory authority fined Locatefamily.com €525,000 for failing to designate a representative.
• DSA Article 13: Platforms and marketplaces can suspend your account or block listings if you do not provide proof of a legal representative. Regulatory authorities may also impose fines or other penalties for non-compliance.
• GPSR (General Product Safety Regulation): Non-EU manufacturers selling physical products in the EU must appoint an EU Authorized Representative. Failure to do so can result in product recalls, market bans, or other enforcement actions.

These penalties are not theoretical: marketplaces and authorities actively enforce these requirements. Sellers and platforms discovered during audits or complaints are often given a short deadline to comply or face immediate suspension or fines. Appointing a representative is a legal obligation, not a formality, and should be prioritized alongside other compliance measures.

Realistic Scenarios: What Applies and How to Comply

• Scenario 1: US SaaS company with EU users
  A US-based SaaS platform offers services to EU customers and processes their data. It needs a GDPR Article 27 representative. Cheapest compliant route: REP27 from EUR 290/year (GDPR), or EU Shield for €490/year. No DSA representative is required unless the SaaS platform also hosts user-generated content or acts as an intermediary.
• Scenario 2: Chinese Amazon seller
  A Chinese company sells physical goods to EU consumers via Amazon. It needs a GDPR Article 27 representative (for data processing) and a GPSR responsible person (for product safety). REP27 covers GDPR and offers GPSR as an option. No DSA representative is required unless operating its own marketplace.
• Scenario 3: UK online shop selling to EU
  A UK-based online shop sells directly to EU consumers. It needs a GDPR Article 27 representative. Cheapest GDPR-only options: REP27 or DilicheckRep monthly plan. DSA representative is only needed if the shop operates as a marketplace for third-party sellers.

In each scenario, the simplest compliant route is to appoint a provider offering a fast, verifiable designation and clear documentation, and to publish the representative’s details in the privacy notice or terms as required. Always confirm if your provider covers all EU/EEA states relevant to your business.