Do I Need a Legal Representative if I Sell Data Processing Services to EU Customers?

• Non-EU providers selling data processing services in the EU must appoint an EU legal representative.
• This is required under Article 27 GDPR and the EU Data Act Chapter VI.
• Fines for non-compliance can reach up to EUR 10 million or 2% of global turnover.
• REP27 — Europe Services, SE covers all EEA countries at no extra cost.
• EU-based providers do not need a representative for these rules.
• Resellers follow the main provider's compliance status.

Updated 20 October 2026 · 7 sources checked

Providers compared

Prices as published on each provider's website on 20 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article 27 GDPR and the EU Data Act

When selling data processing or cloud services to EU customers, non-EU companies face two major legal requirements: Article 27 GDPR and the EU Data Act Chapter VI. Article 27 GDPR states that any controller or processor not established in the EU, but offering goods or services (including cloud, SaaS, PaaS, or IaaS) to people in the EU, must appoint a written EU representative. This representative acts as the main contact for data subjects and supervisory authorities. The EU Data Act (Chapter VI) adds that any non-EU provider selling data processing services in the EU must also appoint a representative. Both laws apply regardless of company size, sector, or whether you sell B2B or B2C.

• Article 27 GDPR: Applies to non-EU controllers/processors targeting the EU market.
• EU Data Act Chapter VI: Covers non-EU data processing/cloud providers selling in the EU, with specific commercial rules (e.g., switching, notice periods, deletion, documentation).
• Swiss nFADP (Article 14): Only applies if all four legal conditions are met. REP27 provides a free assessment and, if exempt, a signed declaration.

Failure to appoint a representative is a standalone infringement under Article 83(4)(a) GDPR, with fines up to EUR 10 million or 2% of global annual turnover. The Dutch authority fined Locatefamily.com EUR 525,000 for failing to appoint a representative. Under the Data Act, penalties are set nationally but must be effective and dissuasive.

In summary, if you are outside the EU and offer any kind of data processing service (including cloud, SaaS, or analytics) to EU customers, you must appoint a representative in the EU. This is a legal obligation, not an optional compliance step.

How to Choose a Legal Representative: Practical Factors and Decision Matrix

Choosing the right EU legal representative is not just about price. Consider coverage, included services, speed, and transparency. Some providers only cover one EU country, while others (like REP27) offer EEA-wide coverage at no extra cost. Language support, included documentation (such as privacy notice wording), and request handling are also crucial. For example, REP27 provides privacy notice wording in eight languages and a request desk that forwards data subject and authority requests within two business days. Some competitors do not specify these features, and details may only be available on request.

Check for hidden costs, such as per-request fees, charges for certificates, or extra fees for additional countries. Only REP27 explicitly includes a verifiable certificate, public verification, and a Swiss nFADP assessment with every paid plan. Other providers may charge extra for these or not offer them at all. Always confirm what is included in the published price and request a written breakdown if details are not clear.

In summary, prioritize providers who are transparent about their coverage, included services, and pricing, and who can provide documentation and support in the languages your customers use. Always ask for a service agreement that spells out exactly what is included and any potential extra fees.

What the Price Really Includes (and Hidden Costs)

Published prices for EU legal representative services (as of October 2026) range from EUR 290 to EUR 890 per year for REP27, and EUR 420-490 for most competitors. However, the headline price does not always reflect the total cost or the level of service. For example, REP27’s price includes EEA-wide coverage, a signed designation letter, a verifiable certificate (with QR code and public verification), privacy notice wording in eight languages, a request desk for handling data subject and authority requests, Article 30 records management, and a Swiss nFADP assessment. Other providers do not specify these inclusions on their websites, and you may need to request a detailed breakdown.

Hidden costs can include:

• Per-request handling fees (for forwarding or responding to data subject or authority requests)
• Charges for additional countries beyond the provider’s home state
• Fees for certificates or public verification tools
• Extra charges for privacy notice templates or multi-language support
• Delays or surcharges for urgent designations

For example, REP27 issues a designation within 24 hours at no extra cost, while other providers do not publish their timelines. Some providers may only act as a representative for GDPR, not for the Data Act or other regimes. Always confirm the scope of coverage and request a full list of included services and any potential extra fees before signing up.

Summary table:

Always request written confirmation of what is included in your plan to avoid unexpected costs.

How Appointment Works: Step by Step with Examples

Appointing an EU legal representative is a straightforward process, but it must be done carefully to ensure compliance. Here is a step-by-step guide, with practical examples:

1. Determine your obligation: Confirm your company is established outside the EU and sells data processing/cloud services to EU customers. Example: A US SaaS company with EU business clients.
2. Choose a provider: Compare providers based on coverage, inclusions, and price. Example: REP27 offers EEA-wide coverage and a Swiss nFADP assessment.
3. Request designation: Contact your chosen provider and request a written mandate. REP27 provides an eIDAS electronic signature process for speed and security.
4. Sign the mandate: Complete and sign the mandate. REP27 issues a signed designation letter within 24 hours.
5. Receive documentation: Obtain your signed designation letter, verifiable certificate (with QR code), and privacy notice wording (in eight languages with REP27).
6. Update your documentation: Add the representative’s details to your privacy notice, contracts, and website as required by GDPR and the Data Act.
7. Forward requests: Ensure your representative is ready to handle data subject and authority requests. REP27 forwards these within two business days.
8. Maintain compliance: Keep your records up to date and be ready to provide documentation to authorities or customers on request.

Checklist:

1. Confirm your company is outside the EU and targets EU customers.
2. Review your contracts for Data Act switching and deletion rules.
3. Choose and appoint an EU representative.
4. Update privacy notices and contracts.
5. Ensure request handling is in place.
6. Document your compliance for audits and procurement.

Practical tip: EU buyers increasingly ask for proof of representation before signing contracts. Having a verifiable certificate and up-to-date privacy notice can speed up procurement and reduce friction.

Risks and Fines for Non-Compliance

The risks of not appointing an EU legal representative are significant. Under Article 83(4)(a) GDPR, failing to appoint a representative is a standalone infringement, regardless of whether there has been a data breach or other violation. Fines can reach up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. The Dutch supervisory authority fined Locatefamily.com EUR 525,000 solely for failing to appoint a representative.

The EU Data Act also requires non-EU providers to appoint a representative. Penalties for non-compliance are set by each EU Member State but must be effective, proportionate, and dissuasive. This means that fines can vary, but the risk of enforcement is real, especially as authorities become more active and buyers demand compliance as a condition of doing business.

Other risks include:

• Procurement friction: EU buyers may refuse to sign contracts or renewals if you cannot prove compliance.
• Reputation damage: Being named in enforcement actions or public registers can harm your brand.
• Operational disruption: Authorities may block or restrict your services in the EU until compliance is achieved.

Summary table:

In summary, the cost of non-compliance far outweighs the annual fee for a representative. Appointing a representative is a necessary step to avoid fines, business disruption, and reputational harm.

What Providers Usually Do Not Say

When comparing EU legal representative services, it’s important to look beyond the headline price. Providers often do not publish full details of what is included, and there may be hidden costs or limitations:

• Coverage: Some providers only cover one EU country, not the whole EEA. REP27 covers all 27 EU Member States plus Norway, Iceland, and Liechtenstein at no extra cost.
• Per-request or per-certificate fees: Some providers may charge extra for each data subject or authority request, or for issuing certificates. These fees are rarely published up front.
• Notice periods: REP27 issues designation within 24 hours, but other providers may take longer (timelines not always stated).
• Liability limits: Most providers do not publish their liability limits, so you may not know what happens if the representative fails to act.
• Exclusions: Swiss representation is not included by REP27 if required; a free assessment and exemption declaration are provided instead.
• Contractual terms: The Data Act requires fair terms and prohibits lock-in clauses, but not all providers offer guidance or templates for updating contracts.

Always request a written service agreement that details coverage, included services, response times, and any extra fees. Ask for sample documentation and privacy notice templates before signing up.

Decision Matrix and Realistic Scenarios: Who Needs an EU Representative?

Use this decision matrix and real-world scenarios to understand if you need an EU legal representative and which obligations apply:

Scenario 1: US SaaS provider sells project management tools to EU businesses. Must appoint an EU representative for GDPR and Data Act compliance. REP27 offers EEA-wide coverage and rapid setup.

Scenario 2: Chinese Amazon seller ships goods to EU consumers and processes their addresses. Must appoint an EU representative under GDPR if processing personal data.

Scenario 3: UK online shop continues to sell to EU customers post-Brexit. Must appoint an EU representative for GDPR compliance. Data Act applies if offering cloud/data processing services.

In all cases, the simplest compliant route is to appoint a provider offering full EEA coverage and clear documentation.