Do I Really Need a Single Provider for EU and UK GDPR Representatives?

• EU and UK each require a local GDPR representative (Art. 27 EU/UK GDPR)
• Combined providers save effort, costs, and reduce errors
• Prices for both representations start at €390/year (REP27), others from £41/month
• Not every provider covers both regions – check carefully
• Not required for companies genuinely established in both territories

Updated 21 October 2026 · 9 sources checked

Providers compared

Prices as published on each provider's website on 21 October 2026, excluding VAT unless stated. Each row links to its source.

What Does the Law Require? (Article 27 EU/UK GDPR in Detail)

Article 27 of the EU General Data Protection Regulation (GDPR) and the UK GDPR require companies without an establishment in the EU or the United Kingdom to appoint a local representative if they offer goods or services to individuals in these territories or monitor their behavior. This obligation applies regardless of company size once personal data of EU or UK citizens is processed. The representation must be in writing, and the representative's contact details must be published in the privacy policy.

• The obligation does not apply to companies genuinely established in the respective region or to public authorities (Art. 27(2) GDPR).
• Violations can be fined up to €10 million or 2% of global annual turnover.
• The EU representative covers all 27 EU member states plus Norway, Iceland, and Liechtenstein. The UK representative applies exclusively to the United Kingdom.
• After Brexit, two separate representatives are required if both markets are served. An EU representative is not recognized in the UK and vice versa.

Practical example: A US company selling to German and British customers needs two representatives – one in the EU and one in the UK. Appointment is a prerequisite for lawful data processing and should be done before starting business activities.

How to Choose the Right Provider? (Comparison & Practical Tips)

Selecting the appropriate GDPR representative depends on factors such as geographic coverage, pricing structure, scope of services, and quality. Not every provider is legally established in both jurisdictions – this is essential to cover both markets with a single contract. Verify whether the provider actually has establishments in the EU and UK and if a combined offer is available.

• A combined provider like REP27 ensures both mandates are consistent and coordinated.
• Separate providers for EU and UK mean double effort for onboarding, documentation, and renewal – increasing the risk of errors in the privacy policy.
• Check if additional services like multilingual notice texts, public verification pages, or a central request desk are included.
• Compare cancellation periods and renewal terms to avoid protection gaps.

Practical tip: Combine both representatives with one provider whenever possible to ensure consistency and verifiability.

What Is Really Included in the Price? (Compare Scope of Services)

Pricing and scope of services vary significantly by provider. While some cover only the legal minimum, others offer extras like multilingual notice texts, public verification pages, or a central request desk. Combined offers like REP27 provide two separate certificates (EU and UK), each with a QR code and public verifiability, plus notice texts in up to eight languages. They also include request management (DSARs) and templates for the privacy policy.

• REP27 offers both representatives from €390/year, two certificates, an expiration date, and a central contact point for requests.
• Other providers often charge separate fees for EU and UK (e.g., €290/year each or more), potentially doubling costs.
• Additional services like legal advice, DPO services, or compliance audits are usually not included.
• Most providers do not disclose details about additional costs or included services on their websites – inquiries are recommended.

Conclusion: Carefully check which services you actually need and whether they are included in the price.

Hidden Costs and What Providers Rarely Say

Many providers charge separate fees for EU and UK representation, quickly doubling costs. Different contract durations and cancellation periods can cause protection gaps if one mandate expires while the other remains active. REP27 offers a common expiration date and a transition service to ensure seamless coverage. None of the providers include legal advice on individual cases, DPO services, compliance audits, or representation for special industries (e.g., gambling, biometrics, children).

• Per-request fees may apply if request volumes exceed limits (e.g., REP27 charges from the 11th request/year in the basic plan).
• The representative’s liability is usually limited to forwarding requests – legal responsibility for data processing remains with the company.
• Cancellation periods and automatic renewals must be observed to avoid unwanted contract extensions.
• Some providers lack public verification pages or multilingual notice texts, complicating proof of compliance.

Practical tip: Read terms and service descriptions carefully and ask specifically about hidden costs or limitations.

How Does the Ordering Process Work Step by Step? (Process and Examples)

1. Assess your needs: Determine if your company is outside the EU and/or UK and whether you sell to end customers in these markets or monitor their behavior.
2. Choose a provider: Select a provider with establishments in both regions if you serve both markets.
3. Fill out the online form: Provide details about your company, data processing purposes, categories of affected individuals, and recipients.
4. Review documents: The provider prepares two mandates (EU & UK), checks consistency, and ensures no contradictions.
5. Signatures: Both representatives are signed separately (e.g., REP27: Europe Services SE for the EU, REP27 LTD for the UK).
6. Receive certificates and notice texts: You get separate certificates with QR codes and appropriate wording for your privacy policy for each market.
7. Update privacy policy: Include both representatives with correct details in your privacy policy.
8. Keep verification link and QR code: These allow you to prove compliance at any time.

Practical example: With REP27, the entire process usually takes less than 24 hours after submitting all documents.

Decision Matrix: Who Needs What? (Matrix for All Company Types)

Practical tip: Regularly review if your business model or target markets change to respond timely to new obligations.

Checklist: Become Compliant Today (Step-by-Step Guide)

1. Check if your company is located outside the EU and/or UK.
2. Determine if you sell to end customers in the EU/UK or monitor their behavior.
3. Decide whether you serve both markets or only one.
4. Choose a provider with establishments in both regions (e.g., REP27).
5. Complete the online form and submit required information.
6. Review received mandates and certificates for accuracy.
7. Update your privacy policy with correct details for both representatives.
8. Save verification links and QR codes for proof to authorities or partners.
9. Plan renewals timely to avoid protection gaps.

This checklist helps you become legally compliant in a few steps.

Risks and Fines for Violations (Pitfalls & Examples)

Non-compliance with Article 27 EU/UK GDPR is a standalone violation and can result in fines up to €10 million or 2% of global annual turnover. Supervisory authorities may also impose sales bans or public warnings. A notable case is the fine against Locatefamily.com by the Dutch authority for €525,000 due to missing representative appointment.

• Reputational damage and sales bans are also possible.
• Incorrect or contradictory privacy policy information can trigger further investigations.
• Missing representatives may cause requests from data subjects or authorities to be improperly forwarded, leading to additional legal consequences.

Practical tip: Keep all certificates and proofs up to date and ensure your privacy policy is always correct.

Three Practical Scenarios (Concrete Examples & Solutions)

• US SaaS provider: Sells software to customers in Germany and the UK. Needs both representatives. Using a combined provider like REP27 allows completing the process in one step – two certificates, one expiration date, less effort.
• Chinese Amazon seller: Lists products on Amazon.de and Amazon.co.uk. Since end customers are served in both markets, two representatives are required. A combined offer reduces errors and simplifies proof to marketplaces and authorities.
• British online shop: Sells exclusively to German customers. Needs only an EU representative, no UK representative. The order can be limited to the EU representative.

These examples highlight the importance of correctly assessing your market activities and choosing a suitable provider.