EU Data Act Legal Representative for Non-EU Connected Product Sellers: Providers & Prices 2026

• Appointment is mandatory under Article 37 for non-EU sellers of connected products/services in the EU
• REP27 — Europe Services, SE: €290-890/year, designation in 24h, verifiable certificate
• Prighter: €420/year, Regingada: €490/year, EU Shield: €490/year (prices verified)
• REP27 does not provide legal advice or answer requests on the merits
• Penalties for non-compliance may reach GDPR-level fines (up to €20M or 4% turnover)
• Not required for on-premise software vendors or non-EU sellers with no EU customers

Updated 16 October 2026 · 13 sources checked

Providers compared

Prices as published on each provider's website on 16 October 2026, excluding VAT unless stated. Each row links to its source.

What the EU Data Act Requires (Articles 3, 4, 37, 40)

The EU Data Act introduces a specific obligation for non-EU companies making connected products or offering related services in the EU market. Under Article 37(11), these companies must appoint a legal representative established in the Union. This representative acts as the official contact for authorities and users, and is responsible for demonstrating the company’s compliance with the Data Act upon request (Article 37(12)).

The appointment is not optional: until a representative is formally designated, every EU Member State authority may address the non-EU company directly (Article 37(13)). This increases the risk of multiple investigations or enforcement actions. Penalties for non-compliance are determined by each Member State but may reach the same level as GDPR fines—up to €20 million or 4% of global turnover (Article 40(1), (4)).

The Data Act also sets out detailed requirements for connected product sellers and related service providers. Articles 3 and 4 require pre-contractual disclosure of the type, format, and volume of product data, as well as information about which data will be obtained, who will use it, and for what purposes. Data holders must respond to access requests without undue delay, free of charge, and at the same quality as they themselves have access to (Article 4(1)). Trade secrets must be identified and protected, but cannot be used as a blanket reason to refuse data access (Articles 4(6)-(8)).

In summary, if you are a non-EU company selling connected products or offering data-driven services to EU customers, you must:

• Appoint an EU-based legal representative
• Provide clear, pre-contractual disclosures
• Respond to data access requests promptly
• Demonstrate compliance to authorities on demand

How to Choose a Legal Representative Provider

Choosing the right legal representative provider is crucial for compliance and operational efficiency. Key factors to consider include:

• Speed of appointment: Some providers, such as REP27, issue a signed designation letter and certificate within 24 hours. Others may take longer or require more documentation.
• Verifiability: Look for providers offering a verifiable certificate (ideally with a QR code or public registry) to demonstrate compliance to customers and authorities.
• Languages supported: If you serve customers across the EU, multilingual request handling is important. REP27 offers request desk services in 8 languages.
• Scope of services: Some providers cover only GDPR Article 27, while others (like REP27) also offer optional coverage for the GPSR Responsible Person or Reg. (EU) 2019/1020.
• Transparency of pricing: Published prices should be clear and inclusive. Many providers require you to request a quote for additional services or multi-regulation coverage.

Decision matrix for typical company profiles:

Practical tip: Always verify what is included in the annual fee and ask for a copy of the designation letter and certificate before updating your documentation.

What the Price Includes: Provider Comparison

Legal representative service pricing varies widely, both in published rates and in what is included for the fee. The table below summarizes published inclusions and exclusions. Where information is not published, request specifics before signing:

REP27’s published price covers all core requirements for Data Act representation, including a verifiable certificate and multilingual request desk. Optional add-ons (e.g., GPSR Responsible Person) are available but not included in the base price. Most other providers do not publish detailed inclusions or exclusions, so it is essential to clarify before committing.

Practical tip: Always request a full breakdown of what is included, and check for any per-request or per-incident fees, especially if you expect frequent data subject or authority contacts.

Hidden Costs and What Providers Usually Do Not Say

While most providers advertise a headline price, there are several areas where hidden costs or exclusions may arise. Based on published information:

• REP27 does not provide legal advice, DPO services, or answer requests on the merits. The service is limited to forwarding requests and providing compliance documentation.
• Other providers often do not specify whether they charge extra for high request volumes, additional regulations (such as GPSR or the Digital Services Act), or for producing records on demand.
• Notice periods for switching providers or terminating the appointment are capped by law (maximum two months for switching, per Data Act Chapter VI), but some providers may have internal policies or minimum contract terms.
• Liability limits are rarely published. The representative’s liability is typically limited to their role as a contact point and does not extend to covering fines or substantive compliance failures by the non-EU company.
• Designation does not shield the non-EU company from direct enforcement action by EU authorities. The representative is an additional point of contact, not a substitute defendant.

Practical tip: Before signing, ask for the provider’s terms and conditions, clarify any per-request fees, and confirm the process for terminating or switching the appointment. If you need legal advice or DPO services, you will need to contract these separately.

How Appointment Works: Step-by-Step

Appointing an EU Data Act legal representative is a structured process. Here is a step-by-step guide based on provider practices and legal requirements:

1. Determine your status: Confirm that your company is established outside the EU and sells connected products or related services to EU customers. If you only sell on-premise software or have no EU customers, you do not need a representative.
2. Choose a provider: Compare providers based on speed, verifiability, price, and included services. REP27 offers online appointment and 24-hour turnaround; others may require more documentation or time.
3. Request service: Complete the provider’s online form or contact them by email. Be prepared to provide company details, product/service descriptions, and contact information.
4. Sign the mandate: The provider will send a written mandate for you to sign, formally appointing them as your EU legal representative. This is a legal requirement under Article 37.
5. Receive documentation: The provider issues a signed designation letter (REP27: eIDAS electronic signature), a verifiable certificate (often with QR code), and instructions for updating your documentation.
6. Update disclosures: Add the representative’s contact details to your product pages, manuals, and contracts. Ensure all pre-contractual information required by Articles 3 and 4 is included.
7. Prepare for requests: Set up internal processes to forward or respond to data subject and authority requests via the representative’s desk. REP27 forwards requests within 2 business days.

Checklist for buyers:

1. List all connected products/services sold to EU customers
2. Review and update pre-contractual disclosures
3. Appoint a legal representative before 12 January 2027
4. Document compliance measures for demonstration to authorities
5. Train staff on handling requests via the representative

Risks and Fines for Non-Compliance

Failure to appoint a legal representative or to comply with the Data Act’s requirements exposes non-EU companies to significant enforcement risks. Article 40 allows Member States to set penalties, which may reach the same levels as GDPR fines—up to €20 million or 4% of global turnover. These fines can be imposed for failing to appoint a representative, not providing required disclosures, or not responding to data access requests.

Until a representative is appointed, all EU Member State authorities are competent to address your company directly (Article 37(13)). This increases the risk of parallel investigations, inconsistent demands, and reputational damage. Once a representative is appointed, authorities must address them as the first point of contact, streamlining communications and reducing enforcement risk.

Non-compliance with disclosure obligations (Articles 3 and 4) can also trigger investigations. For example, failing to inform users about the type, format, or volume of product data before sale, or not responding to access requests promptly, may result in complaints and regulatory scrutiny.

Practical tip: Appoint a representative as early as possible, and ensure all required disclosures are in place before launching or renewing contracts in the EU. Keep documentation ready to demonstrate compliance at any time.

Realistic Scenarios: What Applies and What to Do

• US SaaS selling IoT dashboards to EU businesses: The company is non-EU, offers a data-driven service, and targets EU business customers. It must appoint both a Data Act and GDPR Article 27 representative. The simplest route is to use a provider like REP27 for both, update pre-contractual disclosures (type, format, and volume of data, access rights), and ensure data export features meet the Act’s requirements.
• Chinese Amazon seller offering smart home devices to EU consumers: As a non-EU manufacturer selling connected products to EU consumers via marketplaces, the seller must appoint a Data Act legal representative and likely a GPSR Responsible Person. The seller should select a provider offering both services, update product listings and manuals with the representative’s contact details, and prepare standard agreements for handling trade secrets and third-party data sharing.
• UK online shop selling only to UK customers: If the company has no EU customers and does not offer connected products or services in the EU, no Data Act representative is required. However, if the company expands to EU markets, it must appoint a representative before making sales or entering into contracts with EU users.

In all cases, the key is to map your sales channels and customer locations, review your product and service offerings, and act before enforcement deadlines. Early compliance reduces risk and procurement friction.