EU Data Act Legal Representation for Non-EU Businesses: Providers & Prices (2026)

• EU Data Act Chapter VI requires non-EU cloud/data service providers to appoint an EU representative.
• REP27 — Europe Services, SE, Usantis, Regingada, EU Shield, and Prighter offer this service.
• Published prices (October 2026): EUR 420–890/year, depending on provider and plan.
• REP27 covers all EEA countries at no extra cost; others may vary.
• Appointment is mandatory for non-EU providers selling to EU customers.
• Some providers include GDPR Article 27 and Swiss nFADP assessment.

Updated 20 October 2026 · 5 sources checked

Providers compared

Prices as published on each provider's website on 20 October 2026, excluding VAT unless stated. Each row links to its source.

What the EU Data Act Requires (Chapter VI, Article 30+)

The EU Data Act (Regulation (EU) 2023/2854) introduces new obligations for providers of data processing services—such as cloud, SaaS, and IoT platforms—offering their services in the EU, regardless of where the provider is established. Chapter VI (Articles 30–35) is particularly significant for non-EU businesses, as it mandates the appointment of a legal representative within the EU. This representative acts as the official point of contact for authorities and customers regarding compliance with the Data Act’s requirements on switching, transition, and data access.

• Article 30: Requires non-EU providers selling data processing services in the EU to appoint a representative established in the Union. This is a written mandate, and the representative must be able to act on behalf of the provider regarding all obligations under Chapter VI.
• Article 31–35: Cover specific duties, including removing obstacles to switching providers, capping notice periods (maximum two months for customers to start switching), mandating a transition period (minimum 30 days), ensuring functional equivalence for migrated services, providing clear information on formats and interfaces, and erasing exportable data after the transition at the customer’s request.

Failure to appoint a representative is a standalone infringement and can lead to national penalties. The regulation applies to both B2B and B2C services, and to any size of provider, as long as they are offering data processing services to customers in the EU. Importantly, the requirement does not apply to non-EU providers selling only outside the EU, or to on-premise software vendors not offering data processing as a service.

For example, a US-based SaaS platform with European customers must appoint an EU representative under the Data Act. A Chinese IoT manufacturer selling connected products in the EU must do the same. However, a non-EU company selling only physical goods (with no data processing service) does not fall under this obligation.

How to Choose an EU Data Act Representative

Selecting the right EU Data Act representative is a critical compliance step for non-EU businesses. The main considerations are geographical coverage, included services, languages supported, speed of appointment, and whether additional compliance needs (such as GDPR Article 27 or Swiss nFADP) are addressed. Some providers, like REP27, offer a comprehensive package including EEA-wide coverage, a verifiable certificate, multilingual privacy notice templates, and a Swiss nFADP assessment with every paid plan. Others, such as Usantis, Regingada, EU Shield, and Prighter, publish prices but do not detail what is included in the fee.

When comparing providers, request a sample designation letter and a list of included and excluded services. Consider whether the provider:

• Covers all EEA countries at no extra cost (as REP27 does);
• Provides documentation and privacy notice templates in multiple languages;
• Offers a verifiable certificate or public verification page;
• Includes a request desk for handling data subject and authority requests;
• Supports Swiss nFADP assessment or representation if you have Swiss customers.

Below is a summary of what is included, not included, or may incur extra fees for each provider, based on available data:

Practical tip: Always ask for a detailed service description and contract before committing. Some providers may charge additional fees for handling requests, supporting more countries, or providing documentation in extra languages.

What the Price Really Includes

Published prices for EU Data Act legal representation in October 2026 range from EUR 420 to EUR 890 per year, depending on the provider. However, what is actually included in this price can vary significantly. REP27 — Europe Services, SE is transparent about its inclusions: the service covers all 27 EU Member States plus Norway, Iceland, and Liechtenstein (the entire EEA) at no extra cost. The annual fee includes a signed designation letter (with eIDAS electronic signature), a verifiable certificate (with QR code and public verification), privacy notice wording in eight languages, a request desk for forwarding data subject and authority requests, and the holding and production of Article 30 records to authorities on request. Importantly, REP27 also provides a Swiss nFADP assessment with every paid Article 27 plan at no extra cost, though it does not act as Swiss representative if all criteria are met.

For Usantis, Regingada, EU Shield, and Prighter, the published prices are clear, but the scope of included services is not detailed on their public pages. This means buyers should request a full breakdown of what is covered, including whether the price includes:

• Coverage for all EEA countries or only selected jurisdictions;
• Multilingual documentation and privacy notice templates;
• Handling of authority and data subject requests;
• Certificate or public verification;
• Support for Swiss nFADP assessment or representation.

Hidden costs can arise if the provider charges extra for each country, for handling requests, or for additional compliance documentation. Always clarify these points before signing.

Summary table:

Hidden Costs and Exclusions

While the published annual prices for EU Data Act representation are straightforward, buyers should be aware of potential hidden costs and exclusions that may affect the total cost of compliance. REP27 is explicit about its inclusions, but other providers do not specify whether the base fee covers all necessary services or if additional charges apply. Here are the main areas to watch for:

• Multi-country coverage: Some providers may charge extra for each additional EEA country. REP27 covers the entire EEA at no extra cost, but for others, this is not specified.
• Languages: REP27 includes privacy notice templates in eight languages. Other providers may charge extra for documentation in additional languages or only provide templates in English.
• Per-request fees: Handling data subject or authority requests may incur additional fees, particularly if requests are frequent or complex. REP27 forwards requests within two business days as part of the service; other providers do not specify their process or costs.
• Swiss nFADP assessment: Only REP27 includes a Swiss assessment with every paid plan. If Swiss representation is required, REP27 does not provide it, and clients must appoint a separate Swiss representative.
• Liability and support limits: Providers may limit their liability or the level of support included in the base price. Always request the full contract and service terms before signing.
• Notice periods and transition: The Data Act caps notice periods and mandates transition support, but not all providers clarify how their service aligns with these requirements.

Practical advice: Always ask providers to specify in writing what is included, what is excluded, and what may incur extra fees. This prevents surprises during audits or when handling requests from authorities or customers.

How Appointment Works: Step by Step

Appointing an EU Data Act representative is a structured process. Here’s how it works in practice, with concrete steps and tips for each stage:

1. Determine Applicability: Confirm that your business is a non-EU provider offering data processing services (cloud, SaaS, IoT, etc.) to customers in the EU. If you only sell physical goods or operate entirely outside the EU, the requirement does not apply.
2. Research Providers: Compare providers based on published prices, included services, and geographical coverage. Use the table above to shortlist candidates.
3. Request Documentation: Ask each provider for a sample designation letter, a list of included/excluded services, and their standard contract. Clarify how quickly designation can be issued (REP27 provides it within 24 hours).
4. Sign the Mandate: Enter into a written agreement (designation letter) with the chosen provider. This document authorizes the representative to act on your behalf for Data Act compliance.
5. Receive Confirmation: Obtain a certificate of appointment (e.g., eIDAS-signed letter, QR code verification) from the provider. REP27 offers public verification for added transparency.
6. Update Documentation: Revise your contracts, privacy notices, and technical documentation to reference your appointed representative. REP27 provides privacy notice templates in eight languages to simplify this step.
7. Ongoing Compliance: Ensure your provider forwards requests from authorities or data subjects promptly. Maintain up-to-date Article 30 records and monitor regulatory changes that may affect your obligations.

Checklist for buyers:

1. Confirm your service is caught by Chapter VI (cloud/data processing, non-EU, selling in EU).
2. Compare providers’ published prices and included services.
3. Request a sample designation letter and list of inclusions/exclusions.
4. Sign the mandate and receive confirmation/certificate.
5. Update your privacy notice and contracts to reference the representative.
6. Ensure your technical and contractual documentation is Data Act-compliant.
7. Monitor for renewal dates and regulatory updates.

Risks, Fines, and Enforcement

Non-compliance with the EU Data Act’s representative requirement exposes businesses to significant risks. Under the Data Act, failure to appoint a representative is a standalone infringement, subject to national enforcement and penalties. While the regulation does not specify a fixed fine amount, authorities are required to impose penalties that are effective, proportionate, and dissuasive. For context, under GDPR Article 27 (a parallel regime for personal data), fines can reach up to EUR 10 million or 2% of global annual turnover for failing to appoint a representative. The Data Act is enforced at the national level, and each EU Member State designates competent authorities to oversee compliance.

Practical consequences of non-compliance include:

• Inability to sign contracts with EU customers, as buyers increasingly require proof of representation;
• Heightened risk of investigation or enforcement action by national authorities;
• Potential for reputational damage and loss of business opportunities;
• Operational disruption if requests from authorities or customers are not handled promptly.

REP27 highlights that procurement teams in Europe now routinely ask about Data Act compliance and representative appointment before finalizing contracts. This means that even if enforcement is not immediate, commercial pressure is already driving compliance in practice.

Tip: Appoint a representative proactively, update all customer-facing documentation, and ensure your provider can demonstrate compliance on demand (e.g., via a verifiable certificate or public verification page).

Decision Matrix: Do You Need an EU Data Act Representative?

Use the following matrix to determine whether your business needs to appoint an EU Data Act representative:

Examples:

• A US-based SaaS platform with EU customers: Needs a representative.
• A Chinese IoT manufacturer selling connected products in the EU: Needs a representative.
• A UK online shop selling only physical goods to EU consumers: Does not need a representative (unless offering data processing services).

What Providers Usually Do Not Say

When comparing EU Data Act representatives, there are several important details that providers may not disclose upfront:

• Scope of Service: Some only cover GDPR Article 27, not Data Act or Swiss nFADP obligations. Always confirm the specific regulations covered.
• Extra Fees: Additional charges may apply for multi-country coverage, extra languages, or per-request handling. REP27 is explicit about EEA-wide coverage at no extra cost, but others are not.
• Per-request Support: Providers may limit the number of requests handled or charge for each authority or data subject request. REP27 forwards requests within two business days as part of the base service.
• Notice Periods and Transition: The Data Act caps notice periods and mandates a 30-day transition, but not all providers clarify how their service aligns with these requirements or if they assist with contract updates.
• Liability Limits: Providers may limit their liability in the contract. Always review the full terms before signing.
• Swiss Representation: Only REP27 includes a Swiss nFADP assessment, and will issue a declaration of exemption if representation is not required. If all Swiss criteria are met, clients must appoint a separate Swiss representative.

Practical tip: Request a detailed contract and service description before committing. Clarify all inclusions, exclusions, and potential extra fees in writing.

Realistic Scenarios: What Applies and How to Comply

• US SaaS company selling to EU businesses: Must appoint an EU Data Act representative. REP27, Usantis, Regingada, EU Shield, and Prighter all offer this service. The company should select a provider, sign a designation letter, and update its privacy notice and contracts. If also processing personal data, GDPR Article 27 representation is likely required (REP27 covers both).
• Chinese Amazon seller: If the seller operates a cloud platform or provides data processing services to EU customers (e.g., IoT device management), a Data Act representative is required. If only selling physical goods via Amazon, no representative is needed for the Data Act. The seller should assess its service offering and, if caught, follow the appointment steps above.
• UK online shop with EU customers: If the shop offers cloud or data processing services (e.g., a SaaS platform or connected product), a representative is required. For sales of physical goods only, the Data Act does not apply. The shop should review its services, and if caught, appoint an EU representative and update documentation accordingly.

These scenarios illustrate the importance of assessing your business model and service offering against the Data Act’s requirements. When in doubt, consult the regulation or seek legal advice to ensure compliance.