How to Compare EU and UK GDPR Representative Providers

• Article 27 GDPR requires an EU representative for companies outside the EU
• Fines can reach €10 million or 2% of global turnover
• REP27 covers EU and UK in one request, prices from €290 to €990/year
• Not every company needs the service: see decision by profile
• Compare what is included, limits, and hidden costs
• Verify if the provider is established in the required countries

Updated 26 October 2026 · 6 sources checked

Providers compared

Prices as published on each provider's website on 26 October 2026, excluding VAT unless stated. Each row links to its source.

Legal Requirements: GDPR Article 27 and UK GDPR

GDPR Article 27 mandates that any company outside the European Union offering goods, services, or monitoring behavior of individuals in the EU must designate, in writing, a representative established in an EU Member State (source). The same principle applies to the United Kingdom post-Brexit, requiring a local representative for foreign companies processing data of UK residents. The designation is mandatory even if the company has no physical presence in the EU or UK. Non-compliance can result in fines up to €10 million or 2% of global annual turnover, whichever is higher. A practical example: Locatefamily.com was fined €525,000 for failing to appoint a representative.

The representative must be available for communication with data protection authorities and data subjects. This does not apply to public authorities or companies processing data only occasionally and without risk to data subjects' rights and freedoms. The representative acts as a contact point for requests from data subjects and authorities but does not replace the DPO (Data Protection Officer).

It is essential to ensure the representative is established in the required territory, as a designation made by an entity outside the EU or UK is not valid before local authorities.

How to Choose: Practical Criteria to Compare Providers

Choosing the right representative is crucial to avoid risks and unnecessary costs. Evaluate the following criteria:

• Establishment: The representative must be established in the EU (and/or UK). For example, REP27 has entities in the Czech Republic (EU) and the UK, allowing coverage of both regimes in one request.
• Published price: Compare annual fees and renewals. REP27 offers plans from €290 to €990/year (EU) and €390 to €990/year (EU+UK), while competitors range from €490 to £1,450/year.
• Included services: Certificate, privacy notice wording, request desk, languages, record storage (Art. 30), Swiss assessment (REP27), professional liability coverage (EU Shield).
• Limits and exclusions: Request volume, sector or data type exclusions (REP27 excludes sensitive data, large volumes, regulated sectors, etc.).
• Appointment process: Ease, issuance time (REP27: up to 24h), synchronized renewal, verifiable certificates.

Also check if the provider offers wording in multiple languages (useful for multilingual sites) and if there is support to synchronize renewal for both territories to avoid compliance lapses.

What the Price Really Includes (and What It Does Not)

Not all providers offer the same services for the published price. A detailed analysis of inclusions avoids surprises and hidden costs. See the comparison:

REP27 clearly details what is and isn’t included: the Basic plan covers up to 10 requests/year; unlimited in higher plans. Includes wording for privacy notice in 8 languages and free Swiss assessment (Art. 14 nFADP). Does not cover sensitive data, child activities, large volumes, regulated sectors, adult content, gaming, crypto-assets, weapons, or consumer pharmaceuticals. Other providers do not publicly disclose limits or exclusions.

It is recommended to request detailed limits and exclusions before contracting, especially for companies in sensitive sectors or with high data volumes.

Hidden Costs and Exclusions: What Providers Usually Don’t Say

When comparing providers, it is essential to analyze not only the initial price but also hidden costs and contractual exclusions. Key points:

• Volume limits: REP27 limits to 10 requests/year on Basic plan; unlimited on Standard/Multi plans. Other providers do not publicly disclose limits.
• Clear exclusions: REP27 does not accept sensitive data (Art. 9/10), child services, large volumes, regulated sectors, adult content, gaming, crypto-assets, weapons, consumer pharmaceuticals, or licensed activities.
• Renewals and discounts: REP27 offers discount on annual renewal (e.g., Basic drops from €290 to €240/year for one territory, €320 for both). Others do not detail renewal or discount policies.
• Professional liability: Only EU Shield mentions professional liability coverage, useful for companies concerned about legal risks.
• Notice periods: REP27 requires written cancellation at least 30 days in advance. Others do not publicly disclose notice periods.
• Non-included services: No provider, including REP27, acts as compliance department, DPO, legal consultancy, or responds substantively to requests. The role is forwarding and formal representation.

Always request the full contract and carefully read exclusions and renewal conditions before contracting. This avoids surprises and ensures continuous compliance.

How Appointment Works: Practical Step-by-Step

The GDPR representative appointment process is simple but requires attention to detail. Typical steps with REP27 and comparison points with other providers:

1. Choose provider and plan: Select the plan suitable for request volume and territories (EU, UK, or both).
2. Fill out the form: Provide company data, processing description, and target countries. REP27 uses a single form covering both territories, avoiding duplicate information.
3. Review and issuance: A specialist reviews the file. REP27 issues both designations (EU and UK) the same day, each signed by the local entity (Europe Services, SE for EU; REP27 LTD for UK).
4. Receive certificates: You receive two certificates, two verification codes, and wording in 8 languages. Each certificate is verifiable via QR code and public webpage.
5. Update privacy notice: Include the provided lines on your website. Note: a single notice for both territories is incorrect; each authority requires mention of the local entity.
6. Annual renewal: REP27 synchronizes renewal for both territories, avoiding lapses. Renewal discount is applied automatically.

Other providers may require separate processes for EU and UK, with different forms, renewal dates, and wording. This increases risk of inconsistencies and compliance lapses.

Buyer checklist:

1. Verify your company is outside EU/UK and offers goods/services or monitors residents.
2. Confirm you are not exempt (occasional activity, low risk, public sector).
3. Choose providers established in required territories.
4. Compare prices, limits, included services, and exclusions.
5. Request formal appointment and verifiable certificate.
6. Update your privacy notice with correct wording.
7. Schedule renewal and keep records for audit.

Risks, Fines, and Consequences of Non-Compliance

Non-compliance with GDPR Article 27 can lead to severe consequences. Fines can reach €10 million or 2% of global annual turnover, whichever is higher (source). Real example: Locatefamily.com was fined €525,000 for lacking an EU representative. Besides fines, there are risks of operational blocks, investigations by data protection authorities, and serious reputational damage.

The representative is the formal contact point for data subjects and authorities. Without one, the company may be considered "unreachable" by authorities, increasing sanction risk. Also, absence of a representative can hinder contracts with European partners, as many require proof of compliance as a business condition.

Another risk is documentary inconsistency: using two different providers for EU and UK may cause discrepancies in records, wording, and renewal dates, which can be questioned in audits. REP27 reduces this risk by issuing both certificates together, with synchronized wording and dates.

Risk summary:

• High and immediate fines
• Operational and contract blocks
• Reputational damage
• Loss of business opportunities
• Risk of documentary inconsistencies

Real Scenarios: Which Obligation Applies? Practical Examples

• US SaaS selling to EU and UK: Needs representative in both territories. The simplest solution is REP27, covering EU and UK in one request, reducing costs and avoiding inconsistencies. The SaaS receives two certificates, wording for each territory, and synchronized renewal.
• Chinese seller on Amazon Europe: If collecting customer data directly (e.g., email list, own CRM), needs EU representative. If only using marketplace and not processing data outside platform, may be covered. REP27 offers wording and certificate for marketplaces but does not cover large volumes or regulated sectors.
• UK online store selling to France: Needs EU representative but not UK one. REP27 issues EU designation quickly, with French wording included. No UK representative needed if already established there.

Decision by profile: