Which Companies Need an EU Representative for GDPR?

• GDPR Article 27 requires non-EU companies targeting the EU to appoint a representative.
• The obligation applies to controllers and processors outside the EU under Art. 3(2).
• Excludes public authorities and occasional low-risk processing.
• Fines for non-compliance: up to €10 million or 2% of global turnover.
• The representative must be located in the EU and accept the mandate in writing.
• Comparing prices and services is key: differences and hidden costs exist.

Updated 21 October 2026 · 8 sources checked

Providers compared

Prices as published on each provider's website on 21 October 2026, excluding VAT unless stated. Each row links to its source.

What Does the Law Require? (Articles 3 and 27 GDPR)

The General Data Protection Regulation (GDPR) states in Article 27 that any company or entity established outside the European Union (EU) which, under Article 3(2), offers goods or services to individuals in the EU or monitors their behavior, must appoint a representative in the EU in writing. This representative acts as a contact point for data subjects and data protection authorities and must be established in one of the Member States where affected data subjects reside.

• The obligation applies to both controllers and processors outside the EU.
• The appointment must be formalized in writing and signed by both parties, detailing the scope, duties, and duration of the mandate.
• The representative must keep a record of processing activities (Art. 30 GDPR) and cooperate with authorities when required.
• Exceptions: no representative is required for public authorities or for occasional, low-risk processing that does not involve special categories of data or criminal data.

Failure to appoint constitutes an independent infringement under Article 83(4)(a), punishable by fines up to €10 million or 2% of global annual turnover, whichever is higher. A real example is the €525,000 fine imposed on Locatefamily.com by the Dutch authority for failing to appoint a representative.

The representative does not assume legal responsibility for the processing: this remains with the original controller or processor. Their role is administrative and as a contact point, not legal advisory.

How to Choose an EU Representative: Key Criteria and Comparison

Choosing the right EU representative is crucial to comply with GDPR and avoid penalties. Not all services are equal: some only provide a postal address, while others formally accept the mandate and manage requests and records. Before deciding, consider these aspects:

• Formal appointment: Does the provider explicitly accept the Art. 27 mandate and sign it?
• Record management: Do they maintain and produce the record of processing activities (Art. 30) if requested by an authority?
• Languages supported: Does customer service cover the languages needed for your clients and authorities?
• Additional costs: Are there charges per request, for extra languages, or for renewal?
• Certificates and verification: Do they offer a verifiable certificate and public verification methods?

Service comparison (based on public information from October 2026):

Always request the appointment letter before paying and verify that it accepts all GDPR-required tasks.

What Does the Price Really Include? Fees, Levels, and Hidden Costs

Published prices by EU representative providers can vary widely and do not always reflect the total cost of service. It is essential to analyze what each fee includes and what charges may arise later.

• Base fees: Range from under €300/year to over €2,000/year, depending on whether they only provide an address, a formal appointment, or additional legal services.
• Per-request costs: Some providers charge between €25 and €90 per data subject request handled. This can significantly increase the real cost if you receive many requests.
• Record management: Maintaining and producing the record of processing activities (Art. 30) often costs an additional €100 to €400/year with many providers. REP27 includes this from the Standard plan.
• Languages and support: Multilingual support is rare in basic plans; REP27 covers 8 languages in Standard and Multi.
• Renewals: Some providers increase prices after the first year. REP27 reduces renewal fees from the second year onward.

Practical example: a company receiving 20 requests per year and contracting a plan with per-request fees may end up paying more than double the base price. Always request the contract and calculate the total annual cost before deciding.

Service level summary:

• Postal address only: Mail forwarding only, no formal acceptance or record management.
• Formal appointment: Signed mandate, request and record management, response commitment.
• Legal retainer: Includes legal advice, usually unnecessary for most companies.

How the Appointment Works Step-by-Step: Practical Guide

The process of appointing an EU representative under GDPR must be rigorous and documented. Here is a step-by-step guide to comply properly:

1. Assess the obligation: Confirm if your company is outside the EU and offers goods/services or monitors individuals in the EU.
2. Select a provider: Choose one that explicitly accepts the Art. 27 mandate and is established in the EU.
3. Request the appointment letter: Ask for the draft letter and verify it includes formal acceptance, scope, record management, and response deadlines.
4. Sign and countersign: Sign the appointment; the provider must countersign (REP27 does so within 24 hours).
5. Receive the certificate: The provider must issue a verifiable certificate with QR code and public webpage.
6. Update your privacy policy: Add the representative’s details (name, address, email) in your privacy notice per Art. 13/14 GDPR.
7. Operation: The representative receives, logs, and forwards requests from data subjects and authorities within set deadlines. With REP27, requests are forwarded within 2 working days (or same day for authorities in Standard/Multi).
8. Record management: If included in your plan, the representative maintains the Art. 30 record and provides it to authorities if requested.

Buyer checklist:

1. Does your company offer goods/services or monitor individuals in the EU?
2. Are you located outside the EU?
3. Is the processing more than occasional and not excluded?
4. Request the appointment letter and verify it accepts Art. 27 tasks.
5. Ask about extra costs: requests, languages, renewal.
6. Check if they maintain your Art. 30 record and provide it to authorities.
7. Confirm support in required languages.
8. Review response times to authorities.
9. Sign and publish the representative’s details in your privacy policy.

Risks, Penalties, and Non-Compliance Scenarios

Failing to appoint an EU representative when required is considered an independent infringement under GDPR, punishable by fines up to €10 million or 2% of global annual turnover, per Article 83(4)(a). Authorities can initiate proceedings even without prior complaint, and failure to respond or invalid appointment may worsen consequences.

• Real example: Locatefamily.com was fined €525,000 by the Dutch authority solely for not appointing a representative.
• Invalid mandate: Appointing only a postal address or a provider who does not formally accept the mandate can be worse than no appointment, as a third party is named who will not respond to authorities.
• Liability: The representative does not assume legal responsibility for processing but must fully cooperate with authorities and facilitate communication with the controller outside the EU.

Recommendations to avoid risks:

• Verify the mandate is signed and explicitly accepts Art. 27 tasks.
• Confirm the representative maintains and produces the Art. 30 record if required.
• Do not rely solely on low prices: review the actual service scope and response times.

Non-compliance can damage reputation, ability to operate in the EU, and lead to significant financial penalties.

Decision Matrix: Do You Need an EU Representative?

The following matrix helps determine if your company needs an EU representative under GDPR. Analyze your situation and check if the obligation applies:

Concrete examples:

• A US SaaS allowing EU user registration: Yes, needs a representative.
• A Chinese manufacturer selling products on Amazon to EU customers: Yes, needs a representative.
• A Canadian NGO processing only donor data outside the EU: No representative needed.

What Providers Often Don’t Say: Exclusions, Renewals, and Limits

Many providers omit key details that can affect compliance and the real cost of service. It is essential to read the fine print and ask before contracting:

• Postal address only: Some only offer an EU address without formally accepting the mandate or committing to respond to requests or maintain records.
• Record management: Most do not include managing and delivering the Art. 30 record in the base price; this can be a significant annual cost.
• Limited support: Support is usually English only, even if EU coverage is advertised. REP27 includes 8 languages in Standard and Multi.
• Per-request fees: Charges per request can exceed the annual price if you receive many data subject requests.
• Automatic renewals: Some contracts auto-renew with price increases after the first year. REP27 lowers renewal prices.
• Liability limits: The representative does not assume your legal responsibility nor provide legal advice unless you contract a specific legal plan.
• Excluded activities: REP27 does not accept clients processing special categories, criminal data, high-risk activities, children under 16, scraping, adult content, weapons, cryptocurrencies, or activities requiring licenses.

Always request the contract and verify all points before committing.

Practical Scenarios: Examples of Obligation and Compliance Paths

To illustrate how the EU representative obligation applies, here are three real scenarios and the simplest compliance path:

• US SaaS selling to EU businesses and consumers: Must appoint an EU representative. REP27’s Standard plan covers unlimited requests, support in 8 languages, and record keeping. Add representative data in privacy policy and respond to requests via the desk.
• Chinese seller on Amazon shipping to the EU: Obligation under GDPR Art. 27. If selling CE or GPSR marked products, REP27 Multi also covers GPSR controller and authorized CE representative roles. Add data in listings and product documentation.
• UK online store still selling to the EU: Post-Brexit, needs EU representative and often UK representative. EUverify offers both in one plan; REP27 offers both separately with discounts if contracted together. Add both details in privacy policy and respond per jurisdiction.

In all cases, the appointment must be formal, signed, and reflected in the company’s public and private documentation.