Who Needs to Appoint a GDPR Representative in the EU?

• Article 27 GDPR requires most non-EU businesses processing EU data to appoint an EU representative.
• Exemptions: occasional, low-risk processing or activities related to national security/defense.
• The representative must be established in an EU member state where data subjects are located.
• Contact details must be provided to data subjects and authorities.
• Non-compliance can lead to fines up to €10 million or 2% of worldwide turnover.
• Providers offer different levels of service: address only, full mandate, or legal retainer.
• Pricing varies widely; hidden per-request or renewal fees are common.

Updated 16 October 2026 · 8 sources checked

Providers compared

Prices as published on each provider's website on 16 October 2026, excluding VAT unless stated. Each row links to its source.

What Article 27 GDPR Requires

Article 27 of the GDPR establishes a clear obligation: any controller or processor not established in the EU, but subject to Article 3(2) (offering goods or services to individuals in the EU or monitoring their behavior), must appoint a representative in writing in the EU before starting any data processing activities. This rule ensures that EU data subjects and supervisory authorities have a local point of contact for privacy matters, even when the company itself is outside the EU.

There are important exemptions. Article 27 does not apply if:

• Your processing is only occasional, does not include large-scale processing of special categories of data, and is unlikely to pose a risk to the rights and freedoms of individuals.
• Your activities are related to national security or defense.

The representative must be established in one of the EU member states where the data subjects whose data you process are located. The appointment must be made in writing and the representative must be authorized to act on your behalf in relation to GDPR obligations. The representative’s contact details must be provided to both data subjects and supervisory authorities and published in your privacy notice.

Failure to comply is a standalone infringement under Article 83(4)(a), punishable by fines up to €10 million or 2% of worldwide turnover. The Dutch authority fined Locatefamily.com €525,000 for this violation. The representative is not a shield: Article 27(5) clarifies that appointing a representative does not prevent actions against your company itself.

• Included / Not Included / Extra Fees Table

How to Choose a GDPR Representative

Choosing the right GDPR representative is critical for compliance and operational efficiency. Providers offer three main service tiers:

• Tier 1: Address only – A simple mail-forwarding service. No mandate, no records, no GDPR-specific obligations. Cheapest, but not compliant with Article 27 requirements.
• Tier 2: Designation – A written mandate, certificate, request desk, and Article 30 record handling. This is what Article 27 expects: the provider accepts the role and responsibilities in writing, holds records, and commits to forwarding requests within a set timeframe.
• Tier 3: Legal retainer – A law firm acts as representative and also provides legal advice. This is costly and only necessary if you want ongoing legal counsel, which is not part of the Article 27 role.

When comparing providers, ask:

• Does the mandate explicitly accept Article 27 tasks?
• Who holds the Article 30 record and how is it produced to authorities?
• What is the response time for forwarding requests from authorities?
• Are there per-request or renewal fees?
• Is multilingual support available?

Some providers, like REP27, issue a signed designation letter and certificate within 24 hours, with multilingual support and no per-request fees on Standard and Multi plans. Others may charge per request or only provide a forwarding address, which does not meet GDPR requirements.

Decision Matrix:

Always request the provider’s designation template before paying. If it does not list and accept Article 27 tasks, you are not buying a compliant service.

What the Price Really Includes

GDPR representative service prices range from under €300 to well over €2,000 per year. This variation reflects the scope of what is actually provided. A low price may only cover a postal address, while a higher fee may include a full mandate, request desk, and records management. Key inclusions to check:

• Written acceptance of Article 27 tasks: The provider must formally accept the role and obligations in writing.
• Certificate and public verification: A verifiable certificate reassures clients, auditors, and authorities. REP27 provides a QR-coded certificate and public verification page.
• Multilingual request handling: Essential for pan-EU coverage. REP27 offers 8 languages from the Standard plan.
• Article 30 records management: The provider should hold and produce your records to authorities. This is included in REP27’s Standard and Multi plans.
• Per-request fees or renewal increases: Some providers charge €25–€90 per data subject request or increase fees after the first year. REP27’s Standard plan has no per-request charge and renewal prices drop in year two.

Compare what is included in each plan, not just the headline price. For example, REP27’s Base plan covers up to 10 requests per year, while Standard and Multi plans offer unlimited requests and records management. Many competitors do not publish full details or require you to request them.

Always ask for the year-two renewal price in writing, as introductory pricing is common. For companies needing combined EU and UK representation, some providers (including REP27) offer both services, sometimes with a discount.

Hidden Costs and Exclusions

Many providers advertise low annual fees but add significant charges for essential services. Common hidden costs include:

• Per data subject request fees: Some providers charge €25–€90 per request, which can quickly exceed the annual subscription if you receive multiple requests in a month.
• Setup or onboarding fees: One-off fees of €0–€250 are common. REP27 includes setup in the annual fee.
• Additional language support: Entry-level plans may only cover English. REP27’s Standard and Multi plans include 8 languages.
• Article 30 records management: Some providers charge €100–€400 per year to hold and produce records. REP27 includes this in Standard and Multi plans.
• Renewal increases: Some providers raise prices after the first year. REP27’s renewal fees drop to €240/€390/€690 from year two.

Legal advice, DPO services, and compliance audits are not included by REP27 or most competitors. REP27 does not answer requests on the merits; it forwards them to you. The designation does not prevent direct enforcement against your company.

Providers rarely highlight these exclusions and extra fees in their marketing. Always read the mandate and service terms carefully before signing. Ask specifically about per-request charges, renewal pricing, and what happens if you need to change or terminate the service.

How Appointment Works: Step by Step

1. Assess applicability: Determine if you are a non-EU controller or processor subject to Article 3(2) GDPR (offering goods/services to, or monitoring, individuals in the EU).
2. Identify target countries: List the EU member states where your data subjects are located. Your representative must be established in at least one of these countries.
3. Shortlist providers: Compare providers’ published services, pricing, and terms. Request the designation template to ensure it covers Article 27 obligations.
4. Review hidden fees: Ask about per-request charges, onboarding fees, language support, and renewal pricing.
5. Complete onboarding: Fill out the provider’s form, supplying company details, processing scope, and contact information.
6. Receive countersigned mandate: The provider reviews your file and issues a signed designation letter (REP27: within 24 hours). You also receive a certificate and verification code.
7. Update privacy notice: Add the representative’s name, address, and contact details to your privacy notice as required by Article 13(1)(a).
8. Keep compliance records: Retain the signed mandate, certificate, and Article 30 record for audits. Do not publish the full mandate or commercial terms.
9. Ongoing operation: The provider logs and forwards requests from data subjects and authorities within the agreed timeframe. For REP27, this is within two business days (or same day for authorities on Standard/Multi).
10. Renew or terminate: Monitor renewal dates and cancellation terms. REP27 allows cancellation before renewal and provides written confirmation.

This process ensures you meet Article 27 requirements and are prepared for audits or regulatory inquiries.

Risks and Fines for Non-Compliance

Appointing an EU representative is not optional for most non-EU businesses processing EU personal data. The risks of non-compliance are significant:

• Standalone infringement: Failure to appoint a representative is a violation under Article 83(4)(a) GDPR, regardless of whether any data breach has occurred.
• Fines: Supervisory authorities can impose fines up to €10 million or 2% of your total worldwide annual turnover, whichever is higher. For example, Locatefamily.com was fined €525,000 by the Dutch authority for failing to appoint a representative.
• Direct enforcement: Appointing a representative does not shield your company from enforcement or liability. Authorities can still take action against your business directly (Article 27(5)).
• Operational risk: Without a representative, you may be unable to respond to data subject requests or regulatory inquiries in a timely manner, leading to further penalties and reputational harm.

To mitigate these risks, ensure your provider issues a countersigned mandate, holds your Article 30 record (if required), and commits to forwarding requests within a set timeframe. Keep all documentation ready for audits. If your provider cannot act for your business (e.g., due to prohibited activities), they should refund you in full and provide written confirmation, as REP27 does.

What Providers Usually Do Not Say

Many GDPR representative providers do not fully disclose the limitations and exclusions of their services. Common omissions include:

• Mail-forwarding only: Some entry-level offers are just a postal address, not a true Article 27 mandate. These do not meet GDPR requirements.
• Per-request fees: Low annual fees may hide high per-request charges, which can make the service expensive if you receive multiple requests.
• Records not held: Some providers do not hold your Article 30 record, which is required for compliance. Always check who holds and produces the record.
• Automatic renewals and price increases: Many providers raise prices after the first year or automatically renew without clear notice. Always ask for the year-two price in writing.
• Liability limits: The representative is not liable for your GDPR breaches. Article 27(5) makes clear that your company remains fully responsible.
• Termination and handover: Check what happens to pending requests and records if you change or terminate your provider. REP27 specifies written confirmation and handover procedures.

Always read the service description and mandate carefully. Request all terms in writing before committing, and clarify what is included, excluded, and subject to extra fees.

Checklist: How to Appoint a GDPR Representative Today

1. Confirm if you are a non-EU controller or processor subject to Article 3(2) GDPR.
2. Identify which EU countries your data subjects are in.
3. Shortlist providers offering a written Article 27 mandate.
4. Request and review the designation template.
5. Check for hidden fees and renewal terms.
6. Complete onboarding and receive countersigned documents.
7. Update your privacy notice with the representative’s contact details.
8. Keep the signed mandate and certificate for audits.
9. Ensure your Article 30 record is held and accessible if required.
10. Monitor renewal dates and cancellation terms to avoid unwanted charges.

Following this checklist will help you achieve and maintain compliance, avoid fines, and respond efficiently to data subject and authority requests.

Realistic Scenarios: Who Needs What?

• US SaaS selling to EU businesses and consumers: Must appoint an EU representative under Article 27. The Standard plan from REP27 covers all requirements: written mandate, unlimited request forwarding, records management, and multilingual support. Base plan is suitable for low volume, but Standard is recommended for most SaaS.
• Chinese Amazon seller listing on EU marketplaces: Needs both an EU GDPR representative (for data protection) and, for product compliance, a GPSR responsible person. REP27’s Multi plan covers both roles with one order and one renewal date, simplifying compliance for sellers on Amazon, Etsy, or eBay.
• UK online shop with EU customers: After Brexit, UK businesses offering goods or services to the EU must appoint an EU representative. REP27’s Base or Standard plan is suitable, depending on the volume of data subject requests and need for records management. If also selling CE-marked goods, consider the Multi plan for combined representation.

In each scenario, the simplest compliant route is to appoint a provider that issues a signed mandate, holds your records (if required), and provides clear, verifiable documentation for audits and clients.