Who Needs a Data Protection Officer for the EU? Providers & Prices 2026

• DPO obligation: Public authorities or large-scale monitoring/special data (Art. 37 GDPR)
• EU representative under Art. 27 GDPR for non-EU companies with EU customers or users
• Fines up to €10 million or 2% of global turnover for violations (Art. 83 GDPR)
• REP27: EU representative for the entire EEA from €290/year, incl. certificate & more
• Scope of services and additional fees vary greatly between providers
• Not everyone needs a DPO or EU representative – see decision matrix

Updated 19 October 2026 · 6 sources checked

Providers compared

Prices as published on each provider's website on 19 October 2026, excluding VAT unless stated. Each row links to its source.

What Does the GDPR Require? (Articles 27, 37, 83)

The General Data Protection Regulation (GDPR) distinguishes between two key roles: the Data Protection Officer (DPO) and the EU representative. These obligations apply to different companies and situations:

• Data Protection Officer (DPO, Arts. 37-39): A DPO is mandatory for public authorities and companies whose core activities include extensive, systematic monitoring of individuals or large-scale processing of special categories of personal data (e.g., health data, political opinions). The DPO's tasks are defined in Art. 39 GDPR and include advising, monitoring compliance, acting as a contact point for authorities and data subjects, and supporting data protection impact assessments.
• EU Representative (Art. 27): Companies outside the EU offering goods or services to individuals in the EU or monitoring their behavior (e.g., tracking, analytics) must appoint a written EU representative. The representative acts as a contact point for supervisory authorities and data subjects and maintains the record of processing activities (Art. 30), if the provider takes on this task.

The obligation to appoint an EU representative does not apply if processing is occasional, does not involve special data, and poses no risk to the rights and freedoms of data subjects. Many small companies do not need a DPO as long as they do not perform large-scale monitoring or process special categories of data.

Fines: Failure to appoint an EU representative can result in fines of up to €10 million or 2% of global annual turnover (Art. 83(4) GDPR). For example, the Dutch supervisory authority fined Locatefamily.com €525,000 for lacking an EU representative.

The obligation to appoint a DPO is regulated in Art. 37 GDPR (source), the tasks in Art. 39 (source), and the fines in Art. 83 (source).

How to Choose the Right Provider? Key Criteria & Comparison

Selecting a suitable EU representative or DPO service provider is crucial for compliance. Offers vary significantly in scope, response times, and hidden costs. Consider the following criteria:

• Does the provider accept the tasks under Art. 27 GDPR in writing? A genuine mandate must explicitly cover the duties under Art. 27. A mere mailbox or address is insufficient.
• Who maintains the Art. 30 register? GDPR requires the representative to make the record of processing activities available on request. Not all providers take on this task.
• Response times to inquiries: How quickly are requests from authorities or data subjects forwarded? A "best-efforts" promise without deadlines is risky. REP27 guarantees forwarding within 2 working days (standard: same day for authority requests).
• Languages: Are inquiries handled in multiple EU languages? REP27 offers a desk in 8 languages, many entry-level offers only in English.
• Additional fees: Are all services included in the price, or are there extra charges per request, per language, or for maintaining the register?

A direct comparison:

Always request the designation letter and verify that the duties under Art. 27 are explicitly accepted. Get the service scope and cost structure confirmed in writing beforehand.

What's Included in the Price? Where Are Hidden Costs?

Pricing models for EU representatives and DPO services vary widely. Many providers lure with low entry prices but charge additional fees for each data subject or authority request (typically €25–90 per request). Maintaining the Art. 30 register is often extra (€100–400/year). With REP27, from the Standard tariff, all requests are included, the register is maintained, and there are no hidden fees. Check especially:

• Whether the price covers per request or unlimited requests
• Whether the Art. 30 register is included
• Whether renewal is more expensive (REP27 prices decrease on renewal)
• Whether additional languages cost extra

Some providers offer only a postal address without genuinely taking on legal duties. This is non-compliant and can lead to fines. The following overview shows typical price traps:

Read the fine print and request a full service overview before committing.

How Does the Appointment Process Work? Step-by-Step Guide & Decision Matrix

The appointment of an EU representative or DPO with reputable providers follows a clear process. This ensures you meet all legal requirements:

1. Check if you need an EU representative or DPO (see matrix below).
2. Compare providers and request the designation letter for review.
3. Complete the onboarding form (company info, data processing, contacts).
4. Receive countersignature and certificate (REP27 within 24 hours).
5. Publish the representative's contact details in your privacy policy (Art. 13/14 GDPR).
6. Maintain the Art. 30 register (or have the provider maintain it).
7. If needed: perform the free Swiss representation check (REP27).

Decision matrix:

This matrix helps avoid wrong investments and choose the right compliance solution precisely.

Checklist for today:

1. Check if you fall under Art. 27 or Art. 37 GDPR.
2. Compare at least three providers (scope, price, additional fees).
3. Request the designation letter and verify task acceptance.
4. Ask about maintaining the Art. 30 register and response times.
5. Order the service and document the appointment.
6. Update your privacy policy and internal processes.

What Providers Often Don’t Say: Exclusions, Termination, Liability

Many providers omit important details in marketing that are crucial in practice:

• No legal advice: An EU representative may not provide legal advice as part of the representation. Legal questions require a separate lawyer or DPO.
• Liability remains with the client: Under Art. 27(5) GDPR, liability for data protection violations always remains with the controller or processor. The representative is only a contact point and not liable for client errors.
• Termination periods and automatic renewal: Termination policies vary. REP27 allows termination with 30 days’ notice before renewal. Check how requests and registers are handed over.
• Per-request fees: Many providers charge extra fees per data subject or authority request, stated in the fine print. REP27 Standard and Multi include all requests.
• Languages and desk: A service advertised EU-wide is often only available in English. REP27 offers a desk in 8 languages, easing legal compliance.
• No assumption of special product responsibility: The role as GPSR responsible person or CE authorized representative is only included in REP27 Multi tariff, not Base.

Read the terms and designation letter carefully. Check if the provider guarantees handover of documents in case of provider change.

Three Realistic Scenarios: How to Comply Correctly

1. US SaaS provider with EU customers: A US software company offers a cloud solution to EU customers. It does not process special data but monitors user activity (e.g., logins, usage stats). Result: EU representative under Art. 27 GDPR is mandatory. A DPO is only required for large-scale monitoring or special data processing. The cheapest compliant solution: REP27 Standard – all requests included, register maintained, desk in 8 languages.
2. Chinese Amazon seller: A seller from China sells via Amazon.de to EU customers. They need an EU representative (Art. 27 GDPR) and possibly a GPSR responsible person for product compliance. A DPO is not required as long as no large-scale monitoring or special data processing occurs. The complete solution: REP27 Multi – EU representative and GPSR responsible person in one contract, one contact, one certificate.
3. UK online shop without EU customers: A UK webshop sells exclusively to UK customers and does not process data of EU citizens. Result: No obligation to appoint an EU representative or DPO. Obligations arise only when targeting or delivering to EU customers.

These scenarios show the importance of reviewing your business model. Anyone targeting EU customers or monitoring their behavior must appoint an EU representative – regardless of company size.