REP27 · Article 27 · EEA
EEA Agreement · Article 27 GDPR · thirty countries
Most providers sell you the Union. The GDPR was incorporated into the EEA Agreement in July 2018, which means Iceland, Norway and Liechtenstein apply it as their own law and your Article 27 designation reaches data subjects there without a second contract. That is the good news, and it is worth having in writing. The part that costs people money is the opposite mistake: assuming the same designation stretches to the United Kingdom, Switzerland or Turkey. It does not, and no wording can make it.
EU 27IcelandNorwayLiechtensteinDatatilsynetPersónuverndOne designation
The word "Europe" is doing a lot of damage in compliance documents. There are three distinct groups, they follow different statutes, and a designation written for one is worth nothing in the others.
Iceland, Norway and Liechtenstein are not Member States. They participate in the internal market through the EEA Agreement, and Union acts relevant to that market are incorporated into it by decision of the EEA Joint Committee. The GDPR was incorporated on 6 July 2018 and entered into force for the three states on 20 July 2018.
The regulation applies there as national law rather than directly, but the obligations are identical. Article 27 reads the same in Reykjavik as in Rome.
Datatilsynet in Norway, Persónuvernd in Iceland and the Datenschutzstelle in Liechtenstein supervise their territories and can write to your representative.
The consistency mechanism works differently for EEA states, and a controller outside the Union has no lead authority in any case.
Article 27(3) asks for establishment in a Member State where your data subjects are. Nothing requires a separate representative in Oslo.
The request is logged and forwarded to you the same working day, in Norwegian if that is how it arrived. Nothing about the procedure changes because the sender is outside the Union.
The representative holds them and makes them available. This is the part first-time clients have never prepared, and it is the part authorities ask for first.
If the notice names only "the European Union", they reasonably conclude the contact point is not for them. Naming the EEA removes the doubt and the complaint that follows it.
They ask for the designation and a way to verify it. A certificate with a verification code settles it without an exchange of emails.
This is the section worth printing. Every line below is a separate appointment with a separate provider, and no Article 27 designation reaches any of them.
| Territory | Law that applies | What it requires from a foreign company |
|---|---|---|
| United Kingdom | UK GDPR | A representative established in the UK. Ours is REP27 LTD, company number 17385889 |
| Switzerland | Revised Federal Act on Data Protection | A Swiss representative for certain controllers; no EU provider can act |
| Turkey | KVKK | VERBIS registration and a local representative, unrelated to Article 27 |
| Serbia, Albania, North Macedonia | National laws modelled on the GDPR | Local representation where the national law requires it |
| Andorra, Monaco, San Marino | National law, adequacy in some cases | Adequacy concerns transfers, not representation |
Article 13(1)(a) requires the identity and contact details of the representative to be given to data subjects. The wording below is what we supply, and the reason for its shape is that a reader in Bergen should not have to interpret it.
A paragraph naming Europe Services, SE, the Prague address, the request email and the words "European Economic Area", translated into the languages you publish in.
Because it is narrower than your coverage, and a Norwegian data subject reading it has grounds to say they were not told who to contact.
In the privacy notice itself, not in the terms of sale and not only in a cookie banner. Authorities look at the notice.
Naming a representative you have not appointed in writing. An unsigned arrangement published as fact is worse than silence.
The theory is settled; what clients ask is what happens on the day. The sequence below is the one we have run, and it is identical whether the authority sits in an EEA state or a Member State.
| Step | What arrives | What the representative does |
|---|---|---|
| 1 | A letter or email to the address published in your privacy notice | Logged the day it arrives, with a reference the authority can quote |
| 2 | A request for the record of processing activities | The Article 30 record we hold is produced within the deadline |
| 3 | Questions about a specific data subject | Forwarded to you the same working day; the substantive answer stays yours |
| 4 | A deadline, usually short | Acknowledged immediately, which is what prevents an escalation on procedure alone |
| 5 | Follow-up or closure | Filed with the designation, so a later audit sees a complete trail |
The failure mode we see in companies that appointed a cheap provider is silence at step one. An address that nobody reads produces a finding of non-cooperation, which is heavier than the original complaint and easier to prove.
If the designation says "European Union" only, ask for it to be reissued. It costs nothing to correct now and is awkward to explain later.
A PDF proves that a PDF exists. A certificate with a code checkable on a public page is what enterprise procurement and authorities accept.
A data subject may write in their own language. A desk that replies only in English turns a routine request into a complaint about accessibility.
Ask the renewal price before the first invoice. Ours is lower than the entry price; several providers move in the other direction.
Yes. The regulation was incorporated into the EEA Agreement in July 2018 and applies in the three states as national law. The text of Article 27 is the same as in the Union.
Yes, for data subjects in those thirty. What matters under Article 27(3) is that the representative is established in a Member State where your data subjects are; nothing requires an office in Oslo as well.
It can. Each EEA authority supervises its own territory and may address the representative as the contact point, in addition to or instead of you.
No. It left the Union in 2020 and the EEA Agreement with it. UK data subjects are covered by the UK GDPR, which requires a separate representative established in the United Kingdom.
No. Switzerland is not in the EEA. The revised Federal Act on Data Protection applies there and asks for a Swiss representative in defined cases; no EU-established provider can perform that role.
Outside both. Turkish law requires VERBIS registration and, for foreign controllers, a local representative. The customs union between Turkey and the Union does not affect data protection at all.
EEA, when your coverage is EEA-wide. Naming only the Union understates it and gives a Norwegian or Icelandic data subject a reason to say they were not told who to address.
No. Article 27 asks for one designation. Providers selling per-country representation inside the EEA are selling something the regulation does not ask for.
Whichever the data subject chooses. In practice we see Norwegian, Icelandic, English and German for these three states; the desk answers in eight languages.
No. Product safety is a separate regulation with its own responsible person under Article 16. A company shipping physical goods usually needs both.
Article 3(2) has no threshold. If you offer goods or services to them or monitor their behaviour, the obligation exists regardless of how many they are.
Only if that distributor is established in the Union or the EEA and has signed a designation accepting the role. A commercial relationship is not an appointment.
The opposite. A designation made before 2021 covers the Union and the EEA, and stopped covering the United Kingdom when it left. Most companies discover this during an audit.
Within 24 hours of a completed form: signed designation, certificate with a verification code, and the privacy notice paragraph ready to publish.
No. It is the same designation at the same price, from €290 a year. The coverage comes from the EEA Agreement, not from an add-on.
Incorporation decisions are published and take effect on a stated date. If a future act changes the position, the designation is amended and reissued rather than replaced.
Related: which Member State to designate in · covering the United Kingdom as well
Europe Services, SE in Prague as your Article 27 representative for the whole European Economic Area, appointed within 24 hours, with a verifiable certificate and a request desk in eight languages.
See the plans