REP27 · EU representative · Bangladesh
Article 27 GDPR · Bangladesh
If your company is established in Bangladesh and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Bangladesh is still legislating on data protection. In the meantime Article 27 applies in full to any Bangladeshi company offering goods or services to people in the European Union.
27 authorities, no shelterWithout an establishment in the Union you are outside the one-stop-shop. There is no lead authority to negotiate with: any of the 27 whose residents you reach can open a file on its own.
Ready-made garment exporters selling direct to European brands and consumers, IT outsourcing, and leather goods.
A campaign targeted at European users, a European language on the landing page, a local phone number: the test is whether you envisaged those customers, not whether you meant to.
Behavioural analytics on people in the Union is monitoring under Article 3(2)(b). This route catches companies with no European revenue at all.
Tickets, RMA forms and warranty registrations from European customers are personal data you process. B2B does not change that.
Bangladesh is still legislating on data protection. In the meantime Article 27 applies in full to any Bangladeshi company offering goods or services to people in the European Union.
no dedicated authority yet — data protection legislation is still in draft. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Bangladeshi companies reach the Union above all through ready-made garments sold to European brands and increasingly direct to European consumers, plus IT outsourcing and leather goods.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
Article 27(4) asks for someone a regulator can address. You get an address in Prague, an inbox and a form, with a person behind them during European hours.
Enterprise procurement asks for evidence. A verifiable certificate answers it in one line instead of three rounds of email.
Represented company, legal basis, territory, effective date, the processing you declared, both signatures. No template language hiding what was agreed.
If you process personal data of people in the Union — buyer contacts, compliance auditors, staff of your clients — Article 3(2) can still apply. The free check gives you a first answer in ten seconds.
Increasingly yes. Social and environmental audits now sit alongside data questionnaires, and the designation is one of the few items that can be verified independently.
With the records: what you process, for whom, for how long. That single document satisfies most of what a European client asks and is what we hold under Article 30(4).
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Bangladeshi garment exporters are moving from B2B to D2C, and the duty arrives with the first European webshop.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check