REP27 · EU representative · Egypt
Article 27 GDPR · Egypt
If your company is established in Egypt and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Law 151 of 2020 governs personal data in Egypt. It does not exempt an Egyptian company from Article 27 when it offers goods or services to people in the European Union.
Visible from outsideThis is the only GDPR duty a regulator can check without an investigation: the absence is written in your own privacy notice, on a page you publish yourself.
IT outsourcing and development for European clients, textile and furniture exporters, tourism operators, and logistics.
Paid or free, physical or digital. Article 3(2)(a) looks at whether you envisage customers in the Union — a language option, a currency or EU shipping is usually enough.
Analytics, profiling, advertising pixels or app telemetry on people located in the Union fall under Article 3(2)(b), even when you never sell to them.
Processors are covered too. Naming a representative is increasingly a condition to pass vendor onboarding with EU customers.
Law 151 of 2020 governs personal data in Egypt and provides for a dedicated centre and a licensing regime. It does not exempt an Egyptian company from Article 27.
the Personal Data Protection Center. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Egyptian companies reach the Union through IT outsourcing and development for European clients, textile and furniture exports, tourism operators, and logistics along the Suez corridor.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
Your electronic signature and ours. Article 27(1) wants it in writing; a one-sided declaration is weaker than most companies assume.
One line of HTML that reads the register in real time: green while the designation is active, red the moment it lapses. Nobody can display a status they no longer hold.
A Greek or Polish data subject writes in their own language. The desk reads it, logs it and forwards it with the deadline already counted.
Yes. As a processor caught by Article 3(2) the duty is yours, and it is also what unblocks procurement with larger EU clients who check the supply chain.
It governs data leaving Egypt. Article 27 governs who answers inside the Union. Two different directions, two different regulators, both usually relevant.
Article 3(2)(a) covers the offer made to a person in the Union. The booking is where the GDPR attaches, regardless of where the holiday takes place.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Egyptian outsourcing firms usually arrive with a European client already asking the question, which makes the review straightforward.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check