REP27 · EU representative · Indonesia
Article 27 GDPR · Indonesia
If your company is established in Indonesia and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Law 27 of 2022 on Personal Data Protection governs processing in Indonesia. It does not discharge Article 27 for an Indonesian company offering goods or services to people in the Union.
27 authorities, no shelterWithout an establishment in the Union you are outside the one-stop-shop. There is no lead authority to negotiate with: any of the 27 whose residents you reach can open a file on its own.
Marketplace sellers, furniture and textile exporters, travel platforms, and software development for European clients.
Paid or free, physical or digital. Article 3(2)(a) looks at whether you envisage customers in the Union — a language option, a currency or EU shipping is usually enough.
Analytics, profiling, advertising pixels or app telemetry on people located in the Union fall under Article 3(2)(b), even when you never sell to them.
Processors are covered too. Naming a representative is increasingly a condition to pass vendor onboarding with EU customers.
Law 27 of 2022 on Personal Data Protection introduced GDPR-style obligations and a supervisory body. It does not discharge Article 27 for an Indonesian company offering goods or services to people in the Union.
the authority created under Law 27 of 2022. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Indonesian companies reach the Union through marketplace selling, furniture and textile exports, travel platforms, and software development for European clients.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
Article 27(4) asks for someone a regulator can address. You get an address in Prague, an inbox and a form, with a person behind them during European hours.
Enterprise procurement asks for evidence. A verifiable certificate answers it in one line instead of three rounds of email.
Represented company, legal basis, territory, effective date, the processing you declared, both signatures. No template language hiding what was agreed.
No. A marketplace is a sales channel, not a designated representative, and it will not answer a supervisory authority for you. Marketplaces increasingly require sellers to name one.
The two are unrelated. Article 27 has applied since May 2018 and does not wait for Indonesian implementation timelines.
Buyer contacts, warranty registrations and portal accounts are personal data of people in the Union. B2B does not remove the duty.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Indonesian sellers usually meet the question through a marketplace compliance check rather than a regulator.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check