REP27 · EU representative · Mexico
Article 27 GDPR · Mexico
If your company is established in Mexico and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
The LFPDPPP governs processing in Mexico. It grants no exemption from Article 27 for companies whose customers are in the European Union.
Visible from outsideThis is the only GDPR duty a regulator can check without an investigation: the absence is written in your own privacy notice, on a page you publish yourself.
Manufacturing exporters, tequila and food brands selling D2C into Europe, and software firms serving Spanish clients.
A campaign targeted at European users, a European language on the landing page, a local phone number: the test is whether you envisaged those customers, not whether you meant to.
Behavioural analytics on people in the Union is monitoring under Article 3(2)(b). This route catches companies with no European revenue at all.
Tickets, RMA forms and warranty registrations from European customers are personal data you process. B2B does not change that.
The Federal Law on Protection of Personal Data Held by Private Parties governs processing in Mexico. The institutional framework has been reorganised in recent years, but none of it changes the European duty.
the national data protection authority under the LFPDPPP. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Mexican companies reach the Union through manufacturing exports, tequila, coffee and food brands selling D2C into Spain and Germany, and software firms serving Spanish-speaking European clients.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
Your electronic signature and ours. Article 27(1) wants it in writing; a one-sided declaration is weaker than most companies assume.
One line of HTML that reads the register in real time: green while the designation is active, red the moment it lapses. Nobody can display a status they no longer hold.
A Greek or Polish data subject writes in their own language. The desk reads it, logs it and forwards it with the deadline already counted.
The designation is made in a member state where your data subjects are, but our desk covers all 27. A customer in Ireland or Germany is handled under the same contract, without a second designation.
Almost always yes: buyer contacts, support accounts, logistics contacts at European companies. Personal data of people in the Union does not become impersonal because the relationship is B2B.
No. Trade agreements do not create adequacy or remove Article 27. The GDPR is not a trade instrument; it follows the person.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Mexico dissolved INAI in 2025 and moved its functions into the federal executive, replacing an autonomous regulator with a ministerial one. For European counterparties this raised rather than lowered the importance of a designation inside the Union: it is the only contact point unaffected by the reorganisation. With the regulator in transition, Mexican companies have found European counterparties asking for external evidence of compliance rather than domestic filings. A verifiable designation, checkable from a code, is the fastest way to supply it.
Affected here: manufacturing and automotive suppliers, agricultural exporters, and software companies serving Spain.
Mexican exporters usually find out through a European buyer's supplier questionnaire, which is the cheapest possible way to find out.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check