REP27 · EU representative · New Zealand
Article 27 GDPR · New Zealand
If your company is established in New Zealand and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
New Zealand holds an adequacy decision and the Privacy Act 2020 applies domestically. Neither removes the Article 27 duty for companies targeting people in the Union.
€10 million or 2%Failing to designate is a standalone infringement under Article 83(4)(a) GDPR — whichever amount is higher. EDPB Guidelines 3/2018 confirm it is a breach in its own right, not a detail.
Agritech, tourism operators selling to European travellers, SaaS, and premium food and wine exporters.
Regulators read the site the way a customer would. Prices in euro, a shipping option to Ireland, a checkout in French: each one is evidence you envisaged the Union.
Store listings available in EU countries, telemetry from European devices and accounts held by people in the Union all bring you inside Article 3(2).
As a processor you are caught in your own right. Your client's designation covers your client, never you.
The Privacy Act 2020 governs processing in New Zealand and the Privacy Commissioner enforces it. New Zealand holds an adequacy decision with the Union, again about transfers.
the Office of the Privacy Commissioner. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
New Zealand companies reach the Union through agritech and dairy technology, tourism operators selling to European travellers, SaaS, and premium food and wine exporters.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The exact Article 13(1)(a) and 14(1)(a) sentence, generated in each language your site uses, ready to paste. Most files stall here, so we remove the step.
Your certificate carries a code. Scanning it opens a page that reads the register live: active, under review, suspended, revoked or expired. Nothing to take on trust.
From the Standard plan we keep the records and produce them to a supervisory authority on request, telling you the same day it happened.
Article 27(2)(a) exempts occasional, low-risk processing without special categories of data — genuinely occasional, not merely small. Continuous sales through a website do not qualify, whatever the volume.
It governs how you handle their data under New Zealand law. It does not give a European regulator someone to write to inside the Union, which is what Article 27 is for.
Requests are logged in Prague during European hours and reach you with the deadline already calculated. You wake up to a forwarded request with the date it is due, not to a surprise.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
New Zealand received adequacy in 2012 and the Privacy Act 2020 modernised the regime with mandatory breach reporting and compliance notices. Its information privacy principle 12 governs disclosure abroad, mirroring in the other direction what the GDPR asks of European exporters.
New Zealand exporters often assume distance is protection. It is not a factor in Article 3(2): a website that ships to Europe and prices in euros is directed at people in the Union whether the warehouse is in Auckland or Antwerp.
New Zealand holds an adequacy decision, adopted in 2012. Adequacy governs transfers into the country and leaves contactability untouched — which is the whole subject of Article 27.
The test in Article 3(2) has no revenue floor. A European landing page, a euro price at checkout or an advertising pixel firing for visitors in the Union is enough, whether or not anything has been sold. In practice the businesses that reach that line here are wine and food exporters, SaaS companies with European customers, and tourism operators marketing to Europe.
New Zealand files are small in number and unusually well documented. The Privacy Act 2020 habits carry over almost intact.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check