REP27 · EU representative · Pakistan
Article 27 GDPR · Pakistan
If your company is established in Pakistan and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Pakistan has no comprehensive data protection act in force yet, which makes Article 27 more relevant, not less: nothing at home offsets the European duty.
Article 27(5)The designation does not shield you. Actions can still be brought against your company directly. Anyone selling a representative as protection is selling something the regulation does not contain.
IT outsourcing and software houses serving European clients, textile exporters, surgical instruments, and sports goods.
Paid or free, physical or digital. Article 3(2)(a) looks at whether you envisage customers in the Union — a language option, a currency or EU shipping is usually enough.
Analytics, profiling, advertising pixels or app telemetry on people located in the Union fall under Article 3(2)(b), even when you never sell to them.
Processors are covered too. Naming a representative is increasingly a condition to pass vendor onboarding with EU customers.
Pakistan has no comprehensive data protection act in force, which makes Article 27 more relevant, not less: nothing at home offsets or duplicates the European duty.
no dedicated authority yet — the Personal Data Protection Bill is still pending. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Pakistani companies reach the Union through IT outsourcing and software houses serving European clients, textile exports, surgical instruments from Sialkot, and sports goods.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The designation letter, the records under Article 30(4), the log of every request received and when it was forwarded. Assembled as you go, not reconstructed under pressure.
Valid until a date, verifiable by code, and it stops showing as active the day it lapses. That is what makes the status worth something.
Article 27 alone, or with the GPSR responsible person and the CE authorised representative on the Multi plan. One renewal date for all of it.
Yes. The GDPR applies by reason of where your customers are, not by reason of your local law. Article 3(2) catches you regardless of what Pakistan legislates or when.
It is usually the first concrete item they can verify. A certificate with a public status page answers the question without a call.
Buyer contacts, distributor staff and regulatory correspondence are personal data. Products carrying CE marking may also require an authorised representative, which our Multi plan covers.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Pakistani software houses are a large and growing group, and the absence of a domestic law makes the European document the only one they can show.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check