REP27 · EU representative · Panama
Article 27 GDPR · Panama
If your company is established in Panama and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Law 81 of 2019 governs data protection in Panama. It does not discharge Article 27 for a Panamanian company reaching people in the European Union.
€525,000The Dutch supervisory authority fined Locatefamily.com €525,000 for failing to designate an EU representative, and added periodic penalties until the company complied. No other breach was needed.
Logistics and shipping platforms, holding companies with European operations, banking technology, and tourism.
Regulators read the site the way a customer would. Prices in euro, a shipping option to Ireland, a checkout in French: each one is evidence you envisaged the Union.
Store listings available in EU countries, telemetry from European devices and accounts held by people in the Union all bring you inside Article 3(2).
As a processor you are caught in your own right. Your client's designation covers your client, never you.
Law 81 of 2019 governs data protection in Panama, supervised by ANTAI. It does not discharge Article 27 for a Panamanian company reaching people in the European Union.
the Autoridad Nacional de Transparencia y Acceso a la Información. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Panamanian companies reach the Union through logistics and shipping platforms, holding companies with European operations, banking technology, and tourism.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The written designation Article 27(1) requires, countersigned by Europe Services, SE and signed electronically under eIDAS, naming the member states covered.
A certificate with a QR code and a public verification page, so a regulator, a client or a buyer can confirm the designation is live at that moment.
A dedicated address, inbox and form. Every request from a data subject or an authority is logged and forwarded to you within two business days.
If the subsidiary contracts with EU customers and decides the processing, the group is established in the Union for that activity. If the Panamanian entity signs the contracts, Article 27 applies to it.
Consignee contacts, customs declarations, driver details and portal accounts are all personal data. Where those people are in the Union, Article 3(2) can apply.
Not from us, and the file is judged on the processing described, not on the jurisdiction. What we do check is that the activity is not on our excluded list.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Panamanian files are usually about logistics data, which people forget is personal data until a driver asks for a copy of it.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check