REP27 · EU representative · Qatar
Article 27 GDPR · Qatar
If your company is established in Qatar and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Law 13 of 2016 and the QFC data protection regulations govern processing in Qatar. Neither substitutes Article 27 for a company reaching people in Europe.
Visible from outsideThis is the only GDPR duty a regulator can check without an investigation: the absence is written in your own privacy notice, on a page you publish yourself.
Energy technology, sports and events platforms, hospitality, and financial services in the QFC.
Paid or free, physical or digital. Article 3(2)(a) looks at whether you envisage customers in the Union — a language option, a currency or EU shipping is usually enough.
Analytics, profiling, advertising pixels or app telemetry on people located in the Union fall under Article 3(2)(b), even when you never sell to them.
Processors are covered too. Naming a representative is increasingly a condition to pass vendor onboarding with EU customers.
Law 13 of 2016 governs the mainland and the QFC has its own data protection regulations. Neither substitutes Article 27 for a company reaching people in Europe.
the Compliance and Data Protection Department, with the QFC Data Protection Office in the financial centre. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Qatari companies reach the Union through energy technology, sports and events platforms with European audiences, hospitality, and financial services in the QFC.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
Your electronic signature and ours. Article 27(1) wants it in writing; a one-sided declaration is weaker than most companies assume.
One line of HTML that reads the register in real time: green while the designation is active, red the moment it lapses. Nobody can display a status they no longer hold.
A Greek or Polish data subject writes in their own language. The desk reads it, logs it and forwards it with the deadline already counted.
QFC regulations govern processing inside the centre and are enforced by its own office. The GDPR applies because of where your customers are located, and asks for a representative inside the Union.
Streaming analytics, ticketing accounts and app telemetry on people in the Union all fall under Article 3(2). Either limb — offering services or monitoring — is enough on its own.
No. That affects how you may transfer data out of the Union, not whether you need a representative. Both questions usually arise together for Qatari platforms.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Qatar was the first Gulf state to pass a general data protection law. Separately, the Qatar Financial Centre operates its own data protection regulations for entities licensed there, so a company may sit under one regime or the other depending on where it is incorporated. Neither reaches into the Union.
A company licensed in the Qatar Financial Centre applies the QFC data protection regulations rather than the federal law, so two Qatari companies can face different domestic rules. Both face the same European rule.
Qatar holds no adequacy decision, so transfers from the Union need Standard Contractual Clauses and a transfer impact assessment. The representative is required on top of them, not instead.
| Question | Answered at home | Answered by Article 27 |
|---|---|---|
| Who supervises us domestically | the National Cyber Security Agency | No |
| Who a person in Spain writes to | No | Your representative in the Union |
| Where the Article 30 record sits | No | Inside the Union |
The companies caught are usually energy and LNG suppliers, construction and engineering contractors, and airlines and hospitality groups selling to European travellers.
Qatari files often come from events and hospitality, where the European audience is seasonal but the data is not.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check