REP27 · EU representative · Saudi Arabia
Article 27 GDPR · Saudi Arabia
If your company is established in Saudi Arabia and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
The Personal Data Protection Law and its implementing regulations govern processing in the Kingdom, and require a foreign controller to appoint a local representative. None of that discharges Article 27, which looks at your customers in the Union.
Article 27(5)The designation does not shield you. Actions can still be brought against your company directly. Anyone selling a representative as protection is selling something the regulation does not contain.
Technology and giga-project suppliers, e-commerce, education platforms, and companies serving European partners.
Regulators read the site the way a customer would. Prices in euro, a shipping option to Ireland, a checkout in French: each one is evidence you envisaged the Union.
Store listings available in EU countries, telemetry from European devices and accounts held by people in the Union all bring you inside Article 3(2).
As a processor you are caught in your own right. Your client's designation covers your client, never you.
The Personal Data Protection Law and its implementing regulations govern the Kingdom, supervised by SDAIA, and require foreign controllers to appoint a local representative. That duty mirrors Article 27 without satisfying it.
the Saudi Data and Artificial Intelligence Authority. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Saudi companies reach the Union through technology and giga-project suppliers, e-commerce, education platforms, and companies serving European partners and contractors.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The designation letter, the records under Article 30(4), the log of every request received and when it was forwarded. Assembled as you go, not reconstructed under pressure.
Valid until a date, verifiable by code, and it stops showing as active the day it lapses. That is what makes the status worth something.
Article 27 alone, or with the GPSR responsible person and the CE authorised representative on the Multi plan. One renewal date for all of it.
No. The PDPL wants a representative in the Kingdom for foreign entities processing Saudi data. The GDPR wants one in the Union for you. Same structure, opposite direction.
Personal data of employees and contact persons at European companies is still personal data. B2B does not remove Article 3(2), it only changes who the data subjects are.
If none of your data subjects are in the Union, Article 3(2) does not apply and you need nothing from us. Run the free check and we will say so plainly.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Saudi files are growing quickly, mostly from suppliers to European engineering firms who are asked for the designation during onboarding.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check