REP27 · EU representative · Taiwan
Article 27 GDPR · Taiwan
If your company is established in Taiwan and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
The Personal Data Protection Act governs processing in Taiwan. It does not discharge Article 27 for a Taiwanese company selling into the European Union.
€525,000The Dutch supervisory authority fined Locatefamily.com €525,000 for failing to designate an EU representative, and added periodic penalties until the company complied. No other breach was needed.
Semiconductors and electronics, bicycle and machinery exporters, e-commerce, and B2B software with European resellers.
One sale might be occasional. A product that European customers can buy today, tomorrow and next month is not, and Article 27(2)(a) does not apply.
Many files start with a product built for a home market that quietly acquired European users. Intent is not the test; the presence of the users is.
European controllers are audited on their processors. That is why the designation appears in questionnaires before it appears in enforcement.
The Personal Data Protection Act governs processing in Taiwan, and a dedicated commission is being stood up to enforce it. Neither discharges Article 27.
the Personal Data Protection Commission, newly established. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Taiwanese companies reach the Union through semiconductors and electronics, bicycle and machinery exports, e-commerce, and B2B software sold through European resellers.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The written designation Article 27(1) requires, countersigned by Europe Services, SE and signed electronically under eIDAS, naming the member states covered.
A certificate with a QR code and a public verification page, so a regulator, a client or a buyer can confirm the designation is live at that moment.
A dedicated address, inbox and form. Every request from a data subject or an authority is logged and forwarded to you within two business days.
Often yes: buyer contacts, support accounts, warranty registrations, engineering portals. If any of those people are in the Union, Article 3(2) applies.
It affects transfers out of the Union, not representation. Both questions typically arise for Taiwanese suppliers with European customers.
It is a separate duty under Regulation (EU) 2019/1020, which requires an authorised representative in the Union for many CE-marked goods. Our Multi plan covers it alongside Article 27.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Taiwan amended its Act in 2023 to create an independent commission after a constitutional court ruling found the previous arrangement inadequate. An adequacy assessment has been discussed for years without conclusion, so Taiwanese companies remain third-country controllers in the meantime.
Taiwanese hardware brands selling direct to European consumers through their own storefronts are within Article 3(2) from the first order, and their European distributors are usually the ones to raise it.
Taiwan holds no adequacy decision, so transfers from the Union need Standard Contractual Clauses and a transfer impact assessment. The representative is required on top of them, not instead.
The test in Article 3(2) has no revenue floor. A European landing page, a euro price at checkout or an advertising pixel firing for visitors in the Union is enough, whether or not anything has been sold. In practice the businesses that reach that line here are semiconductor and electronics manufacturers, bicycle and machinery exporters, and hardware brands selling direct to European consumers.
Taiwanese hardware exporters usually need two of our three roles at once, which is why Multi is the common choice here.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check