REP27 · EU representative · Thailand
Article 27 GDPR · Thailand
If your company is established in Thailand and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
The Personal Data Protection Act B.E. 2562 governs processing in Thailand and requires foreign controllers to appoint a local representative. Article 27 is the equivalent duty for the European Union, and one does not satisfy the other.
€10 million or 2%Failing to designate is a standalone infringement under Article 83(4)(a) GDPR — whichever amount is higher. EDPB Guidelines 3/2018 confirm it is a breach in its own right, not a detail.
Tourism and hospitality platforms, food and rubber exporters, e-commerce, and software development for European clients.
Paid or free, physical or digital. Article 3(2)(a) looks at whether you envisage customers in the Union — a language option, a currency or EU shipping is usually enough.
Analytics, profiling, advertising pixels or app telemetry on people located in the Union fall under Article 3(2)(b), even when you never sell to them.
Processors are covered too. Naming a representative is increasingly a condition to pass vendor onboarding with EU customers.
The Personal Data Protection Act B.E. 2562 governs processing in Thailand and requires foreign controllers to appoint a local representative. Article 27 is the equivalent duty for the Union, and one does not satisfy the other.
the Personal Data Protection Committee. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Thai companies reach the Union through tourism and hospitality platforms selling to European travellers, food and rubber exports, e-commerce, and software development for European clients.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The exact Article 13(1)(a) and 14(1)(a) sentence, generated in each language your site uses, ready to paste. Most files stall here, so we remove the step.
Your certificate carries a code. Scanning it opens a page that reads the register live: active, under review, suspended, revoked or expired. Nothing to take on trust.
From the Standard plan we keep the records and produce them to a supervisory authority on request, telling you the same day it happened.
No. The Thai representative answers to the PDPC in Bangkok for foreign companies handling Thai data. The GDPR wants a representative established in a member state, reachable by all 27 authorities.
Article 3(2)(a) attaches at the moment the service is offered to a person in the Union. The booking, not the stay, is what brings you inside the GDPR.
No. That governs transfers out of the Union, a separate question from representation. Thai hospitality groups usually need to think about both.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Thai hospitality files are the clearest example of a European obligation created entirely by a booking engine.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check