REP27 · EU representative · Türkiye
Article 27 GDPR · Türkiye
If your company is established in Türkiye and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
KVKK follows the GDPR closely but Türkiye is a third country for EU purposes. Turkish exporters and platforms serving European customers need a representative established in the Union.
27 authorities, no shelterWithout an establishment in the Union you are outside the one-stop-shop. There is no lead authority to negotiate with: any of the 27 whose residents you reach can open a file on its own.
Textile and furniture exporters, e-commerce sellers on European marketplaces, and software houses with EU clients.
Regulators read the site the way a customer would. Prices in euro, a shipping option to Ireland, a checkout in French: each one is evidence you envisaged the Union.
Store listings available in EU countries, telemetry from European devices and accounts held by people in the Union all bring you inside Article 3(2).
As a processor you are caught in your own right. Your client's designation covers your client, never you.
Law 6698, known as KVKK, follows the GDPR closely and the KVKK authority maintains a data controllers registry, VERBIS. None of that touches Article 27: Türkiye is a third country for EU purposes and holds no adequacy decision.
the Personal Data Protection Authority, KVKK. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Turkish companies reach the Union through textile, furniture and white goods exports, marketplace selling into Germany and the Netherlands, tourism platforms, and software houses serving EU clients.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
Article 27(4) asks for someone a regulator can address. You get an address in Prague, an inbox and a form, with a person behind them during European hours.
Enterprise procurement asks for evidence. A verifiable certificate answers it in one line instead of three rounds of email.
Represented company, legal basis, territory, effective date, the processing you declared, both signatures. No template language hiding what was agreed.
It shows you take compliance seriously and it will not hurt. But VERBIS is a Turkish register held by the Turkish authority. Article 27 wants a named entity inside the Union that European authorities and individuals can address directly.
The designation must be in a member state where your data subjects are, and Germany qualifies. Our desk covers all 27 from Prague, which is what supervisory authorities address in practice, and German requests are handled in German.
It affects how you may transfer data out of the Union, not whether you need a representative. The two obligations are independent and both usually apply to Turkish exporters.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Turkish exporters usually meet the obligation through a German or Dutch marketplace account, which is also where the first warning arrives.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check