REP27 · EU representative · United Kingdom
Article 27 GDPR · United Kingdom
If your company is established in the United Kingdom and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Since Brexit the UK is a third country under the GDPR. If you reach people in the EU you need an EU representative — and separately, companies outside the UK reaching British users need a UK representative under the UK GDPR. The two roles are independent and one never covers the other.
€10 million or 2%Failing to designate is a standalone infringement under Article 83(4)(a) GDPR — whichever amount is higher. The Dutch supervisory authority fined Locatefamily.com €525,000 on this ground alone, adding periodic penalties until it complied.
London fintech, agencies with EU clients, D2C brands selling into Ireland, France and Germany, and SaaS spun out of the UK market.
Paid or free, physical or digital. Article 3(2)(a) looks at whether you envisage customers in the Union — a language option, a currency or EU shipping is usually enough.
Analytics, profiling, advertising pixels or app telemetry on people located in the Union fall under Article 3(2)(b), even when you never sell to them.
Processors are covered too. Naming a representative is increasingly a condition to pass vendor onboarding with EU customers.
The written designation Article 27(1) requires, countersigned by Europe Services, SE and signed electronically under eIDAS.
A certificate with a QR code and a public verification page, so a regulator, a client or a buyer can confirm the designation is live right now.
A dedicated address, inbox and form. Every request from a data subject or an authority is logged and forwarded to you within two business days.
No. A UK representative answers to the ICO under the UK GDPR. For people in the EU you need a representative established in a member state, named under Article 27 of the EU GDPR.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check