REP27 · EU representative · Ukraine
Article 27 GDPR · Ukraine
If your company is established in Ukraine and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Ukraine is aligning its data protection law with the GDPR as part of accession work, but it remains a third country today. Ukrainian companies serving EU clients need a representative in a member state.
€525,000The Dutch supervisory authority fined Locatefamily.com €525,000 for failing to designate an EU representative, and added periodic penalties until the company complied. No other breach was needed.
IT outsourcing and software development for European clients, logistics, and e-commerce serving the diaspora in Poland and Germany.
Paid or free, physical or digital. Article 3(2)(a) looks at whether you envisage customers in the Union — a language option, a currency or EU shipping is usually enough.
Analytics, profiling, advertising pixels or app telemetry on people located in the Union fall under Article 3(2)(b), even when you never sell to them.
Processors are covered too. Naming a representative is increasingly a condition to pass vendor onboarding with EU customers.
Ukraine is aligning its data protection law with the GDPR as part of accession work, and the Ombudsman currently supervises. Until accession, Ukraine remains a third country.
the Ombudsman for Human Rights, pending the new supervisory authority. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Ukrainian companies reach the Union through IT outsourcing and product development for European clients, logistics, and e-commerce serving the diaspora in Poland, Germany and Czechia.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The written designation Article 27(1) requires, countersigned by Europe Services, SE and signed electronically under eIDAS, naming the member states covered.
A certificate with a QR code and a public verification page, so a regulator, a client or a buyer can confirm the designation is live at that moment.
A dedicated address, inbox and form. Every request from a data subject or an authority is logged and forwarded to you within two business days.
Yes. If you decide anything about the processing you are a controller, and even as a pure processor Article 27 applies. Naming a representative is also what unblocks procurement with larger EU clients.
Not yet. Candidate status does not bring a country inside the Union for the purposes of Article 3. Until accession, the designation is required.
It might. Stable arrangements and effective activity in a member state can amount to an establishment, which would remove the Article 27 duty. Tell us the structure and we will look at it before taking a fee.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Ukrainian IT firms often already meet EU standards in practice. The designation is the piece of paper that says so to a procurement officer.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check