REP27 · Article 27 · EU rep
EU rep · GDPR rep · Article 27 representative
EU rep, GDPR rep, EU representative, data protection representative, article 27 rep. They all describe the same statutory role, and the abbreviation is doing real damage because it makes the thing sound smaller than it is. An EU rep is a written mandate that puts a named company inside the Union on the receiving end of your regulatory correspondence. This page defines it, lists what it is not, and says plainly who needs one.
EU repGDPR repArticle 27Written mandateAll 27 statesFrom €290
The right-hand column is where the money is wasted. Companies buy a law firm retainer expecting a designation, or buy a designation expecting legal advice, and discover the difference during an incident.
| Term you searched | What it means | Correct? |
|---|---|---|
| EU rep | Article 27 representative | Informal but right |
| GDPR rep | The same thing | Right |
| Data protection representative | Usually the same thing, sometimes a DPO | Ambiguous, ask which |
| EU authorised representative | Product legislation, not the GDPR | Different regime entirely |
| Legal representative | Company law: who signs for the company | Unrelated to data |
| UK rep | The UK GDPR equivalent | A separate appointment |
Letters and emails from supervisory authorities and from data subjects, at an address published in your privacy notice.
Every request with a date and a reference, which is what turns a chaotic exchange into a defensible file.
The Article 30 record of processing activities, produced to authorities on request rather than assembled afterwards.
To you, the same working day. The substantive decision on any request remains yours as controller.
Article 31: answering procedural questions promptly, which is what prevents an escalation about process rather than substance.
Ask for the legal entity and its registration number, and check it in the national register. Ours is Europe Services, SE, IČO 03571785, Prague.
A certificate with a code checkable on a public page. A PDF proves only that a PDF exists.
A data subject writes in their own. An English-only desk turns a request into a complaint about accessibility.
Ask it before the first invoice. Ours drops to €240; several providers move the other way.
Clients ask what they are signing. The designation is short, and every clause exists for a reason.
| Clause | What it does |
|---|---|
| Identification of the controller | Names your legal entity, its registration and its address outside the Union |
| Identification of the representative | Europe Services, SE, IČO 03571785, Prague, established in the Union |
| Scope of the mandate | Article 27 tasks: contact point, record keeping, cooperation with authorities |
| Duration and renewal | Twelve months, renewable, with termination on notice from either side |
| Publication undertaking | You agree to publish the identity of the representative under Article 13(1)(a) |
| What is excluded | Legal advice, DPO duties, decisions on requests, liability transfer |
Form completed, mandate countersigned within 24 hours, certificate issued with a verification code.
Privacy notice updated, the record of processing activities completed with our template and stored.
Requests arrive, are logged and forwarded the same working day; you answer the substance.
One invoice at the lower renewal price, one expiry date, no gap in coverage.
New designation signed first, notice updated the same day, old one terminated after. Never the other way round.
You may no longer need it. We terminate rather than renew something you have outgrown.
A designation is a short document, so the honest way to compare providers is to look at what arrives with it. This is our list, and anything not on it we do not claim to do.
| Item | What it is | Why it matters |
|---|---|---|
| Signed designation | The mandate, countersigned by Europe Services, SE | The document an authority asks for first |
| Certificate with a code | Checkable on a public page | Clients and auditors verify it without contacting you |
| Privacy notice paragraph | Article 13(1)(a) wording, translated | An unpublished designation protects nobody |
| Article 30 template and storage | The record of processing activities | Produced on request rather than written afterwards |
| Request desk in eight languages | Logged, answered, forwarded same working day | A German user writing in German gets German back |
| Renewal at a lower price | €240 instead of €290 | The relationship is worth more to us than the first invoice |
Ask for the name and registration number, then check it in the national register. If the answer is a brand rather than a company, stop.
A representative that disappears mid-year leaves you with a published contact point that no longer answers.
Ask for the process in writing: who logs it, in what language, within how many hours you hear about it.
The only correct answer is no. Article 27(5) settles it, and a provider claiming otherwise is describing something the law does not permit.
A provider that cannot tell you plainly what is outside the scope has not thought about the scope.
Ask before signing. Renewal is where the real price of a cheap first year shows up.
A designation is not void because a lawyer disapproves of it. It stops working for three concrete reasons, all of them avoidable.
Article 13(1)(a) requires the identity of the representative to be given to data subjects. A designation sitting in a folder is invisible to the person the regulation was written for.
A representative that does not respond within a reasonable time is treated as no contact point at all, and the failure is attributed to you.
Small providers wind up, and the published address goes dead without anyone telling the controller. Check that the entity behind your certificate still exists in the national register.
You opened an EU office, or you stopped selling into the Union. Either way the designation should be terminated deliberately rather than left to renew.
An EU rep is a company inside the Union that has signed a mandate to receive your regulatory correspondence, hold your record of processing activities and answer when an authority or a user writes. It does not advise you, does not decide anything for you and does not absorb your liability. It costs €290 a year, takes 24 hours to put in place, and its entire value shows up on one day: the day a letter arrives with your name on it and somebody in Europe has to answer it properly.
If you take one thing from this page, make it the difference between having bought a designation and being able to show one. The first is a receipt. The second is a signed mandate, a published paragraph in your privacy notice, a certificate anyone can verify and a record produced within days rather than written afterwards.
Yes. Both refer to the representative designated under Article 27 GDPR. The short forms are informal, the role is statutory.
No. That term belongs to product legislation, where an authorised representative acts for a manufacturer. Different regulation, different duties.
Only if the DPO is a company established in the Union willing to sign the designation and hold the record. In practice the roles are held separately.
No. It receives, logs and forwards. You remain the controller and you answer the substance.
No. Article 27(5) expressly preserves proceedings against the controller or processor.
No. One designation covers the Union and, through the EEA Agreement, Iceland, Norway and Liechtenstein.
A separate representative established in the UK, under the UK GDPR. Ours is REP27 LTD, company number 17385889.
Legally a natural or legal person established in the Union can. In practice authorities and enterprise buyers expect a company with a verifiable registration.
In your privacy notice, under Article 13(1)(a), with the identity and contact details.
Article 83(4)(a): up to €10 million or 2% of worldwide turnover, and in practice it is discovered while an authority investigates something else.
Yes, whenever Article 3(2) reaches them, on the same terms as controllers.
Signed within 24 hours of a completed form, with the privacy notice wording ready to paste.
Yes, at the switch price. The new designation is signed, the notice updated the same day, the old one terminated afterwards.
Not for us and not for an authority. The representative must be an entity that accepts the role and answers, not an address that forwards post.
No. That is the Article 16 GPSR responsible person, a separate appointment we also provide.
The designation, the certificate, the privacy notice wording, the Article 30 record and a request desk in eight languages.
Related: when the requirement applies · the terminology explained
Europe Services, SE in Prague, active since 2018, signed within 24 hours with a certificate anyone can verify and a desk that answers in eight languages.
See the plans