REP27 · Services · EU representation
Article 27 · Article 16 · UK GDPR · scope of service
Representation is a small, defined statutory role sold in a market that prefers to sound larger. The result is that buyers cannot compare offers: one provider quotes €290 and another €2,400 for what turns out to be the same one-page designation, with advisory work wrapped around it in the second case. This page states exactly what the service is, what it is not, and the four questions that separate a real provider from an address that forwards post.
Article 27Article 16 GPSRUK GDPRRecord of processingEight languagesFrom €290
The bottom three rows matter more than the top five. A provider that will not tell you plainly what sits outside the scope has not thought about the scope, and you find out during an incident rather than during a sales call.
| Service | Legal source | What you get | Price with us |
|---|---|---|---|
| EU representative | Article 27 GDPR | Contact point in the Union, record of processing, request desk | From €290 a year |
| GPSR responsible person | Article 16 Regulation 2023/988 | Named operator on the label, technical file held, authority cooperation | From €290 a year |
| UK representative | UK GDPR | The same role for the United Kingdom, through REP27 LTD | €100 added to the EU plan |
| All three | Three regulations | Three designations, three certificates, one renewal date | €890 a year |
Letters and emails from supervisory authorities, market surveillance and consumers, at an address published in your privacy notice or printed on your product.
Each request with a date and reference. This is what turns a scattered exchange into a file you can show two years later.
The Article 30 record of processing activities, and for product work the declaration of conformity and technical documentation for ten years.
Acknowledgement within the deadline, in the language the request arrived in. Silence at this stage is recorded as non-cooperation, which is heavier than the original complaint.
To you, the same working day. The substantive decision stays with you: you are the controller, or the manufacturer.
Our answers, for the record: Europe Services, SE, IČO 03571785, registered in Prague since 2018; certificate with a verification code on a public page; requests logged the day they arrive and forwarded the same working day in eight languages; renewal at €240, lower than the entry price.
The statutory role is identical whoever performs it. The price gap comes entirely from what is bundled around it, and it is worth knowing which bundle you are buying.
| Model | Typical price | What you are actually paying for |
|---|---|---|
| Designation only | €250-350 a year | The mandate, the certificate, a working contact point |
| Designation plus tooling | €500-900 a year | A dashboard, templates, sometimes a records tool |
| Compliance package | €1,500-3,000 a year | Advisory hours, gap analysis, policy drafting |
| Law firm retainer | €2,500 and up | Legal advice, with the designation as an add-on |
| Cheapest offers | Under €150 | Usually an address, with nobody committed to answering |
The new designation is signed first, the privacy notice updated the same day, and only then the previous arrangement terminated.
The request log and any correspondence they hold. It belongs to your file, not to theirs.
One paragraph in your privacy notice, and on the label if the product side moves too.
The switch price rather than the full one: €240 for Base, €390 Standard, €690 Multi.
The same 24 hours as a first appointment. The paperwork is identical.
Nothing about why you are leaving. It is not our business and it does not change the price.
This is the scenario the whole service exists for, and it is worth walking through once before you need it. The sequence below is the one we run, and it is the same whether the letter comes from Prague, Dublin or Warsaw.
| Step | What happens | Timing |
|---|---|---|
| Arrival | The letter or email reaches the address published in your privacy notice | Day zero |
| Logging | Recorded with a date and a reference the authority can quote back | Same day |
| Acknowledgement | A procedural reply in the language it arrived in, confirming receipt and the route to you | Same day |
| Forwarding | The full request reaches your inbox with our summary in English | Same working day |
| Records | If the Article 30 record is requested, we produce the copy we hold | Within the deadline |
| Substance | You decide the answer; we transmit it and keep the thread in the file | Your timeline |
Nothing in that sequence requires legal expertise from us, and that is deliberate. The value is that somebody reliably does it, in the right language, within the deadline, and keeps a record that can be produced two years later. Companies that buy on price alone usually discover that the missing part is not advice: it is the first three rows.
A designation is one obligation among several, and it is worth seeing where it sits so you neither overbuy nor assume it covers more than it does.
Being reachable inside the Union, holding the record of processing, cooperating with authorities. That is the statutory perimeter.
Your privacy notice, your lawful bases, your processor contracts, your retention periods, your security measures. Yours to run.
A DPO where Article 37 requires one, and a governance programme in regulated sectors. Different budget, different supplier.
The Article 16 responsible person, technical documentation, CE marking where sector rules apply, and packaging registration per country.
Deciding what you collect and why. The regulation puts that with the controller and leaves it there.
At the edge of the mandate, deliberately, and we say so before you pay rather than after something arrives.
Representation is usually bought by a compliance or operations lead and approved by finance. These are the five questions finance asks, with the answers written for them.
Yes, annual, for as long as you reach the Union without an establishment there. It ends the day either fact changes.
No. It does not scale with revenue, SKUs, marketplaces or number of requests. One designation, one price.
Article 83(4)(a): up to €10 million or 2% of worldwide turnover, plus the commercial cost of failing vendor assessments.
Yes, and we issue separate designations per legal entity on one invoice where a group needs several.
Twelve months, terminable on notice. There is no multi-year commitment and no penalty for leaving.
Selling something means saying when not to buy it. Four situations where representation is the wrong purchase, written plainly because a designation you do not need is waste on your side and churn on ours.
| Situation | Why you do not need it | What to do instead |
|---|---|---|
| You have a real EU establishment | Article 27 applies to controllers outside the Union. Establishment removes the question | Document who the controller is and keep it current |
| You are a public authority | Article 27(2)(b) exempts public authorities and bodies | Nothing, on this point |
| You do not reach the Union | No offering, no monitoring, no Article 3(2) | Write down the analysis and date it |
| You sell only through an EU importer | The importer places the goods on the market and carries the product duties | Check whether the data side still reaches you |
The last row is the one worth reading twice, because it is only half an exemption. An importer takes on the product obligations under Article 16 and nothing at all under Article 27. A manufacturer selling FOB to a European distributor may still be processing the personal data of people in the Union through its own website, its newsletter or its support desk, and that part of the analysis has to be run separately. We would rather tell you that now than sell you a plan and discover the mismatch during an audit.
There is also a fifth case that comes up often enough to name: the company that will need representation in three months but not today, because the European launch has not happened. The correct answer there is to wait. A designation signed before the first EU customer exists is a year of coverage spent on nothing, and the appointment takes 24 hours whenever you are ready.
A written designation under Article 27 GDPR naming a company established in the Union as your contact point for supervisory authorities and data subjects, with the record of processing activities held on your behalf.
No. A consultancy advises you. A representative receives correspondence, holds records and cooperates with authorities. Many companies need both, from different providers.
No, and any provider including it at these prices is not really providing it. We supply the designation, the certificate, the wording and the desk.
Not with one document. It takes two designations from two entities established in the two territories. We issue both, on one invoice.
Only if you buy the Article 16 responsible person as well. Data and products are separate regulations with separate designations.
The Article 30 record listing what you process, why, for whom and with which recipients. The representative holds it and produces it to authorities on request.
Signed within 24 hours of a completed form, with a certificate carrying a verification code and the paragraph for your privacy notice.
We receive, log and forward them the same working day, and answer procedural questions. The substantive decision on each request stays with you as controller.
Eight, which covers the languages requests actually arrive in. A data subject may write in the official language of their own Member State.
No. Article 27(5) preserves proceedings against the controller or processor. Any promise to the contrary describes something the regulation does not permit.
Tell us and we terminate rather than renew. There is no benefit to you in keeping a designation you no longer need.
Yes. Ask and we send the template. It is one page and every clause has a purpose.
Yes, on the same terms. Agencies and software houses processing for EU clients are caught by Article 3(2) directly.
No. A virtual office forwards post. A representative accepts statutory tasks in writing and answers for them.
That a named entity established in the Union has accepted the role for your company, verifiable by a third party without contacting you.
Legal advice, DPO duties, policy drafting, product testing, CE marking, packaging registration and any transfer of your liability.
No. One designation covers your whole catalogue and every European marketplace.
One invoice at the lower renewal price, one expiry date, and a reminder before it falls due rather than after.
Related: how to choose a provider · what it costs
Europe Services, SE in Prague, signed within 24 hours, with a verifiable certificate, the record of processing held for you and a desk that answers in eight languages.
See the plans