Article 27 GDPR · Amazon sellers
Since December 2024 Amazon has trained a generation of sellers to treat compliance as something the platform tells you about. Fill the responsible person fields and the buy box comes back. That reflex is the problem: the second obligation, the Article 27 GDPR representative, has no field, no dashboard and no suppression — and it is the one enforced by authorities that issue fines rather than by a platform that hides listings.
Buyer messagingOrder reportsReturnsOff-Amazon marketingBrand storeYour own site
Amazon collects what protects Amazon. Its compliance dashboard is a marketplace obligation under Article 22 of the GPSR, not a compliance service for your business, and it is silent about every duty that does not affect the platform's own exposure.
| Article 16 GPSR | Article 27 GDPR | |
|---|---|---|
| Protects | Product safety | Personal data |
| Enforced by | Market surveillance, and Amazon | Supervisory authorities |
| Visible failure | Listing suppressed within days | None, until a complaint or an audit |
| Where it appears | Label, packaging, Seller Central | Privacy notice, Article 30 records |
| Maximum exposure | Withdrawal, recall, national penalties | €10 million or 2% of worldwide turnover |
Sellers buy the first because the pain is immediate. The second is bought by sellers who have met an authority once, or by those whose wholesale buyers started asking.
A named EU operator for the label and the Seller Central fields, signed within 24 hours.
A representative for the customer data, published in your privacy notice and reachable in eight languages.
The Multi plan covers the two roles on a single form, a single invoice and a single renewal date.
Declaration of conformity and technical file for ten years on the product side; Article 30 record on the data side.
Set out in the order a seller actually experiences it, the two obligations stop looking like a legal distinction and start looking like a calendar.
| Stage | What Amazon asks | What the law adds |
|---|---|---|
| Account opening | Identity, bank details, tax data | Nothing yet |
| First European listing | Responsible person details | The same details on the product itself |
| First European order | Nothing | You become controller of that buyer's data |
| First download of order reports | Nothing | Processing in your own systems, your retention decision |
| First marketing to past buyers | Nothing | Consent, notice, and a representative to name in it |
| First deletion request | Nothing | One month to answer under Article 12(3) |
Four of the six rows are invisible to the platform. That is the entire argument of this page.
Usually through the platform, asking for deletion or for a copy of their data. The clock starts on receipt.
Marketplace messaging is treated as customer service, and data requests arriving there are the most commonly missed.
Which is national, free of charge, and in their own language.
And finds either a name it can write to, or a third-country seller with no contact point in the Union.
The unanswered request is the complaint. The absent designation is what makes it an easy case.
Amazon polices your products and ignores your data. The product side gets fixed because it hurts immediately; the data side gets fixed by sellers who have met an authority, or whose wholesale buyer asked. Both designations are the same onboarding form and one invoice, and together they cost less than a week of advertising on the account you are protecting.
A seller shipping to both the Union and the United Kingdom needs two designations under two separate instruments, because since Brexit the UK GDPR stands on its own. They are issued as a pair, on one renewal date, so a lapse in one cannot happen quietly while the other stays live.
Less than most expect, and none of it needs a lawyer: your company details and registration number, the European marketplaces you sell on, a short description of what customer data you handle outside the platform, and the address of any website or brand store you run. That is enough to sign the designation, assemble the Article 30 record and produce the paragraph for your privacy notice.
Legal name, number and address in your own country, as they appear in your national register.
Which European sites you sell on, so the scope of the designation matches reality.
Reports, marketing lists, returns handling, support tools. This becomes the substance of your record.
Where the representative has to be published, and where an authority will look first.
For what stays inside the platform Amazon has its own role, but from the moment you download reports, message buyers, handle returns or market to past customers, you determine purposes and means for that processing.
Then your exposure is smaller, not absent. Order reports, returns handling and any brand store or off-platform page still involve personal data you decide about.
No. It identifies you as a trader under a different regulation. It creates no designation and no contact point for data subjects.
One Member State is enough. Article 3(2) does not scale with the number of countries.
No. Tax registration is separate from establishment under the GDPR and does not remove the need for a representative.
No. An Amazon fulfilment centre is Amazon's establishment. Recital 22 asks for your own effective and real activity through stable arrangements.
Usually a buyer complaint about an ignored deletion request, or a spillover from an unrelated case. Almost never a proactive audit of a small seller.
Only a written designation with an EU-established entity accepting the role counts. An agency relationship is not one.
Not directly; Amazon does not police it. The consequences come from supervisory authorities and from buyers who complain.
Whichever is causing damage today. Suppressed listings mean Article 16 first; otherwise the Article 27 designation is the cheaper and more neglected gap.
€890 a year for the Multi plan, against €290 for either role alone.
Both designations are countersigned within 24 hours of a completed form, each with its own verifiable certificate.
Yes, for the Union. Since Brexit a UK company is a third-country company for both regimes, which surprises a large share of the sellers who write to us.
Related: the responsible person Amazon does check · the wider ecommerce picture
Both designations signed within 24 hours of a completed form, on one invoice and one renewal date, each with a certificate anyone can verify.
See the Multi plan