REP27 · Ecommerce · Dropshipping
Article 27 GDPR · Article 16 GPSR · no warehouse
Dropshipping removes the warehouse from your business. It removes nothing from your obligations. The consumer contracts with you, you decide what data is collected and you place the product on the European market under your own listing — so both the data obligation and the product obligation land on your name, while the supplier who packed the parcel stays out of reach of any European authority.
No stockNo EU officeSupplier shipsYou invoiceYou answer
Every argument about dropshipping compliance ends in the same place: whoever the consumer bought from is the one the authority writes to.
| Belief | Why it fails |
|---|---|
| "The supplier is the manufacturer, so it is their problem" | The manufacturer's duties exist, but a manufacturer outside the Union does not discharge your duty to name an EU operator on what you sell |
| "The goods ship from an EU warehouse, so we are established" | A third party's warehouse is that third party's establishment. Recital 22 asks for your own effective and real activity |
| "We never see the data, the platform does" | You decide what is collected and why. That makes you controller regardless of who stores it |
| "We are too small to be noticed" | Marketplace checks are automated and customs checks are random. Neither reads your turnover first |
An EU representative named in your privacy notice, receiving requests from customers and supervisory authorities.
An EU-established responsible person named on the product and in every marketplace field.
Declarations of conformity and test reports collected from each supplier before the first order, not after the first complaint.
Where the required details will physically appear when you never touch the box: usually an insert the supplier adds, agreed in writing.
An Article 30 record of what you process, kept by the representative and available to authorities.
Step four is the one that decides whether a dropshipping model is workable in Europe at all. A supplier who will not add an insert is a supplier you cannot sell in the Union.
Everything that makes dropshipping compliant in Europe is decided in the supplier conversation, not afterwards. Five points, in writing, in the order they matter.
| Point | What you need | If they refuse |
|---|---|---|
| Declaration of conformity | A document naming the product and the standards applied | The product cannot lawfully be sold in the Union |
| Test reports | Reports from a laboratory, not a self-declaration | You commission testing yourself or drop the reference |
| Label insert | Agreement to add your responsible person details to each parcel | You cannot comply without touching the goods |
| Change notification | Written notice before any change of factory or specification | Your documentation silently stops matching the product |
| Data handling | What the supplier does with the buyer address you send | An undocumented transfer sits in your file |
There is a transfer nobody thinks about: to fulfil the order you send your customer's name and address to a company outside the Union. That is a transfer of personal data to a third country, and it needs a basis, a mention in your privacy notice and an entry in your Article 30 record.
Usually standard contractual clauses with the supplier, or necessity for the performance of the contract with the customer, depending on the arrangement.
Your privacy notice should say that order data is shared with fulfilment partners outside the Union. Most dropshipping notices do not.
One line in the Article 30 record naming the category of recipient and the country. Held by the representative and available if asked.
Ask what the supplier keeps and for how long. You are answerable for a retention period you never agreed and cannot describe.
A storefront in English, prices in euro, a privacy notice generated from a template, no representative named, no address in the Union, and a product arriving from Asia with no operator on the box. Each of those alone is unremarkable; together they describe a seller that has never been reachable in Europe. That is why dropshipping files, once opened, tend to cover both regulations at once rather than one.
Only if it is established in the Union and signs a mandate accepting the Article 16(3) tasks. A Chinese or Turkish supplier cannot, whatever it writes on the invoice.
No. A logistics provider's warehouse is its establishment, not yours. Recital 22 asks for effective and real activity through your own stable arrangements.
You decide what is collected, for what purpose and for how long. That makes you controller even when a platform holds the database.
Legally yes. You sell under your own name, so both the data and the product obligations follow the listing rather than the printer.
Then the marketplace enforces the product side and ignores the data side. Both obligations still belong to you.
Yes. Agree an insert or a printed label with the supplier before you start selling. Without it the product is non-compliant on arrival.
A return address in the Union is good practice commercially, but it is neither an establishment nor a substitute for either designation.
Then your documentation is out of date and your label may name an operator that does not match. Verify at each supplier change; this is the most common failure in dropshipping.
No. Tax registration and banking are separate from establishment for GDPR purposes and do not create one.
Digital products fall outside the GPSR, yes, but Article 27 GDPR applies to them exactly as it does to physical goods.
€890 a year for the Multi plan, which covers the Article 27 representative and the Article 16 responsible person together.
Both designations are signed within 24 hours of a completed form. Collecting supplier documentation is what takes real time.
Yes, for sellers who choose suppliers that can produce documentation. It is not viable for a catalogue assembled from suppliers who cannot.
Related: ecommerce obligations in full · what has to be on the label
The Article 27 representative and the Article 16 responsible person signed together within 24 hours, each with its own certificate and verification code.
See the Multi plan