Article 27 GDPR · Appointed in 24 hours · All 27 member states
Someone in Europe has to answer for you. That is the whole law in one sentence.
Article 27 · Regulation (EU) 2016/679
Your legal address in Europe, signed in 24 hours.
If your company sits outside the EU and reaches people inside it, the law says someone in the Union has to answer for you. We are that someone — named in your privacy notice, reachable by every supervisory authority, verifiable by anyone with the code on your certificate.
We read your public privacy notice and tell you whether an EU representative is named, in about ten seconds. No account, no card.
Designation of a representative in the Union
REP27 / CZ-03571785
Designation activeAnyone — an authority, a customer, a buyer running due diligence — can scan this and see the designation live. Not a PDF that could say anything.
Why this is not optional
Missing representative is the easiest violation to spot.
It is visible in your own privacy notice, from the outside, without any investigation. A supervisory authority does not need to audit you to see it — and under EDPB Guidelines 3/2018 the omission is a standalone infringement, not a mitigating detail.
Fine issued by the Dutch supervisory authority to Locatefamily.com for failing to designate an EU representative, plus periodic penalties until compliance.
Maximum administrative fine under Article 83(4)(a) GDPR — whichever is higher — for infringements of Article 27.
Supervisory authorities that can act against you: without an EU establishment you are outside the one-stop-shop, so any of them has jurisdiction.
The appointment
What lands in your inbox
Everything is issued in your language and in English, ready to be published, filed and shown to a regulator or an enterprise buyer.
Signed designation letter
The written designation Article 27(1) requires, executed with an eIDAS-compliant electronic signature, naming the territory covered.
Verifiable certificate
A dated certificate with a QR code and a verification code. Scanning it shows whether the designation is live right now.
Privacy notice text
The exact Article 13 and 14 wording with our name and address, generated in each of your site's languages. Copy, paste, done.
Request desk
A dedicated address, inbox and web form. Every request from a data subject or an authority is logged and forwarded to you within two business days.
Live badge
A seal that stops lying when you stop paying.
Everyone else hands you a PDF. We give you one line of HTML that reads the designation register in real time: green while it is active, red the moment it lapses. Nobody can display a status they no longer hold — which is exactly why the status is worth something.
<script src="https://gdprrepresentative.com/badge.js"
data-code="R27-8F4K-2Q9D"></script>
Three steps, one day
From form to certificate
Tell us what you process
Five minutes. Company details, your records of processing under Article 30, one contact person who will handle forwarded requests.
Sign and pay
The designation letter is generated from your answers and signed electronically by both sides. Payment by card or SEPA direct debit, annually, renewing automatically.
Publish and forget
Certificate, badge and privacy notice text are issued within 24 hours. From then on we receive, log and forward — and you keep selling into Europe.
When someone actually writes
What happens the day a regulator emails us
This is the part nobody explains before you buy, so here it is in full.
- Hour 0. The message lands in your dedicated address. It is stamped, given a reference number and stored in the register.
- Within 2 business days. It reaches your nominated contact by email, with the original attached and the deadline the GDPR gives you clearly stated.
- Day 30. The clock on a data subject request runs out. The desk shows it to both sides, so nobody discovers it late.
- Always. We hand over your Article 30 records if an authority asks for them, and we tell you the same day that we did.
- Never. We do not answer on the merits, negotiate, or speak for you. Article 27 makes us a contact point, not a defence lawyer — and the contract says so.
Territory
One designation, twenty-seven authorities.
Because you have no establishment in the Union, the one-stop-shop does not apply to you: there is no single lead authority to deal with. Any national regulator whose residents you reach can open a file. The designation covers the member states listed on your certificate, and the desk answers in the language the person writes in.
Honest comparison
What the €150 providers leave out
Prices in this market run from about €150 to €1,500 a year. The gap is not the legal role — that is identical — it is what you can prove afterwards.
| Typical low-cost provider | REP27 | |
|---|---|---|
| Designation document | Static PDF, no way to check it is still valid | Certificate with QR and public verification, live status |
| Proof for a buyer or auditor | You email them the PDF and hope | They scan the code and see it themselves |
| Per-request charges | €50–200 each time an authority makes contact | Included from the Standard plan |
| Languages | English only, sometimes one local language | Site and desk in 8 languages, notice text generated per language |
| Article 30 records | You keep them; the representative has nothing to show | Held and produced on request, as Article 30(4) expects |
| Speed | Days, after an email exchange | 24 hours from form and payment |
Comparison based on publicly listed prices and terms of EU representative providers, checked in 2026. Providers change their offers — check theirs before you decide.
The document itself
Written, signed, dated — the way Article 27 wants it.
Article 27(1) does not accept a handshake or a line in a contract: the designation must be in writing. Ours states the represented company, the legal basis, the territory, the effective date and the verification code, and it is signed by both sides with an electronic signature that satisfies Regulation (EU) No 910/2014.
It also records what Article 27(5) makes explicit and most buyers forget: appointing a representative does not shield you from actions brought against you directly. We are your contact point in Europe, not a wall between you and a regulator — and any provider who tells you otherwise is selling something the regulation does not contain.
Pricing
One annual fee. No fee per request.
Prices exclude VAT. Billed annually in advance, renewing automatically; cancel any time before the renewal date.
- EU representative under Article 27 GDPR
- Designation letter and verifiable certificate
- Live badge and privacy notice text
- Up to 10 forwarded requests a year
- Everything in Base
- Unlimited forwarded requests
- We hold your Article 30 records for the authorities
- Request desk in 8 languages, with the 30-day clock visible to both sides
- Everything in Standard
- Responsible person under Article 16 GPSR
- Authorised representative under Reg. (EU) 2019/1020
- Your name and ours on packaging and marketplace listings
Regulated and higher-risk activities — health data, biometrics, credit, dating, minors, data brokerage — are quoted separately and activated within five business days.
Article 27, in plain terms
Questions we get before signing
Who needs an EU representative?
Any controller or processor established outside the EU that offers goods or services to people in the EU, or monitors their behaviour, and therefore falls under Article 3(2) GDPR. The designation must be in writing. The only exemption, in Article 27(2)(a), covers occasional processing that is low risk and excludes special categories of data — it rarely fits a commercial business.
What happens if we do not appoint one?
It is a standalone infringement under Article 83(4)(a) GDPR: up to €10 million or 2% of total worldwide annual turnover, whichever is higher. The Dutch authority fined Locatefamily.com €525,000 for this alone, with periodic penalties running until it complied.
Is this the same as a data protection officer?
No. The representative is your point of contact inside the Union under Article 27. The DPO is an internal role under Articles 37 to 39. Under EDPB guidance one entity cannot be both for the same company, because the roles can conflict.
We are in the UK. Does this apply after Brexit?
Yes. The UK is a third country under the GDPR. If you offer goods or services to people in the EU or monitor their behaviour, you need an EU representative — and separately, non-UK companies reaching the UK may need a UK representative.
What exactly do you do when an authority writes?
We log the request, forward it to your nominated contact within two business days, and keep the record. We do not answer on the merits, give legal advice or assess your compliance — those stay with you, and the contract says so plainly.
Can we use our EU distributor or our law firm instead?
Only if that entity is established in the Union and formally accepts the role in writing. A distributor who has not signed a designation is not your representative, and a law firm acting as counsel is not one either. What Article 27 requires is a named, established entity that authorities and data subjects can address, published in your privacy notice.
Does appointing a representative make us liable in the EU for everything?
No. It does not create a new establishment, it does not move your tax residence, and it does not extend the GDPR to processing that was already outside its scope. It gives European authorities and individuals a reachable address. Article 27(5) also confirms that they can still act against you directly.
What do we publish in our privacy notice?
The representative's identity and contact details, under Articles 13(1)(a) and 14(1)(a). We generate the exact sentence in each language of your site: name, street address in Prague, and the dedicated email for data subject requests.
We are a processor, not a controller. Does Article 27 still apply?
Yes. Article 27 covers both controllers and processors caught by Article 3(2). If you process EU personal data on behalf of clients and have no EU establishment, you need a representative too — and your clients increasingly ask to see it before signing.
How fast is it?
Designation letter and certificate within 24 hours of the form and payment. Higher-risk sectors within five business days, after review.
Talk to a person
Ask before you buy
Tell us where you are established and what you process. We answer with a straight yes or no on whether Article 27 applies to you, and what it would cost.
Check your site first. It costs nothing.
If your privacy notice already names a representative, we will tell you and you can close the tab. If it does not, you will know in ten seconds what a regulator would see.
Run the free check