We are already certified under the EU-US Data Privacy Framework. Is that enough?

No. The framework legitimises the transfer of personal data to your servers; Article 27 requires a named point of contact established inside the Union. Supervisory authorities check for both, and the second is the one visible in your privacy notice.

Do US companies need an EU representative?

Yes, when they fall under Article 3(2) GDPR by offering goods or services to people in the Union or monitoring their behaviour. There is no EU adequacy decision that removes Article 27: the EU-US Data Privacy Framework covers transfers of data, not the duty to have someone in Europe answering for you. A DPF certification and an EU representative are separate obligations, and having one does not satisfy the other.

How much does an EU representative cost?

REP27 charges €290 a year for Base, €490 for Standard and €890 for Multi, billed annually in advance.

REP27 · EU representative · United States

Article 27 RGPD

Votre représentant dans l’UE, signé en 24 heures.

Si votre société est établie en Suisse et que vous proposez des biens ou services à des personnes dans l’Union européenne — ou que vous suivez leur comportement — l’article 27 du RGPD impose de désigner par écrit un représentant dans l’Union. Ce représentant, c’est nous : mentionnés dans votre politique de confidentialité, joignables par les 27 autorités, vérifiables par quiconque détient le code du certificat.

€290Base — designation, certificate, live badge, 10 requests a year

€490Standard — unlimited requests, Article 30 records held, desk in 8 languages

€890Multi — Article 27 + GPSR responsible person + CE authorised representative

Commencer en 24 heures Vérification gratuite

Pourquoi cela vous concerne

La nLPD est proche du RGPD mais reste une loi distincte, et la Suisse n’est pas dans l’UE. Les sociétés suisses avec des clients européens relèvent de l’article 3(2) et doivent désigner un représentant.

€10 million or 2%Failing to designate is a standalone infringement under Article 83(4)(a) GDPR — whichever amount is higher. The Dutch supervisory authority fined Locatefamily.com €525,000 on this ground alone, adding periodic penalties until it complied.

Qui en a besoin

Pharma et medtech, technologies pour la banque privée, horlogerie et e-commerce de luxe, éditeurs de logiciels visant le marché européen.

You sell to people in the EU

Paid or free, physical or digital. Article 3(2)(a) looks at whether you envisage customers in the Union — a language option, a currency or EU shipping is usually enough.

You watch what they do

Analytics, profiling, advertising pixels or app telemetry on people located in the Union fall under Article 3(2)(b), even when you never sell to them.

You process for European clients

Processors are covered too. Naming a representative is increasingly a condition to pass vendor onboarding with EU customers.

Ce que vous recevez

Signed designation letter

The written designation Article 27(1) requires, countersigned by Europe Services, SE and signed electronically under eIDAS.

Verifiable certificate

A certificate with a QR code and a public verification page, so a regulator, a client or a buyer can confirm the designation is live right now.

Request desk in Prague

A dedicated address, inbox and form. Every request from a data subject or an authority is logged and forwarded to you within two business days.

Questions fréquentes

La nLPD nous demande déjà un représentant en Suisse. Est-ce la même chose ?

Non. La loi suisse exige un représentant en Suisse pour les sociétés étrangères ; le RGPD en exige un dans l’Union pour vous. Deux lois, deux rôles, deux désignations.

How fast can we be covered?

The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.

What does it cost, and what happens at renewal?

From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.

Are you our data protection officer?

No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.

Cover your EU customers from United States

Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.

Vérification gratuite