REP27 · Providers · Choosing one
Article 27 · choosing a provider · due diligence
Everything in this market looks the same on a sales page: a European flag, a price, a promise of coverage across 27 countries. The difference shows up on one day only, the day an authority writes, and by then you cannot change supplier retroactively. This page is the due diligence we would run if we were buying instead of selling, including the questions whose answers should make you walk away.
Legal entityVerifiable certificateWritten scopeEight languagesRenewal price
The second item on the right is the decisive one. A provider promising to take on your liability is either misunderstanding Article 27(5) or hoping you do, and neither is a good start to a relationship built on statutory duties.
| Ask | Good answer | Bad answer |
|---|---|---|
| Which legal entity signs? | A named company with a registration number you can check | A brand, a trading name or "our European partner" |
| Since when has it existed? | Years, verifiable in the national register | Registered last quarter, or unclear |
| How is the designation verified? | A certificate with a code checkable on a public page | A PDF by email, nothing else |
| Who answers a request in German? | A desk covering the languages your users write in | English only, with translation "if needed" |
| Where is the Article 30 record kept? | Held by the representative, produced on request | "You keep it" or no answer |
| What is excluded from the service? | A written list | Vagueness, or "everything is included" |
| What does year two cost? | Stated before you sign | Discovered on the invoice |
The designation is the same document at every price point. What changes is whether advisory work, tooling or nothing at all is wrapped around it. Below €150 something is usually missing, and it is normally the part where somebody answers.
The failure that costs most. An unanswered authority request is recorded against you as non-cooperation, on top of whatever the original complaint was.
Article 30 asks the representative to hold it. Providers that never collected it discover this the week an authority asks.
Small providers wind up. Your privacy notice keeps pointing at an address that no longer answers, and you are not told.
A data subject writes in their own language and receives silence or a translation notice. Both read badly in a complaint file.
Enterprise procurement asks for verification. A PDF slows a deal by weeks and sometimes ends it.
Europe Services, SE, IČO 03571785, Na Čečeličce 425/4, Praha 5, registered in the Czech commercial register and active since 2018.
REP27 LTD, company number 17385889, Suffolk, for the UK GDPR. Two entities because two territories, not as an upsell.
Receive, log, hold the record, cooperate with authorities, forward to you the same working day, in eight languages.
Legal advice, DPO duties, policy drafting, product testing, CE marking, packaging registration, liability transfer.
€290 the first year, €240 on renewal, €890 for the plan covering data and products together.
or.justice.cz for the Czech entity, Companies House for the British one, and the verification code on every certificate.
If you have quotes on the table, this is the shortest way to compare them without becoming an expert in the regulation.
| Line to compare | Why it matters |
|---|---|
| Legal entity and registration number | Establishment in the Union is the entire point of the role |
| First year and renewal price together | The only honest way to see the real cost |
| Languages of the request desk | Determines whether a request becomes a complaint |
| Who holds the Article 30 record | The first document an authority asks for |
| Verification method | Determines how fast enterprise procurement clears you |
| Written exclusions | Tells you what you still have to buy elsewhere |
You can learn most of what matters in ten minutes on any provider's own site, if you know which pages to open and what to look for.
| Page to open | What to look for | What its absence tells you |
|---|---|---|
| Legal notice or imprint | Company name, registration number, registered address | If this is vague, nothing else matters |
| Terms of service | The scope of the mandate and the exclusions | No exclusions means no thought |
| Pricing | Renewal price stated next to the first year | Hidden renewal is where the margin lives |
| Privacy notice | How they treat data they receive on your behalf | A weak notice here is a bad sign for a data business |
| A verification page | Whether third parties can check a designation | Without it, procurement will slow you down |
| Contact details | A real address and a channel that answers | A form-only company will be form-only in a crisis |
Run the same check on us. Europe Services, SE appears in the Czech commercial register under IČO 03571785, REP27 LTD under company number 17385889 at Companies House, the exclusions are written on this site, and every certificate carries a code that anyone can verify without asking us for anything.
Each legal entity that determines purposes and means designates for itself. A parent cannot designate on behalf of subsidiaries it does not control for that processing.
Practical arrangement we use often: separate designations, a single billing relationship, a single renewal date.
Group notices that name the representative differently in each market create avoidable questions. We supply one paragraph, translated.
Usually a shared inbox on your side, with routing rules by entity. Decide it before the first request rather than during it.
Article 30 records are per controller. Merging them into one document is a common and avoidable mistake.
Entities leave groups. Designations should be terminable individually, not bundled into a single contract that has to be renegotiated.
Any serious provider sends it. Reading one page tells you more than any comparison table.
Written answer, with names and hours. Vagueness here predicts silence later.
And verify it yourself, without contacting them. That is the whole point of verification.
A provider that cannot list exclusions is selling a feeling rather than a service.
In writing, before the first invoice. The answer separates the market in half.
Five that we answer here in advance, because a market this opaque rewards whoever writes the answers down first.
| Question | Our answer |
|---|---|
| How many clients does the entity represent? | Fair question. It tells you whether the desk is a real operation or a side project |
| What happens if you go out of business? | Your published contact point stops answering. Termination clauses should require notice to you, and ours does |
| Who physically reads the inbox? | A person, in office hours, in eight languages. Ask any provider to describe the rota |
| Have you ever handled an authority request? | If a provider has never had one, ask what its process is on paper instead |
| Can we speak to a client? | Reasonable for enterprise deals. A provider with none to offer after years is telling you something |
None of these appears on a comparison table, and all five predict what happens on the day something arrives. The market sells coverage maps and country counts because they are easy to draw. What determines whether the service works is whether a named company, reachable in the right language, answers a letter within a deadline and can produce a record afterwards. Judge providers on that and the field narrows very quickly.
One more, specific to price: ask what happens if you exceed some notional volume of requests. A designation should not carry a fair-use clause, because the statutory duty does not have one. If a contract meters the thing the law requires, the pricing is designed for a different business than yours.
A legal entity genuinely established in a Member State, willing to sign the designation, hold the record of processing and answer correspondence. Everything else is packaging.
Yes if it is established in the Union and accepts the mandate. Many decline, because the role carries defined statutory duties for modest fees.
Below about €150 a year something is usually missing, and it is normally the part where somebody actually answers. Ask who reads the inbox.
Article 27(3) asks for establishment in a Member State where your data subjects are. Within that group the country matters far less than the quality of the desk.
Check the company in the national register, and ask for a certificate with a verification code you can check yourself without contacting them.
Your published contact point stops answering and you are usually not told. Check periodically that the entity still exists in the register.
Yes. The new designation is signed first, the notice updated the same day, the old one terminated afterwards, so there is never a gap.
No, provided you obtain the request log from the outgoing provider. That correspondence belongs to your file.
Not automatically. Size predicts marketing budget, not whether somebody answers in Polish on a Tuesday afternoon.
To act as contact point, hold the Article 30 record, cooperate with authorities, and be reachable. Anything beyond that is a commercial add-on.
Enforcement measures can be addressed to the representative, but Article 27(5) preserves proceedings against the controller. Your exposure does not move.
You need it to speak your users' languages. Your own language matters only for the internal relationship.
Then check whether they are regulated to do so. A representative giving casual legal opinions is a risk rather than a benefit.
Twelve months with clear termination is standard. Multi-year lock-ins in this market usually protect the provider, not you.
It is a fair question to ask, and a professional indemnity policy is a reasonable sign of seriousness.
Yes, if it holds both roles. We do: Article 27 for data, Article 16 for products, on one invoice and one renewal date.
A separate designation with an entity established there. Ours is REP27 LTD, company number 17385889.
Put first-year price, renewal price, desk languages, record holder and verification method side by side. The differences appear immediately.
Related: what the service includes · verifying a designation
Europe Services, SE, IČO 03571785, Prague, active since 2018, with a certificate carrying a verification code and a written list of what is excluded.
See the plans