REP27 · Documents · Authorisation
Written mandate · Article 27(1) · acceptance
Companies tell us they have a representative and then discover, when an authority asks, that nothing was ever signed. Article 27(1) requires the designation to be in writing, and a designation nobody accepted is not a designation. This page sets out what the authorisation must contain, who has to sign it on each side, where it has to be published afterwards, and the three situations in which an existing one quietly stops working.
In writingAcceptedPublishedDatedTerminable
Step four is the one companies skip. A mandate sent to a provider and never countersigned is a request, not an appointment, and it fails the moment somebody checks.
Five clauses, one page. Anything longer is usually a services agreement wrapped around the mandate, which is fine as long as you can see where one ends and the other begins.
| If the question is about | The document is | Signed with | Published where |
|---|---|---|---|
| Personal data of EU users | Article 27 designation | An entity established in the Union | Privacy notice |
| Product safety in the EU | Article 16 mandate | An EU-established economic operator | Label and marketplace fields |
| Personal data of UK users | UK GDPR designation | An entity established in the UK | Privacy notice |
| Who can bind the company | Power of attorney or articles | Under national company law | Commercial register |
| Packaging waste | National EPR mandate | A provider licensed in each scheme | National register |
Someone able to bind the company: a director, an officer, or a person holding a power of attorney. A marketing or compliance manager without authority creates a document that can be challenged.
Europe Services, SE for the Union, REP27 LTD for the United Kingdom. Both countersign, both are checkable in a public register.
Article 27 asks for writing, not for paper. An electronic signature with an audit trail satisfies it, and no notarisation or apostille is required.
Groups sometimes want one mandate for several companies. Each controller designates for itself; we issue separate mandates on one invoice.
Article 13(1)(a) requires the identity of the representative to be given to data subjects. Unpublished, it protects nobody and reads as an afterthought.
You opened an EU establishment, or stopped selling into the Union. Either way the mandate should be terminated deliberately rather than left to renew.
Providers wind up. The published address stops answering and nobody tells you. Check the register once a year.
Not fatal: the company signed, not the person. But keep evidence of the signatory's authority at the time, because that is what gets questioned.
| Moment | Document | What you do with it |
|---|---|---|
| Within 24 hours | The countersigned mandate | Keep it with your records |
| Same time | Certificate with a verification code | Send it to clients and auditors who ask |
| Same time | The privacy notice paragraph, translated | Paste it into your notice and publish |
| Within days | Article 30 record template | Complete it once; we hold the copy |
| For products | The label wording, with an ASCII fallback | Give it to your printer or listing tool |
| Before expiry | Renewal notice | Renew or terminate, deliberately either way |
Ours is one page. Below is what each clause is for, so you can compare it with anything else on your desk without needing a lawyer to translate.
| Clause | What it says | Why it is there |
|---|---|---|
| Parties | Your legal name, registration and address; ours, with IČO 03571785 | Establishment in the Union is the substance of the appointment |
| Appointment | You designate, we accept, under Article 27 GDPR | Acceptance is what turns a request into an appointment |
| Tasks | Contact point, record of processing, cooperation with authorities | These are the statutory duties, not commercial extras |
| Your undertakings | Publish the identity, supply processing information, answer forwarded requests | Without publication the designation is invisible |
| Exclusions | No legal advice, no DPO duties, no decisions, no liability transfer | Article 27(5) makes the last one impossible anyway |
| Term and termination | Twelve months, renewable, terminable on notice by either side | A statutory relationship should never be a trap |
| Law and forum | Czech law for the Union mandate, English law for the UK one | Each follows the territory of establishment |
If a mandate you are reviewing runs to fifteen pages, look for these seven items inside it. Usually they are there, wrapped in a services agreement, and the wrapping is where the differences between providers actually live.
The most frequent defect we see when reviewing what a company already holds. Without countersignature there is no appointment at all.
A trading name instead of a company, or an entity dissolved since signature. Check the register once a year.
A UK entity designated for the Union after Brexit. Very common in documents dated before 2021 and never revisited.
Article 28 language pasted into an Article 27 mandate. Different roles, different duties, and it shows.
An undated mandate cannot prove when the appointment began, which is exactly the question asked during an investigation.
The document exists, nobody can find the representative. This is the defect that turns a technicality into a finding.
Yours and the representative's, on the same document, with dates.
Look it up in the national register by number, not by name.
A Member State for the Union, the United Kingdom for the UK GDPR.
Open your own privacy notice and read the paragraph as a stranger would.
Ask your provider to send you the Article 30 record they hold. If they ask what you mean, that is your answer.
With a reminder before, not a discovery after.
If any of the six fails, the fix is the same and takes a day: a new mandate signed on both sides, published the same afternoon, with the previous arrangement terminated afterwards so the published contact point is never empty.
Both come up weekly, and both are genuinely different instruments that happen to share vocabulary in most European languages.
| Document | What it is | How it differs from the mandate |
|---|---|---|
| Data processing agreement | Article 28 contract between controller and processor | Governs processing on instructions; creates no contact point and no representative |
| Power of attorney | Company law instrument letting someone act for the company | May be needed for the signatory, but is not itself the appointment |
| Authorised representative mandate | Product legislation, for a manufacturer | Concerns goods and technical files, never personal data |
| Fiscal representative appointment | Tax law, for VAT | Filed with a tax administration; unrelated to both regimes above |
The practical test is always the same: ask which regulation the request came from. A client asking for "your representative authorisation" in a vendor pack almost always means the Article 27 designation. A customs agent asking the same words means the product mandate. A tax adviser means the fiscal one. The words do not disambiguate; the source does, and one question saves a fortnight of exchanging the wrong documents.
If you hold several of these, keep them in one folder with a cover note listing which is which, who signed each and when they expire. It sounds trivial and it is exactly what an auditor asks for first, usually at the worst possible moment, and the company that can produce it in an afternoon is treated very differently from the one that cannot.
A mandate is dated, and the date is read. Four moments where the timing itself carries meaning.
Ideal but rarely how it happens. Nothing is lost by signing early except the year of coverage, and the appointment takes a day whenever you are ready.
The most common trigger, and perfectly fine. A designation signed because procurement asked is still a valid designation.
Still worth doing immediately, but understand how it reads: a mandate dated after the letter shows exactly when the obligation was noticed.
Nobody should backdate a mandate, and no provider should offer to. It converts an administrative gap into a document problem.
The same logic applies to termination. Ending a mandate the day you open a European office is clean and defensible; letting it lapse silently while you still reach the Union is the opposite, and it is the version that shows up in enforcement files. Whichever direction you are moving, do it deliberately and write down the date.
Yes. Article 27(1) requires the designation to be in writing. An informal arrangement, however long-standing, is not a designation.
No. No notarisation, no apostille, no sworn translation. An electronic signature with an audit trail is sufficient.
Someone able to bind the company: a director, an officer, or a holder of a power of attorney. Keep evidence of that authority.
Yes, and this is the step most often missing. A mandate sent but never countersigned creates nothing.
Legally a natural person established in the Union can act. Most companies prefer a company, because it survives staff changes.
Ours runs twelve months and renews. Either side can terminate on notice, which is what you want from a statutory relationship.
The identity and contact details of the representative, in your privacy notice under Article 13(1)(a). For products, on the label.
No. The mandate is the statutory appointment; a services contract wraps commercial terms around it. Keep them distinguishable.
Each controller designates for itself. We issue separate mandates per entity on a single invoice.
The company signed, not the person, so the mandate stands. Keep proof of their authority at the time of signature.
No, and it should not be. A mandate dated after a complaint reads exactly as what it is.
No. Article 27(5) prevents it. Any clause claiming otherwise is unenforceable and a reason to question the provider.
English, with the privacy notice wording supplied in the languages you publish in.
The designation ends on the date agreed, and you update your privacy notice the same day. Never remove the published contact point before the new one exists.
No, unless your own company law requires it for the person signing. The mandate itself is the appointment.
Only if it is the Article 16 mandate. The Article 27 designation covers personal data and nothing else.
Within 24 hours of a completed form, countersigned, with the certificate and the wording to publish.
Yes. Ask and we send it before any payment. It is one page and every clause has a purpose.
Related: the designation letter in detail · which role you need
Countersigned by Europe Services, SE in Prague, with a certificate carrying a verification code and the paragraph to publish in your privacy notice.
See the plans