REP27A buyer's security questionnaire has a field that stops the whole deal: "Name your representative in the Union."
It is not negotiable by email. Article 27 of the GDPR requires any controller established outside the Union that offers goods or services to people inside it, or monitors their behaviour, to designate in writing a representative established in a member state. Three conditions, all checkable by a stranger.
In writing. A dated mandate, not a clause buried in a service contract: an auditor asks for the document, not for a sentence.
Established in a member state. Not a mailbox in a country where you have no presence, and not an adviser who explains the obligation: supervisory authorities and data subjects address themselves to that entity, so it has to exist where the people are.
Published in your privacy notice. Articles 13 and 14 require the identity and address to be visible on the page. This is the part that costs companies the most, because it is not an internal file but a public statement: until the name is there, anyone who opens the page sees the obligation is unmet. No inspection, no request.
One more thing nobody explains before selling the service: a PDF proves the day it was signed, nothing more. What a counterparty checks is whether the designation is active today — the difference between a letter in a drawer and a verification code that turns red the day it lapses, silently invalidating every audit answer that cited it.
The honest part, before anyone pays. A group company already established in a member state puts you outside Article 27 entirely: it binds only controllers not established in the Union. Occasional, low-risk processing with no special categories is exempt under Article 27(2). And with no goods, no services and no tracking aimed at people in the Union, there is no obligation at all. If that is you, close this.
If not, a missing representative sits in Article 83(4)(a): up to 10 million euro or 2% of worldwide turnover. The lower tier — still more than the fee.
EU from 290 € a year, EU and UK from 390 €, for companies and private individuals. Signed within 24 hours.
Free check of your privacy notice first, no account and no card: https://gdprrepresentative.com
The brand and the three companies: https://rep27.com
Responsible person GPSR and authorised representative 2019/1020: https://eulabelcompliance.com
Accessibility statement (EAA): https://accessibilitystatement.org
