REP27Appoint us
News
Clean desk with an open laptop showing a document, a pen resting on paper, and a small stack of printed certificates — no recognisable faces, professional office lighting

REP27›News

Your GDPR Art. 27 Representative: What's Included

· 1 min read

In briefSigned letter, verifiable certificate, 8-language mailbox, 24-hour forwarding.
Learn more →

Every EU GDPR Article 27 Standard plan from REP27 covers four things, stated in writing.

A signed designation letter. A verifiable certificate with QR code, publicly checkable at any time. A request desk that forwards data-subject and authority requests within 24 hours. And a mailbox that handles incoming queries in 8 languages, with the Article 30 record kept on your behalf.

The plan covers the whole EEA — all 27 EU countries plus Norway, Iceland and Liechtenstein — at no extra cost.

Every paid EU plan also includes the Swiss Article 14 nFADP assessment: an exemption declaration countersigned when the Swiss representative is not required.

If you also sell into the UK, you can add UK GDPR Article 27 coverage in a single order.

The designation is active and publicly verifiable from day one. The 7-day trial requires no card.

Learn more →

Keep reading

One month is the deadline.Video · 28s10.11.2026 · ENOne month is the deadline.Under the UK GDPR, a controller outside the UK must respond to a data subject request within one month; that period can be extended by two further months only if the complexity is justified in writing before the first month closes. The UK GDPR Article 27 representative is the address named in the privacy notice and the first point of contact for both individuals and the Information Commissioner's Office.▶ Watch the videoممثل الاتحاد الأوروبي — GDPR المادة 27.Video · 33s08.11.2026 · ENممثل الاتحاد الأوروبي — GDPR المادة 27.GDPR Article 27 requires any company established outside the EU to appoint a written representative inside the EU if it offers goods or services to people in the EU or monitors their online behaviour, as defined in Article 3(2). Failure to appoint one is an infringement subject to fines of up to €10 million or 2% of global annual turnover, whichever is higher. Exemptions apply only to occasional, low-risk processing and to public authorities.▶ Watch the videoNo EU Office? You Still Need a Representative.06.11.2026 · ENNo EU Office? You Still Need a Representative.Article 27 of the GDPR requires any company with no establishment in the European Union that offers goods or services to EU residents, or monitors their behaviour, to appoint a representative established in the EU — in writing. The obligation has applied since 25 May 2018 and covers companies of any size. Failure to designate one is itself an infringement, subject to fines of up to €10 million or 2% of total worldwide annual turnover under Article 83(4), whichever is higher.Read the article →How many contracts have you signed without reading?Video · 25s05.11.2026 · ENHow many contracts have you signed without reading?Under GDPR Article 27, non-EU organisations must designate an EU representative in writing. The REP27 Services Agreement, signed between Europe Services, SE (IČO 03571785, Praha 5) and REP27 LTD (company number 17385889, Suffolk), is published with a version number and date before any payment, downloadable as a PDF in thirteen languages. Three sections define who the parties are, what the representative does, and — equally important — what it does not do.▶ Watch the videoDoes Every Non-EU Company Need a GDPR Representative?04.11.2026 · ENDoes Every Non-EU Company Need a GDPR Representative?The obligation depends on who you process data about, not where you are.Read the article →A seller in Osaka lost nineteen days to a single line that was missing from his privacy…Video · 25s03.11.2026 · ENA seller in Osaka lost nineteen days to a single line that was missing from his privacy…Under Article 27(1) of the GDPR, any company established outside the European Union that offers goods or services to people in the EU must designate a representative in writing and name that representative in its public privacy notice. Enterprise procurement teams now verify this before signing supplier contracts, and an unnamed representative — or no representative at all — pauses onboarding until the gap is closed.▶ Watch the videoREP27 is in ChatGPT's training data.03.11.2026 · ENREP27 is in ChatGPT's training data.REP27 publishes a structured llms.txt file at gdprrepresentative.com/llms.txt, an emerging standard that lets AI assistants index site content in a machine-readable format. The file covers the service scope and all regulations handled: GDPR Art. 27, UK GDPR Art. 27, GPSR Art. 16, DSA Art. 13, AI Act, NIS2, and CRA. This means when a compliance officer queries ChatGPT or Claude for a GDPR Article 27 EU representative, REP27's service structure is available in a format those models can parse directly.Read the article →A GDPR representative is advertised at 150 € a year by some providers and 890 € by others.Video · 22s01.11.2026 · ENA GDPR representative is advertised at 150 € a year by some providers and 890 € by others.Under GDPR Article 27, every EU representative performs the same legal function: a named entity established in a member state, designated in writing, listed in the privacy notice. The price difference between €150 and €890 per year reflects what happens after the invoice — chiefly whether authority contacts and data subject requests are included or billed separately at €50–€200 each.▶ Watch the videoBrexit did not remove the EU representative obligation.Video · 24s31.10.2026 · ENBrexit did not remove the EU representative obligation.Brexit did not remove the EU GDPR representative obligation — it duplicated it. Article 27 of the EU GDPR and Article 27 of the UK GDPR are separate legal requirements answered to different regulators: a representative established in an EU member state has no standing before the UK Information Commissioner's Office, and vice versa. Companies selling into both markets need two designations, two certificates, and two verification codes.▶ Watch the videoNon-EU companies selling into Europe: one requirement, many regulations.Video · 42s30.10.2026 · ENNon-EU companies selling into Europe: one requirement, many regulations.Non-EU companies selling into Europe: one requirement, many regulations. GDPR, product safety (GPSR), cosmetics, NIS2, the AI Act — several EU and UK…▶ Watch the videoAI Act Article 50: Disclose Your Chatbot by AugustVideo · 16s28.10.2026 · ENAI Act Article 50: Disclose Your Chatbot by AugustFrom 2 August 2026, Article 50 of the EU AI Act requires anyone deploying a chatbot or AI-generated content to disclose it as such to the people interacting with it. Non-EU providers that fall within the scope of the regulation must also designate an EU authorised representative under Articles 22 and 54.▶ Watch the videoNo EU office? You still need a name here.26.10.2026 · ENNo EU office? You still need a name here.Article 27 GDPR requires any controller or processor established outside the EU to designate a representative in the Union in writing if it processes personal data of EU residents under Article 3(2) GDPR. Failure to designate is a standalone infringement under Article 83(4)(a), carrying a fine of up to EUR 10 million or 2% of total worldwide annual turnover. The Dutch supervisory authority fined Locatefamily.com EUR 525,000 solely for the absence of that designation.Read the article →Your Article 27 GDPR checklist for this week26.10.2026 · ENYour Article 27 GDPR checklist for this weekFour concrete actions any non-EU company can complete before the weekend.Read the article →Do you actually need an EU representative?24.10.2026 · ENDo you actually need an EU representative?Article 27 GDPR requires a company established outside the EU to designate a representative in the Union only if it falls under Article 3(2) — meaning it offers goods or services to people in the EU, or monitors their behaviour. If neither condition applies, the GDPR does not apply and no representative is required. If one condition applies, failure to designate is a standalone infringement under Article 83(4)(a), carrying fines up to EUR 10 million or 2% of total worldwide annual turnover.Read the article →Two numbers sit next to each other in this market, and the gap between them is the whole…Video · 22s23.10.2026 · ENTwo numbers sit next to each other in this market, and the gap between them is the whole…The Dutch supervisory authority fined Locatefamily.com €525,000 for failing to designate an EU representative under Article 27 GDPR. A designation from Europe Services, SE costs €290 per year. Article 83(4)(a) sets the maximum at €10 million or 2% of worldwide annual turnover for this infringement alone.▶ Watch the videoMost compliance questions for a non-EU seller start in the wrong place.Video · 22s23.10.2026 · ENMost compliance questions for a non-EU seller start in the wrong place.Non-EU sellers face different EU obligations depending on what they sell, not one single rule. A smart camera with cloud connectivity requires both a Cyber Resilience Act authorised representative and an Article 27 GDPR representative. A food supplement requires neither GPSR nor a GDPR representative — it requires a food business operator established in the Union.▶ Watch the videoEU representative quotes in this market run from about €150 a year to €1,500.Video · 22s22.10.2026 · ENEU representative quotes in this market run from about €150 a year to €1,500.EU representative quotes run from roughly €150 to €1,500 a year for the same legal role: one named contact point in the Union under Article 27 GDPR. The price gap reflects six operational differences — designation document format, public verification, per-request charges, language coverage, Article 30 record-keeping and turnaround time — none of which are defined by the regulation itself.▶ Watch the video400 boxes printed, all to be relabelled.22.10.2026 · EN400 boxes printed, all to be relabelled.Regulation (EU) 2023/988 (GPSR), which has applied since 13 December 2024, requires every product placed on the EU market to carry a product identifier, the manufacturer's name and postal address, an email address, and — for manufacturers established outside the EU — the name and address of an EU responsible person. Missing any one of these elements makes the label non-compliant, regardless of how the product looks.Read the article →I didn't know my website needed an accessibility statement until a customer asked for it.21.10.2026 · ENI didn't know my website needed an accessibility statement until a customer asked for it.Since 28 June 2025, the European Accessibility Act (Directive 2019/882) applies to online shops, booking sites, banking services and ticketing platforms across the EU. Micro-businesses — defined as fewer than 10 staff and under €2 million annual turnover — are often exempt from the service requirements. If your business falls outside that threshold, an accessibility statement is required.Read the article →You appoint an EU representative on a Monday.Video · 24s20.10.2026 · ENYou appoint an EU representative on a Monday.You appoint an EU representative on a Monday. By Friday nothing has happened. No email from Brussels, no request from a data subject, no authority asking…▶ Watch the videoIf you make connected devices or software sold in the EU, this changed on 11 September…20.10.2026 · ENIf you make connected devices or software sold in the EU, this changed on 11 September…From 11 September 2026, the Cyber Resilience Act requires manufacturers of connected devices and embedded software sold in the EU to report actively exploited vulnerabilities within 24 hours — to ENISA and the relevant CSIRT. The obligation applies to products already on the market, not only to new ones.Read the article →
All newsRSS