REP27 · Privacy notice wording
Articles 13(1)(a) and 14(1)(a) GDPR
The designation is the private half of Article 27; the notice is the public half. A signed mandate that nobody can find does not give a data subject in Portugal anyone to write to, which was the entire purpose of the article. This page sets out where the wording goes, what it must contain, and the five formulations we most often find that do not work.
The registered name of the company acting as representative — not a brand, not a department, not a country.
A postal address in a Member State. This is what makes the representative addressable by an authority.
An email address or web form that a data subject can use without an account, in a language they can use.
Saying the entity acts as representative under Article 27 removes any doubt about what its relationship to you is.
The fourth is the most interesting: companies that genuinely have counsel in Europe assume that suffices. Unless the firm has accepted the mandate in writing and is named as representative, it does not.
Structure it as identity, address, route, role — in that order, so a reader skimming finds the name first.
| Element | Example content |
|---|---|
| Entity | The registered company name of your representative |
| Address | Street, postal code, city and Member State |
| Contact | A dedicated email address or web form |
| Role | Acting as representative under Article 27 of the GDPR |
| Placement | In the identity section, under both Article 13 and Article 14 headings |
Of everything Article 27 requires, the notice is the only element visible without contacting you. A supervisory authority conducting a sweep, a buyer running due diligence and a data subject looking for somewhere to complain all start in the same place and reach a conclusion in seconds.
It is also the cheapest thing to fix. The mandate takes a day; publishing the wording takes minutes, and until it is published the designation does no work at all.
Roughly one in five companies that run our free check has a valid designation and a privacy notice that does not mention it. They have paid for the obligation and left the public half unfinished.
The reason is usually organisational rather than legal. The designation is bought by legal or by the person handling compliance; the privacy notice is edited by marketing or by whoever owns the website. Nobody hands the wording across, and the certificate goes into a drive folder where no data subject will ever find it.
From outside, that company is indistinguishable from one that never appointed anyone. An authority conducting a sweep sees the same absence. A buyer running due diligence reaches the same conclusion. A data subject looking for somewhere to write finds nothing and complains to their own authority, which is precisely the sequence Article 27 exists to prevent.
This is why we generate the wording at the moment the designation is issued, in every language the site publishes, rather than leaving it as an exercise. The mandate does no work until the text is live.
In the section identifying who you are, next to the controller's own identity and contact details. Article 13(1)(a) requires it where data is collected from the person; Article 14(1)(a) requires the same where the data was obtained elsewhere. Both wordings should be present.
No. The requirement is identity and contact details: a legal entity name, a postal address in a Member State, and a route to reach it. "Our representative in the EU" without a name satisfies neither article.
The information must be provided in clear and plain language to the people it concerns. In practice that means every language in which you offer your service — the same set your privacy notice already exists in.
No. The banner deals with consent; the identity information belongs in the notice itself, reachable before or at the moment data is collected.
Not for Articles 13 and 14, which are about informing data subjects, not counterparties. A processing agreement is not published and data subjects never see it.
It does not have to quote the article, but saying so removes ambiguity for authorities and buyers reading quickly. We generate wording that names the entity, the address and the role.
The notice must be updated the same day the new designation takes effect. Until then it points people at an entity that no longer acts for you.
We read your public privacy notice and tell you in ten seconds whether a representative is named, and whether the wording holds.
Run the free check