REP27 · Article 27 · Verification
Article 27 · due diligence on a provider
The role costs a few hundred euro a year and requires no licence, which is an open invitation to sell a certificate and nothing behind it. The buyer usually only finds out when a request arrives and nobody answers — by which point the designation was worthless for the whole period it covered. These are the five checks that take ten minutes, and they work on us as well as on anyone else.
Written mandateCompany numberEU addressVerification codePublished identity
The clearest warning sign is the most attractive promise: a provider claiming to take on your liability. Article 27(5) says the designation is without prejudice to legal actions against the controller or processor. Nobody can sell you an exemption from it, so anyone offering one is describing something that does not exist.
Each designation carries a code that resolves on our own site, showing the entity, the scope and whether it is still live.
A client, an auditor or a supervisory authority can check it without contacting you and without an account.
An EU and UK designation each carry their own, and neither page shows the other regime's data.
Which is the point: a code that keeps saying "valid" after the mandate has ended verifies nothing at all.
Check any certificate at gdprrepresentative.com/verify.php, including one issued to somebody else.
You want a company number in a Member State, not a brand name and a website.
Data subjects may write in their own language. An English-only desk is a limitation you should know about before, not after.
The representative is required to make it available to authorities. A provider that has never asked you for processing details is not keeping one.
Ask now how requests and records are handed back. It is the question nobody asks and everybody eventually needs.
The correct answer is no. Any other answer tells you what the rest of the service is worth.
You do not need a lawyer for this. Open your own privacy notice and work down the page.
Is a representative named at all, with an address? A surprising number of notices name only a support email.
The entity in the notice and the entity that signed should be the same. Rebrands and group reorganisations break this quietly.
The registration number should exist in a public register of a Member State and the company should not be dissolved.
If there is a certificate, verify it. If the page says valid with no expiry date, ask what happens when the mandate ends.
From a personal address, in the language of your largest European market, asking what data is held about you. Time the reply.
It is worth knowing what a working desk actually does with a request, because it tells you what you are buying beyond the certificate.
Same working day, in the language the request arrived in, with a reference the sender can quote.
The controller is identified to the sender, because a data subject is entitled to know whose processing they are asking about.
The full request reaches the controller with the date of receipt attached, since that date starts the Article 12 clock.
Everything recorded, so that a year later the sequence can be reconstructed exactly rather than approximately.
It is an unusual thing for a provider to hand buyers the tests that could disqualify it. We publish it because the sector's reputation is the main obstacle to selling in it: a market where a certificate can mean nothing is a market where a real designation is hard to price. Run the five checks on us before you run them on anyone else.
No. There is no licensing regime and no public register, which is exactly why these checks matter and why a verifiable certificate is worth something.
Yes, and you should if you rely on their compliance commercially. The same five checks apply to anyone's designation.
Who the parties are, that the representative accepts the Article 27(4) role, the processing and Member States covered, who keeps the Article 30 record, and the term.
No. Data subjects and authorities must be able to reach the representative. A box with no entity behind it defeats the purpose of the article.
Not automatically. What matters is whether the firm has signed the designation as the representative entity and actually operates the desk.
Then walk away. The mandate is the product; a provider unwilling to show it before signature is telling you something.
It proves the designation exists, covers what it says and is still live. It does not prove the desk answers, which is what the test request is for.
An acknowledgement within a working day is reasonable. Silence for a week from a supposed contact point is your answer.
It may be a natural or legal person established in the Union, but authorities and enterprise buyers expect a company with a verifiable registration.
You need a new designation naming the new entity. A change of company behind the same brand is not automatic continuity.
A quick check of the code and one test request a year is proportionate, and it takes minutes.
Article 27(3) points to a Member State where your data subjects are. Within that group, the language coverage of the desk matters more than the flag.
Re-designate immediately, update the notice the same day, and keep the evidence of what you found. A documented correction is treated very differently from a discovery.
Related: what a lapse costs · moving provider without a gap
Signed within 24 hours, with a certificate carrying a code anyone can verify on our site, and a request desk that answers in eight languages.
See the plans