REP27 · After the appointment
Article 27 GDPR · After the appointment
Almost every page on this subject stops at the moment of purchase. This one starts there. A designation is not a certificate you file and forget: it creates a live contact point in the Union, a register, a clock, and an obligation on our side that runs for as long as the mandate does. Here is what that looks like across a year.
A written mandate under Article 27(1) naming your company, ours, the territory covered and the effective date, executed with an electronic signature.
The wording goes into your privacy notice in each language you publish. Until this happens, the designation exists but nobody can use it.
A certificate with a verification code that resolves on a public page, so procurement teams check your status without emailing you.
Your Article 30 record is held inside the Union from that point, ready to be produced if an authority asks.
The register runs quietly in the background. When something arrives, four things happen in order.
| Event | What we do | Timing |
|---|---|---|
| Data subject request | Log, reference, forward to you | Within 2 business days |
| Supervisory authority request | Log, reference, forward, acknowledge | Same business day, from Standard |
| Request for the Article 30 record | Produce it and notify you | Same day |
| Buyer verifying your certificate | Nothing — the public page answers | Instant |
| Your designation expires unpaid | Badge turns red, status shows expired | Immediate |
EDPB Guidelines 3/2018 treat representative and data protection officer as incompatible roles, because one acts on your instructions and the other must be independent. A provider offering both is describing something other than Article 27.
Expectations are worth setting honestly, because the service is not what most buyers picture when they sign.
For a typical company with European customers but no European presence, the first year contains no data subject requests at all. Perhaps one arrives, usually an access request from someone who has forgotten which service they signed up to. The register records it, we forward it, you answer, and the file closes in under a week.
The certificate, by contrast, gets used constantly. It goes into security questionnaires, into data processing agreements as an annex, and into the compliance page of enterprise buyers who verify the code rather than asking you. Over a year, that is where almost all the value sits — not in the requests handled, but in the questions that stopped being asked.
The exception is companies with consumer-facing volume in Europe, where a handful of requests a quarter is normal and the desk earns the fee outright. Both patterns are covered by the same designation; only the plan differs, which is why unlimited requests start at the Standard tier rather than at the entry one.
A designation letter signed by both sides, a dated certificate with a QR code and verification code, the wording for your privacy notice in each of your languages, and a live badge for your site. Everything the public and commercial side of the obligation needs.
For most companies, rarely — a handful a year, often none. The service is closer to insurance than to a helpdesk: the value is that a working route exists on the day someone uses it.
It is timestamped, given a reference, recorded in the register we keep for you, and forwarded within two business days. Requests from a supervisory authority go the same business day from the Standard plan.
You do, on the merits. We are the contact point, not the decision maker, and the thirty-day clock under Article 12(3) is visible to both sides from the moment the request is logged.
Hold it inside the Union and produce it to an authority on request, telling you the same day. That is what Article 30(1) asks of the representative.
It renews annually at a discounted rate and can be cancelled before each renewal date. Nothing changes about the designation itself unless you ask.
Tell us, and the designation is amended or revoked. Adding the United Kingdom, adding the GPSR responsible person, or ending the appointment entirely are all handled without starting over.
Designation, certificate and notice wording within 24 hours. A person reviews every file before signing.
Appoint us