REP27 · Which Member State
Article 27 GDPR · Choosing a country
Companies ask for Ireland because it is English-speaking, for Germany because it feels rigorous, for the Netherlands because their lawyer suggested it. Almost none of that has legal effect. Article 27 is a regulation, not a directive: it applies word for word in all twenty-seven states, and nothing about the designation changes when the postcode does. Here is the short list of what genuinely varies.
This is the assumption worth correcting first, because whole decisions get built on it.
Article 77 gives every data subject the right to complain to the supervisory authority of the Member State where they live, work, or where the alleged infringement took place. A customer in Milan complains to the Garante. A customer in Warsaw complains to the UODO. Neither of them is routed to Dublin because your representative has a Dublin address.
The one-stop-shop mechanism, which does concentrate cases with a single lead authority, applies to controllers with a main establishment inside the Union. A company relying on Article 27 has no establishment in the Union by definition — that is why it needs a representative — so the mechanism does not apply and any of the twenty-seven authorities may address your representative directly.
Ireland comes up more than every other Member State combined, for three reasons — and the first two do not survive contact with the article.
| Assumption | Reality |
|---|---|
| English-speaking, so easier correspondence | Authorities write in their own language and data subjects may use any official EU language. The desk's language coverage matters; the office's does not. |
| Big tech is there, so it must be the right venue | They are there as controllers with a main establishment, which triggers the one-stop-shop. That mechanism is unavailable to a company using Article 27. |
| Familiar to Anglo-American buyers | True, and the only real point. It is worth a modest premium, not a large one — and a verifiable certificate answers the same doubt. |
| Case backlog at the Irish authority | Relevant to controllers established in Ireland. Irrelevant to a non-EU company, which has no lead authority to be delayed by. |
Europe Services SE has been an active Czech company since 2018 and holds the mandate directly rather than through an agent network. Czech operating costs are a fraction of Dublin or Frankfurt, which is the entire reason our entry fee is €290 rather than €600, and none of the legal characteristics differ: the same regulation, the same twenty-seven authorities, the same enforceable designation.
Where we spend the difference is on the part that is not geographic — a request desk that reads and answers in eight languages, records held and produced on request, and a certificate anyone can verify from the code.
Not for legal purposes. A data subject may write in any official language of the Union, and an authority may correspond in its own. What matters is whether the desk can read and answer in the languages your customers actually use, not the language spoken where the office happens to be.
No. Complaints are handled by the authority where the data subject lives. A complaint from a customer in Milan goes to the Garante in Italy regardless of where your representative sits. The one-stop-shop mechanism applies to controllers with a main establishment in the Union, which is precisely what a company relying on Article 27 does not have.
Occasionally a buyer expects a familiar city. A certificate with a verification code that anyone can check settles the question faster than a postcode does, and costs a great deal less than a Dublin or Frankfurt address.
Yes. The Czech Republic is a Member State and Article 27 is a regulation, applying identically across all twenty-seven. Our Czech entity, Europe Services SE, has been active since 2018 and holds the mandate directly.
You can, but there is no benefit. One designation covers the Union. Multiple representatives multiply cost and create ambiguity about who answers, which is the opposite of what the article is for.
Article 27(5) makes clear that designating a representative does not affect legal actions against the controller itself. Jurisdiction follows the ordinary rules, not the representative's address.
It affects controllers whose main establishment is in Ireland and who therefore rely on the Irish authority as lead. It does not affect a non-EU company using Article 27, because there is no lead authority in that situation.
Yes. A designation can be revoked and a new one issued, and the change is reflected in your privacy notice and on the public verification page. Nothing about the earlier appointment carries over.
Related: do you need one at all? · what it costs · the UK is a separate designation
Designation signed within 24 hours, records held inside the Union, and a certificate any buyer can verify from the code.
See pricing Run the free check