If your company is based outside the EU but offers goods or services to individuals in the EU or monitors their behavior, you likely need an EU Representative under GDPR Article 27. We provide this as a standalone service. If you also need a DPO, we offer both as separate products and scope them together.
What you get:
- A designated EU Representative, established in the Netherlands, which satisfies Article 27(3) for anyone with users in the Netherlands
- A local contact point for EU supervisory authorities and data subjects, not a shared inbox or a forwarding address, covered by professional indemnity and cyber insurance
- €690 a year at the smallest band, charged once up front, and the appointment issues in seconds
Price, scope, and how to start
Price. The standalone Article 27 appointment is €690 a year at the smallest band, for a company with 1 to 10 people, under €2m in global revenue and under 5,000 people in the EU and UK whose data you hold, and the three larger bands are €990, €2,290 and €4,490. Billing is annual only: you are charged once, up front, and there is no setup fee. Every band is published and buyable, so you can answer five questions on start your appointment, see your exact figure and pay, with no sales call.
What is included. The designation itself, made from our Netherlands establishment. A local contact point for supervisory authorities and for data subjects, named in your privacy notice. The Article 30 records you provide held and made available where applicable. Coordination with your team on any regulatory inquiry, and ongoing availability for the life of the appointment.
How to start. Start your appointment directly, which takes a few minutes and needs your company details and the member states you sell into. If you would rather ask first, book a call.
How fast. Seconds, once the short form after payment is done, and that form takes about three minutes. The appointment document, the certificate, your public verification link and the wording for your privacy notice all issue at that moment, automatically. Article 27 requires the representative to be published, so we give you the exact wording to paste in and you publish it.
Before you buy. If you also need a DPO, we offer both as separate products and scope them together.
Key takeaways
- The EU Representative service appoints a local GDPR Article 27 contact inside the EU for companies based outside it. It is €690 a year at the smallest band, charged once up front, and the price is set by headcount, revenue and the number of people in the EU and UK whose data you hold.
- You likely need EU Representative services if you are based outside the EU and offer goods or services to, or monitor the behavior of, people in the EU.
- The EU Representative and the DPO are separate roles. Where you need both, we offer both as separate products and scope them together.
- Setup takes seconds. We update your privacy policy with the representative’s details as part of the designation.
- Weighing options? See EU Representative providers compared.
- Engage Compliance acts as your EU representative under Article 27, and every band of the annual price is published, including the largest one.
What is an EU Representative?
An EU Representative is a designated individual or organization established in one of the EU Member States where the relevant data subjects are located. They act as a local contact point for supervisory authorities and data subjects on behalf of a non-EU company. This is required under GDPR Article 27 for companies that:
- Are based outside the EU, AND
- Offer goods or services to individuals in the EU, OR monitor the behavior of individuals in the EU
There are limited exceptions, including for occasional processing that doesn’t include large-scale special category data and is unlikely to result in risk to individuals.
The EU Representative is NOT the same as a DPO. They serve different functions.
What does an EU Representative do?
- EU Representative appointment and designation
- Act as point of contact for EU supervisory authorities on your behalf
- Act as point of contact for EU data subjects on your behalf
- Hold and make available the Article 30 records you provide, where applicable
- Coordinate with your internal team on regulatory inquiries
- Ongoing availability for supervisory authority and data subject communications
Appointing us does not make you established in the EU
This is the question buyers ask last and worry about first, so here it is plainly. Appointing a representative does not give your company an establishment in the Union.
Article 27 only bites where you have no EU establishment, which is what Article 3(2) is about, so the appointment cannot create the thing whose absence triggered it. What you are giving us is a written mandate to be addressed by supervisory authorities and by data subjects, and Article 27(5) keeps every legal action available against you as controller or processor. The address on your privacy notice is our establishment, not a branch of yours.
The Digital Services Act puts the same point in a single line for its own representative, and it is worth quoting because nothing in the GDPR is as blunt. Article 13(5): “The designation of a legal representative within the Union pursuant to paragraph 1 shall not constitute an establishment in the Union.”
How it works
On payment: we designate the EU Representative and prepare the appointment documentation, which runs the moment the payment clears. The obligation check happens before that, in the five questions you answer at the start.
Next: we update your privacy policy to include the EU Representative’s contact details, which GDPR requires, and confirm the designation.
Ongoing: we act as the designated contact point, handle inquiries, and coordinate with your team as needed.
Pricing
Annual, charged once, up front, with no setup fee. Whichever of headcount, revenue or the number of people in the EU and UK whose data you hold puts you highest sets the band, so a twelve-person company with €80m in revenue sits in the largest one. Every band gets the same named representative, established in the Netherlands and covered by professional indemnity and cyber insurance, whether you buy this one mandate or add any of the twelve representative mandates we act under.
| Company size | EU Representative | UK Representative |
|---|---|---|
| 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold | €690 | €550 |
| 11 to 50 people, or €2m to €10m revenue, or 5,000 or more people in the EU and UK whose data you hold | €990 | €790 |
| 51 to 250 people, or €10m to €50m revenue | €2,290 | €1,830 |
| 251 or more people, or over €50m revenue | €4,490 | €3,590 |
The smallest band is for very small organizations only: 1 to 10 people, under €2m in global annual revenue, and under 5,000 people in the EU and UK whose personal data you hold. All three must be true. If any one of them is not, the next band up applies.
These are commercial pricing bands based on familiar market-size and market-pricing thresholds. They are not a statutory size test.
Standalone EU Representative. The figure for your band covers the designation, the contact point function, and ongoing availability.
More than one appointment. The total is the highest price in your basket, plus 75 percent of its own price for every other mandate in it. So the EU appointment and the separate UK one come to €1,103 a year together at the smallest band and €1,583 at band 1, and the EU appointment with the AI Act general-purpose AI one, which is on the EU price, comes to €1,208 at the smallest band and €1,733 at band 1.
Optional extras, charged once per order and never per appointment. Higher-risk processing, which covers GDPR Article 9 special category data and Article 10 criminal offense data, is €250 at band 0, €500 at band 1, €750 at band 2, €1,000 at band 3. Same-business-day response forwards authority and data subject correspondence the same business day instead of the next working day, and is €1,200 a year.
DPO + EU Representative: If you also need a DPO, that is a separate product. The DPO is From €1,000 per month, and we scope the two together.
EU Representative + Advisory: For companies that need an EU Rep but only lighter-touch privacy support, we can combine the EU Representative designation with our Privacy Advisory tier (From €600 per month).
The other representative mandates
The GDPR Article 27 appointment on this page is one of twelve representative mandates we hold, and several of them catch the same company. You can buy any combination of them on one screen: only the most expensive appointment in your basket is charged in full, and every other one is charged at 75 percent of its own price. Each mandate below has its own page explaining who is caught, what the instrument actually makes somebody do, and what it costs.
UK Representative, under UK GDPR Article 27. Companies with no establishment in the UK that offer goods or services to, or monitor the behavior of, people in the UK.
Swiss Representative, under Swiss FADP Article 14. Companies based outside Switzerland whose processing of Swiss people’s data is large scale, regular, and high risk, and is tied to offering goods or services in Switzerland or monitoring behavior there.
DSA Legal Representative, under Digital Services Act Article 13. Providers of intermediary services, which includes hosting, online platforms, marketplaces and search, that offer services in the EU without an establishment there.
NIS2 Representative, under NIS2 Directive Article 26(3). DNS providers, TLD registries, domain registration services, cloud and data centre providers, CDNs, managed service and managed security providers, online marketplaces, search engines and social platforms that offer services in the EU without being established there. Three of those have no size threshold: Article 2(4) applies the Directive to entities providing domain name registration services regardless of their size, and Article 2(2)(a)(iii) does the same for TLD name registries and DNS service providers.
Data Act Legal Representative, under Data Act Article 37(11). Any company in scope of the Data Act that makes connected products available or offers related services in the EU without being established there.
DGA Data Intermediation Representative and DGA Data Altruism Representative, under Data Governance Act Article 11(3) and Data Governance Act Article 19(3). Data intermediation service providers, meaning data marketplaces and data-sharing intermediaries, that offer those services in the EU without being established there.
e-Evidence Legal Representative, under e-Evidence Directive Article 3. Service providers offering electronic communications, domain name, IP numbering or other information society services in the EU that have no establishment in a Member State bound by the Directive.
EU AI Act Authorised Representative for general-purpose AI models, under EU AI Act Article 54. Providers established outside the EU that place a general-purpose AI model on the EU market. Models released under a genuinely free and open-source licence are outside this, unless they present systemic risk.
EU AI Act Authorised Representative for high-risk systems, under EU AI Act Article 22. Providers established outside the EU that make a high-risk AI system available on the EU market. The appointment has to be in place before the system goes on the market.
TCO Legal Representative, under TCO Regulation Article 17. Hosting service providers without a main establishment in the EU that let users store and share content publicly.
If more than one of those describes you, tick them together in the checkout. There is no separate process for a second mandate and no call to book: you see the combined price before you pay.