Key takeaways
- Several EU and UK laws make a company established outside them appoint a named local representative. These are separate appointments, not alternatives, and one company can be caught by more than one.
- Engage Compliance holds twelve of these mandates: GDPR Article 27 in the EU and the UK, the Swiss FADP, the Digital Services Act, both EU AI Act representative roles, NIS2, the Data Act, both Data Governance Act roles, the e-Evidence Directive, and the Terrorist Content Online Regulation.
- Every price is published for every company size band, charged once a year up front, and bought online with no sales call. The smallest band is for very small organizations only, and its caps are stated wherever its price appears.
- Every active appointment can be verified on that client's own page, so a regulator or a customer can check it without asking us.
How it works
Four steps, most of it automatic
-
1. Pick what you need.
Tick the appointments, answer a few questions about your size, and see your annual price before you pay.
-
2. Pay and fill in one short form.
Pay by card or SEPA. You get a link to a form asking for your company details and who should receive messages from regulators and the public. It takes a few minutes.
-
3. Get your documents.
We run a sanctions check and set up your own representative contact address. Then your appointment document, certificate, privacy notice wording, and public verification page issue automatically.
-
4. Publish and send us two things.
Add the wording to your privacy notice. For GDPR appointments, send your record of processing (Article 30) and the link to your updated privacy notice. We only remind you about what is still missing.
The twelve mandates
One page per mandate: who is caught, what the law makes the representative do, and what it costs.
- GDPR Article 27 EU Representative Companies with no establishment in the EU that offer goods or services to, or monitor the behavior of, people in the EU.
- UK GDPR Article 27 UK Representative Companies with no establishment in the UK that offer goods or services to, or monitor the behavior of, people in the UK.
- Swiss FADP Article 14 Swiss Representative Companies based outside Switzerland whose processing of Swiss people's data is large scale, regular, and high risk, and is tied to offering goods or services in Switzerland or monitoring behavior there.
- Digital Services Act Article 13 DSA Legal Representative Providers of intermediary services, which includes hosting, online platforms, marketplaces and search, that offer services in the EU without an establishment there.
- NIS2 Directive Article 26(3) NIS2 Representative DNS providers, TLD registries, domain registration services, cloud and data centre providers, CDNs, managed service and managed security providers, online marketplaces, search engines and social platforms that offer services in the EU without being established there. Three of those have no size threshold: Article 2(4) applies the Directive to entities providing domain name registration services regardless of their size, and Article 2(2)(a)(iii) does the same for TLD name registries and DNS service providers.
- Data Act Article 37(11) Data Act Legal Representative Any company in scope of the Data Act that makes connected products available or offers related services in the EU without being established there.
- Data Governance Act Article 11(3) and Data Governance Act Article 19(3) DGA Data Intermediation Representative and DGA Data Altruism Representative Data intermediation service providers, meaning data marketplaces and data-sharing intermediaries, that offer those services in the EU without being established there.
- e-Evidence Directive Article 3 e-Evidence Legal Representative Service providers offering electronic communications, domain name, IP numbering or other information society services in the EU that have no establishment in a Member State bound by the Directive.
- EU AI Act Article 54 EU AI Act Authorised Representative for general-purpose AI models Providers established outside the EU that place a general-purpose AI model on the EU market. Models released under a genuinely free and open-source licence are outside this, unless they present systemic risk.
- EU AI Act Article 22 EU AI Act Authorised Representative for high-risk systems Providers established outside the EU that make a high-risk AI system available on the EU market. The appointment has to be in place before the system goes on the market.
- TCO Regulation Article 17 TCO Legal Representative Hosting service providers without a main establishment in the EU that let users store and share content publicly.
On the product side, for physical goods placed on the EU market, we also act as the GPSR responsible person and the EU authorized representative for CE-marked goods, both scoped on enquiry (see how the product-safety representative providers compare). Regimes outside the EU and UK are not part of the online sign-up: Korea, Thailand and Turkey are available on request and China is partner-delivered, all covered on non-EU representative services. We do not offer a representative for Russia.
What it costs
One annual price per mandate per company size band, charged once, up front.
Your band is set by how many people work at your company, your global annual revenue, and how many people in the EU and UK you hold personal data about. Whichever puts you highest wins. There is no setup fee, no monthly option, and no call.
The smallest band is for very small organizations only: 1 to 10 people, under €2m in global annual revenue, and under 5,000 people in the EU and UK whose personal data you hold. All three must be true. If any one of them is not, the next band up applies. If your company grows into a bigger band during the year, nothing changes mid-term: you pay the new band's price from your next renewal.
| EU Representative | UK Representative | Every other mandate |
|---|---|---|
| Band 0: 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold | ||
| €690 a year | €550 a year | Standard €550 a year AI Act Article 54 and TCO €690 a year Swiss €950 a year DSA and Data Act €1,200 a year NIS2 €2,000 a year AI Act Article 22 €2,200 a year |
| Band 1: 11 to 50 people, or €2m to €10m revenue, or 5,000 or more people in the EU and UK whose data you hold | ||
| €990 a year | €790 a year | Standard €790 a year AI Act Article 54 and TCO €990 a year Swiss €1,190 a year DSA and Data Act €1,724 a year NIS2 €2,873 a year AI Act Article 22 €3,157 a year |
| Band 2: 51 to 250 people, or €10m to €50m revenue | ||
| €2,290 a year | €1,830 a year | Standard €1,830 a year AI Act Article 54 and TCO €2,290 a year Swiss €1,830 a year DSA and Data Act €3,993 a year NIS2 €6,655 a year AI Act Article 22 €7,301 a year |
| Band 3: 251 or more people, or over €50m revenue | ||
| From €4,490 a year | From €3,590 a year | Standard From €3,590 a year AI Act Article 54 and TCO From €4,490 a year Swiss From €3,590 a year DSA and Data Act From €7,833 a year NIS2 From €13,055 a year AI Act Article 22 From €14,313 a year |
Standard price: DGA Data Intermediation Representative, DGA Data Altruism Representative, e-Evidence Legal Representative.
AI Act Article 54 and TCO price: EU AI Act Authorised Representative for general-purpose AI models, TCO Legal Representative.
Swiss price: Swiss Representative.
DSA and Data Act price: DSA Legal Representative, Data Act Legal Representative.
NIS2 price: NIS2 Representative.
AI Act Article 22 price: EU AI Act Authorised Representative for high-risk systems.
More than one mandate. Only the most expensive appointment in your basket is charged in full. Every other one is charged at 75 percent of its own price. At the smallest band, adding the UK appointment to the EU one costs €413, and the two together are €1,103 a year.
Optional extra, charged once per order and never per appointment. Higher-risk processing, which covers GDPR Article 9 special category data and Article 10 criminal offense data, is €250, €500, €750 or from €1,000 by band 0 to 3.
Commercial pricing bands based on familiar market-size and market-pricing thresholds. They are not a statutory size test.
Verification
Every appointment we hold can be verified on the client's own page, which shows the company, the mandate, whether the appointment is active, and how to reach the representative. A supervisory authority, a customer, or a due-diligence reviewer can confirm it there without contacting us or you. The wording we give you for your privacy notice links straight to that page.
See what you receive
These GDPR Article 27 samples use an invented company. Every page is marked SAMPLE and has no legal effect. Your documents use the details and legal duties for each mandate you choose.
Sample appointment document (PDF) · Sample certificate (PDF) · How Engage representation works (PDF)
Sample privacy notice wording (SAMPLE)
This is the wording block you receive to publish, shown for the same invented company and built by the same generator as yours. It arrives under the line "Add this to your privacy notice:"
EU Representative (GDPR Article 27) Example Orchard Labs LLC (SAMPLE) has appointed Engage Data Consulting B.V., trading as Engage Compliance, as its EU Representative under GDPR Article 27. Contact the representative: https://www.engagecompliance.co/representatives/example-orchard-labs-sample By email: sample-representative@example.invalid By post: Engage Data Consulting B.V., KvK 82538638, Cruquiuskade 251, 1018 AM Amsterdam, Netherlands Engage Compliance maintains a public record of this appointment. Verification of representative status: https://www.engagecompliance.co/representatives/verify?id=SAMPLE