GDPR EU representative services

Does a GDPR EU representative service cover what we need?

Article 27 requires a controller or processor not established in the Union to designate a representative in the Union in writing, where Article 3(2) applies. The obligation has exceptions in Article 27(2): processing that is occasional, does not include large-scale special category or criminal offence data, and is unlikely to result in a risk, and processing carried out by public authorities or bodies. The representative is an addressee for supervisory authorities and data subjects on processing issues. It is not the party that owns your compliance, and appointing one does not move responsibility or liability away from your organization, as the EDPB's Guidelines 3/2018 make clear. Before you buy anything, confirm in writing whether your processing actually falls under Article 3(2) and whether any Article 27(2) exception applies.

Scope and cost depend on two things you can measure. The first is where your affected data subjects live. Under Article 27(3), the representative must be established in one of the Member States where those individuals are, and the appointment is tied to that footprint. The second is how much processing is in scope, including whether it touches special category or criminal offence data at scale. A service provider will price around the number of Member States, the volume of correspondence it must handle, and the reporting it will pass to you. Ask each provider for a quote that states which Member States it covers, which languages and channels it accepts requests in, how it forwards authority and data subject contacts to you, and how it handles a change in your processing footprint. No price is given here. A quote follows from a written scope that you and the provider agree before work starts.

Do not assume the representative gives you a single regulator. EDPB Guidelines 9/2022 state that a representative does not trigger the one-stop-shop, so a non-EU controller must notify a personal data breach to every supervisory authority in whose Member State affected data subjects reside. Plan your breach notification routes and contact details with that in mind, and confirm with your provider exactly which breach contacts it will and will not relay. The representative also cannot be your external DPO, because the EDPB's guidance says the two roles are not compatible. If you need both, appoint them separately and ask each provider to confirm in writing that it does not hold the other role for you.

What the representative does and does not do

Under Article 27(4), the representative is the Union-based party that supervisory authorities and data subjects may address on all issues related to processing, so that they can reach the organization without contacting a non-EU entity directly. The mandate is one of contact and communication. The representative receives the questions, forwards them to the organization, and helps the organization route its replies back to the authority or the individual.

Supervisory authority inquiries: A national authority can send correspondence, requests for information or notices to the representative, which the organization must then answer.
Data subject questions: Individuals can use the representative as an EU point of contact for questions about how their personal data is processed.
Scope of the mandate: The Article 27(4) mandate covers all processing issues, so the representative must be able to pass on questions about any processing the organization carries out within scope.
Routing and records: The representative needs a documented intake and forwarding process so that requests are logged and answered within the deadlines the organization is bound by.
Language and access: Confirm which languages and channels the representative supports for each Member State where affected individuals live.

Check that the written mandate describes these channels and that the organization has a named internal owner for every forwarded request.

Where the representative must be established

Article 27 ties the representative's location to where the affected data subjects are, not to where the controller is or where its servers sit. The cards below cover the decisions and checks that follow from that rule, from choosing a Member State to recording the appointment so that authorities and data subjects can reach the representative.

Member State requirement under Article 27(3)

The representative must be established in one of the Member States where the data subjects whose data is processed are located. Establishment is about where the representative actually operates, so a mailbox or registered address with no real presence does not meet the test on its own. Confirm with counsel which Member States your processing reaches, because that list determines where a compliant appointment can sit.

Choosing a location across several states

When data subjects sit in more than one Member State, the regulation requires only that the representative be established in one of them, so the choice is a business decision with legal limits. Illustrative example: a controller whose customers are mostly in two states may pick the state where its representative can answer in the local language and respond quickly. Document the reasoning, since the choice may be questioned later.

Written mandate content to confirm

Article 27(1) requires the designation to be made in writing. Before signing, check that the mandate names the controller or processor, states the representative's contact details, confirms the representative is mandated to be addressed by supervisory authorities and data subjects on all processing issues, and sets out how requests are passed back to your team. Ask the provider who keeps the signed copy and how it is produced on request.

Confirming reachability for authorities and individuals

A representative only works if regulators and individuals can contact it in practice. Test the published contact route before you rely on it: send a test message, confirm the response owner, and check that the representative can receive correspondence in the relevant language. Keep a record of the test and repeat it when the provider or contact details change.

Recording the appointment in processing records

Keep the representative's name, address and contact details in your record of processing activities, alongside the processing it covers and the Member States of the affected individuals. Update the record whenever the mandate, provider or location changes. A current entry lets your team show which representative an authority should contact and when the appointment took effect.

Why the representative cannot be the external DPO

The Article 27 representative and the external data protection officer cannot be the same appointment. EDPB Guidelines 3/2018 on territorial scope state that the representative role is not compatible with that of an external DPO. In practice this means a non-EU controller or processor that needs both must appoint two separate people or firms, each with its own written mandate. The reason is structural: the representative is the contact point that supervisory authorities and data subjects address on all processing issues, while the DPO monitors compliance and advises the organization from inside its own governance. Holding both roles in one firm would blur who speaks for the organization and who checks it, which is the independence problem the DPO rules are designed to prevent.

For procurement, this matters most when a single vendor offers a bundle that includes both roles, often sold as an "EU compliance package". Before signing, ask the vendor in writing which person or entity acts as representative, which acts as DPO, and how the firm prevents the same staff from holding both positions or reviewing their own work. Ask for the conflict check it runs, who approves it, and how often it is repeated when staff change. If the vendor cannot answer these questions clearly, treat the bundle as a risk to be priced into your decision rather than a saving. Your own legal counsel should confirm the position under your Member State's rules.

The independence and conflict rules for the DPO itself, including what an external service contract must provide and which tasks stay with the organization, are covered in the sibling guidance on outsourced DPOs. Read that alongside this section before you scope the two appointments, so each role's written mandate reflects the separation the EDPB expects. Responsibility for compliance stays with the organization whichever roles it outsources, and neither appointment transfers that liability to the appointee.

Why a representative does not give one-stop-shop access

A representative appointed under Article 27 does not give a non-EU organization access to the one-stop-shop. The one-stop-shop depends on a main establishment in the Union, meaning a place where the controller's central decisions on the purposes and means of processing are taken. A written mandate to a representative in a Member State does not create that establishment, and EDPB Guidelines 9/2022 make clear that a representative does not trigger the one-stop-shop system. The practical consequence is that a non-EU controller must notify a personal data breach to every supervisory authority in whose Member State affected data subjects reside, and must be ready to deal with each of those authorities separately.

This changes what a breach response plan must contain. The plan should list the Member States where affected people live, map each one to its supervisory authority, and hold the contact routes, notification templates and language requirements for each. The representative can receive authority correspondence and help coordinate, but it does not replace those separate notifications. Treat the representative as a contact point, not as a filing route. Check that the plan is tested against a scenario spread across several countries, since the 72-hour clock in Article 33 does not pause while a team works out which authority is competent.

Cross-border complaints and investigations are handled differently under Regulation (EU) 2025/2518, which lays down additional procedural rules for cross-border enforcement and applies from 2 April 2027. Organizations that expect to be the subject of such cases should read its procedural rules against their own position before that date and ask whether they have any EU establishment that could be treated as a main establishment. Whether any existing EU entity, branch or decision-making arrangement would change the position is a legal question about facts specific to the organization. Confirm it with qualified data protection counsel before relying on any assumption, and record that advice with the breach response plan.

How the appointment is set up, step by step

The sequence turns a vague sense that a representative is needed into a documented designation that supervisory authorities and data subjects can find and contact, with each phase producing a record that can be shown later.

Scope the processing and data subject locations
Start by listing every processing activity that may fall under Article 3(2): offers of goods or services to people in the Union, and monitoring of behaviour that takes place in the Union. Record which Member States the affected data subjects live in, which systems hold their data, and which teams run each activity. The privacy or legal lead signs off the list. The output is a written scope note that names the processing activities, the data subject countries and the owning teams, so the later representative decision rests on facts rather than assumptions.
Decide the exemption position in writing
Test each processing activity against the Article 27(2) exemptions: occasional processing that is unlikely to create risk, and public authorities or bodies. Check separately whether any activity involves large-scale special category or criminal offence data, because that rules out the occasional-processing exemption. Legal counsel and the DPO or privacy lead document the reasoning for each activity. The output is a signed exemption memo that says either that a representative is required or, with reasons, that none is needed. Keep it current when the processing changes.
Select and contract a representative
If a representative is required, choose an organization established in a Member State where the affected data subjects are, and confirm it can receive communications from supervisory authorities and data subjects on all processing issues. Agree the scope, contact channels, handling of incoming requests and escalation routes in a written service contract. Ask the provider to confirm its establishment and how it will forward matters to you. The output is a signed service agreement and a named contact who can act on regulator and data subject correspondence.
Draft and sign the written designation
Prepare a written designation that names the representative, identifies the controller or processor, and states the processing it covers. Confirm with counsel that the mandate allows the representative to be addressed by supervisory authorities and data subjects on all processing issues. Obtain signatures from an authorized officer on both sides. The output is a signed designation letter held with the contract file, which an assessor or supervisory authority can request. Confirm wording with your counsel, because this document is the evidence of the appointment.
Publish representative contact details in privacy notices
Update the privacy notices and any other user-facing information that describes how to contact the controller, so that they show the representative's contact details alongside your own. Coordinate with product, marketing and customer support so the same details appear in web footers, app store listings, contracts and data subject request forms where relevant. The output is a dated change log and screenshots or saved copies of each published location. Check the wording with counsel before release.
Record the representative in the processing records
Add the representative's name and contact details to the record of processing activities for each affected activity, as the GDPR requires the controller's records to include that information where a representative is designated. Link each record to the signed designation and the exemption memo. The output is updated records with version history, showing who maintains them and when they were last reviewed. Records are the first document a supervisory authority asks for, so ensure the entries match what was published.
Confirm the arrangement remains accurate
Set a review trigger for any change in processing, new Member States with affected data subjects, change of representative, or change in the exemption position. Ask the representative to confirm in writing when its details change. The output is a review log that records each trigger, the decision taken and the person responsible. This step prevents the appointment from drifting out of date as the business grows into new EU markets.

What an implementation partner can prepare and what it cannot

An implementation partner can make the representative arrangement workable by mapping where data subjects are, assembling records, routing requests and documenting breach workflows. The representative itself, the controller's legal position and any formal certification stay with the organization and its independent advisers.

Mapping data flows and data subject locations

Before a representative is appointed, the organization needs to know which Member States its data subjects live in and which systems hold their data. A partner can trace data flows from the offer or monitoring activity through hosting, sub-processors and support access, then record the Member States involved. This map shows where the representative must be established and which supervisory authorities may contact it. Check that the map is maintained by the organization, because it changes whenever a product or market changes.

Preparing the evidence pack for the representative

The representative is mandated to be addressed by supervisory authorities and data subjects on processing issues, so it needs organized, current material to answer with. A partner can assemble records of processing, processor contracts, the privacy notice, the data flow map and the security measures in one controlled set. Ask who keeps the pack current and how fast the representative can obtain a document from the controller.

Configuring contact and request routing

Authorities and individuals must be able to reach the representative and the controller without delay. A partner can set up published contact addresses, mailbox or ticket routing and escalation paths in the systems that receive requests. It can also confirm that requests reach the team that answers data subject rights requests. Ask the representative to confirm in writing what it will forward to the controller and within what timeframe.

Documenting breach notification workflows

Because a representative does not trigger the one-stop-shop, a non-EU controller must notify a breach to every supervisory authority in whose Member State affected data subjects reside. A partner can document this multi-authority notification path, including who decides, who drafts and who sends. The workflow should also show how the representative receives authority correspondence. Test it with a tabletop exercise before an incident occurs.

What the partner cannot do

DeployOpen does not act as the representative, does not issue certificates or attestations, and does not take on the controller's legal position or liability. The representative must be an entity established in a Member State where data subjects are, and the EDPB states that the role is not compatible with an external DPO. Confirm the representative's identity, mandate and independence with the representative and your counsel before the systems work begins.

Questions buyers ask about EU representatives

How much does a GDPR EU representative cost and what drives the price?

No fixed price is published for this service, so the figure depends on what you ask the provider to cover. Representative services are usually a recurring fee, billed per year, because the role must stay in place for as long as the obligation applies. Cost drivers include the number of Member States where your data subjects are located, the volume of supervisory authority and data subject contacts you expect the provider to handle, how quickly you need responses forwarded, and whether the provider also keeps records or a register of your processing. Ask each provider for a written quote that lists the Member States covered, the annual fee, any setup charge, and the notice period for ending the contract. Compare quotes on the same scope, not on headline price.

How long does it take to appoint an EU representative?

The appointment itself is a written designation under Article 27(1), so the legal step is short, but the practical lead time depends on the provider's onboarding and on how fast you can supply documents. Expect time for contract review, identity and corporate documents, confirmation of the Member State where the representative will be established, and internal sign-off on who receives authority contact. Ask each provider for its onboarding steps and typical turnaround in writing, and ask what happens to your contact details and privacy notices once the representative is named. Plan the appointment before you start serving EU data subjects, not after a regulator or customer asks for it.

What must our organization supply to a representative provider?

The provider needs enough information to act as the point of contact for supervisory authorities and data subjects on all processing issues. Typically this includes your legal entity details, the written mandate, a description of the processing activities that bring you within Article 3(2), the categories of data subjects in the EU, the processing records or a summary of them, your privacy notices, and a named internal contact who can answer questions quickly. Ask the provider which documents it expects, how it will receive and forward correspondence, and how fast you must respond. Keep ownership of the underlying records and controls with your own team, because the representative does not hold your compliance evidence for you.

Can our company appoint an EU representative itself?

Only if your own entity is established in one of the Member States where the affected data subjects are and you can meet the Article 27 role in practice. Article 27(1) requires a written designation of a representative in the Union, and Article 27(3) requires that person to be established in a Member State where affected data subjects are. A non-EU company without an EU establishment usually cannot be its own representative, because the role is designed to sit outside the controller's own compliance function. The EDPB guidance on territorial scope (Guidelines 3/2018) also notes that the role is not compatible with an external DPO, so do not assign both to the same provider. Confirm your position with qualified EU counsel before deciding.

Does appointing an EU representative make our company GDPR compliant?

No. Appointing a representative does not make you compliant and does not transfer responsibility. EDPB Guidelines 3/2018 state that designating a representative does not affect the responsibility or liability of the controller or processor. The representative is a contact point, so your organization still owns its lawful bases, data subject request handling, security under Article 32, breach notification, transfer safeguards and records. Also note that the representative does not give access to the one-stop-shop: EDPB Guidelines 9/2022 state that you must notify a breach to every supervisory authority in whose Member State affected data subjects reside. Plan your breach and rights processes with that in mind.

How do we check whether an EU representative provider is suitable?

Start with the Article 27 requirements, then test the provider against them in writing. Confirm that the provider is established in a Member State where your affected data subjects are, that it will accept the mandate in writing, and that it can handle authority and data subject contacts in the languages you need. Ask whether the provider also offers an external DPO service, because the EDPB states that the representative role is not compatible with that of an external DPO, and a provider offering both should explain how it separates them. Request its procedure for forwarding correspondence, its response times, its data processing terms, and references you can verify independently. Have qualified EU counsel review the contract before signing.

How to choose a representative or advisor

A representative under Article 27 is a formal role with fixed limits, so the checks below focus on what the provider is mandated to do, where it sits, and whether it can be kept separate from your DPO and processing decisions. Confirm each point in writing with the provider and your own counsel before signing.

Written mandate scope

Ask for the written designation and read what the representative is mandated to handle. Under Article 27(4), the representative is addressed by supervisory authorities and data subjects on all processing issues, so confirm how it receives those contacts, how fast it forwards them to you, and whether it can answer on your behalf or only pass messages along. Confirm the mandate with your counsel, since the exact wording determines your obligations.

Member State location

Article 27(3) requires the representative to be established in a Member State where the affected data subjects are. Map where your EU users or monitored individuals live, then ask the provider which Member State it is established in and how it will cover other countries where your data subjects sit. Confirm this with counsel, because the mapping depends on your actual processing, not your marketing plans.

Independence from DPO and processing roles

EDPB Guidelines 3/2018 state that the representative role is not compatible with that of an external DPO. Ask the provider whether it, or any affiliate, also offers DPO services, hosting, support or other processing to you. Any overlap is a reason to reconsider, and your counsel should confirm the separation in writing.

Liability and professional indemnity

A representative does not take over your responsibility. The EDPB's territorial scope guidance confirms that designating a representative leaves the controller's or processor's liability unchanged. Ask whether the provider holds professional indemnity cover, what it excludes, and how fines or costs caused by its own errors are handled. Confirm the cover limits and contractual terms with your insurer and counsel.

Confidentiality and data handling terms

The representative will receive complaints, requests and authority correspondence that contain personal data. Ask for written confidentiality obligations, the location where those records are stored, who at the provider can access them, and how long they are kept. Check whether a processing agreement under Article 28 is needed for this handling, and confirm the answer with counsel.

Questions to ask before signing

Put these questions to every provider: Which Member State are you established in? Who will receive authority contacts, and how fast are they forwarded? Do you offer DPO or processing services to us or our affiliates? What indemnity cover do you hold? How do you keep records of correspondence? Ask for written answers, and confirm with your counsel that the contract matches them before you rely on the role.

How DeployOpen works on this

DeployOpen does not act as an EU representative, and it does not issue audit reports or certificates. We help your organization prepare the systems, records and evidence that a designated representative and your own teams will need when supervisory authorities or data subjects ask questions, with the work defined in writing before it starts.

How we scope

We confirm which processing activities bring your organization under Article 3(2) and which systems hold data about people in the Union.
The written scope names the systems, data flows, logs and documents to be prepared, and who at your organization owns each one.
Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any work starts.

How we build

We prepare hosting, access and logging for the in-scope platforms inside your own infrastructure or accounts.
We configure record-keeping and contact routes so a breach or access request can be traced to the correct controller entity.
We test the configured controls and document results, so your team and your appointed representative can check them.

How we hand over

We deliver runbooks for breach notification to each affected Member State, since a representative does not route notifications through the one-stop-shop.
We provide written documentation of the systems, data locations and controls, so your team can answer authority questions without us.
Your organization keeps ownership of the representative appointment, the accountability for compliance and every regulator-facing decision.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Ask us to confirm in the quote which document reviews and system changes are included in the retainer and which are billed separately.
Ask your appointed representative and counsel to confirm the Member State they must be established in for your data subjects.