Service
EU GDPR representative for companies outside the EU
We act as your representative in the EU under Article 27 GDPR, appointed through Ireland, for controllers and processors with no establishment in the EU. The fee is €349 a year, and correspondence from supervisory authorities and from EU data subjects is forwarded to you within one working day.
One representative for the whole EU. Named in your privacy notice. Your record of processing held for inspection. With the UK appointment alongside it if you need both.
€349 a year. Cancel at renewal. Last verified 30 September 2026.
Who needs an EU representative
Article 27(1) GDPR: “Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.” Article 3(2) applies to a controller or processor not established in the Union whose processing relates to “the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union” or to “the monitoring of their behaviour as far as their behaviour takes place within the Union”.
In plain terms: if people in the EU are your customers or your users, and you have no office, branch or subsidiary in any EU country, the obligation is yours unless the exemption below covers you. Since 1 January 2021 that includes UK companies selling into the EU.
Four companies that need one
A US software company with EU customers and no EU office.
Sign-ups from Dublin, Berlin and Madrid, billing in euros, support tickets from the EU. Article 3(2)(a) on its face.
A UK company selling into the EU.
Since Brexit a UK company is not established in the Union. If it has no EU subsidiary, it needs an EU representative for its EU customers, the mirror image of the UK obligation.
A Nigerian or other African fintech with users in the EU diaspora.
Senders in Dublin, Paris and Amsterdam are data subjects in the Union. The company is established in Lagos. The EU payment partner’s questionnaire usually asks first.
An online store outside the EU that ships to EU consumers and tracks them.
Delivery to EU addresses is the offering of goods; analytics and retargeting on EU visitors is the monitoring of behaviour. Either limb is enough.
The exemption
Article 27(2) removes the obligation for “processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing”, and for a public authority or body.
All three limbs have to be met at once. A customer database, an app or a mailing list that is part of how the business runs is not occasional, whatever its size.
What the representative does
Article 27(4): the representative is mandated “to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation”. In practice that is four things.
Receives and forwards
Letters and emails from any EU supervisory authority, and requests or complaints from people in the EU, reach you within one working day, with a note of any deadline they carry.
Is named in your privacy notice
Articles 13(1)(a) and 14(1)(a) require the identity and contact details of the controller’s representative in the information you give data subjects. We give you the exact wording and Irish address to use.
Holds your record of processing
Article 30(1) puts the record of processing on “each controller and, where applicable, the controller’s representative”. We hold a current copy and produce it to a supervisory authority on request.
Cooperates with the authorities
Where an authority asks the representative a question, we answer what a representative can answer and route the rest to you. We do not answer for you.
What it is not
It is not a Data Protection Officer and it is not legal advice. Article 27(5) says the designation “shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves”. Your obligations as controller or processor stay with you.
Price
EU representative
€349
a year, invoiced annually in advance.
- Named Article 27 representative, appointed through Ireland
- Correspondence forwarded within one working day
- Record of processing held for inspection
- Privacy notice wording supplied
- Written appointment agreement
UK representative
£249
a year, from Janus Compliance Limited in London.
For companies with UK users as well. The UK GDPR has its own Article 27 and an EU representative does not cover it. The UK service.
Nothing routine costs more. A substantive drafted reply to an authority, or a translation, is quoted and agreed in writing before any work is done. Published EU prices at the smallest band run from €150 at DataRep and €420 at Prighter to $2,700 at VeraSafe; the dated comparison shows each provider’s figures and source.
How appointment works
- 1.You send the four details in the form below, and Michael replies within one working day.
- 2.You receive the appointment agreement and the intake form, which is your record of processing under Article 30 if you have one, or the questions that build one if you do not.
- 3.Both sides sign the written designation that Article 27(1) requires, and the fee is paid.
- 4.You put the representative’s name and Irish address into your privacy notice using the wording we send, and the appointment is complete.
Enforcement
A missing representative is an infringement of Article 27. Article 83(4)(a) places the obligations in Articles 25 to 39 in the tier of fines “up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher”. For most companies the question arrives from a customer’s vendor questionnaire, an investor’s checklist or a payment partner, as a line asking for the representative’s name.
Questions we get asked
Why Ireland?+
Article 27(3) GDPR says the representative "shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are." A company selling across the EU almost always has users in Ireland, so an Irish representative meets that test. Ireland also works in English, which keeps correspondence simple.
Does one representative cover the whole EU?+
Yes. Article 27(1) requires "a representative in the Union", not one per country. The representative can be addressed by any supervisory authority in the EU, and by data subjects wherever they are.
Can the representative be fined for our breach?+
Article 27(5) says the designation "shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves", and Recital 80 says the designation "does not affect the responsibility or liability of the controller or of the processor". The EU text differs from the UK text in one respect: Recital 80 also says "The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor." That is why the appointment agreement requires you to answer correspondence within the deadline and indemnifies the representative.
Do we also need a UK representative?+
If you also offer goods or services to people in the UK without a UK establishment, yes: the UK GDPR has its own Article 27, and an EU representative does not count for the UK. Janus Compliance Limited acts as UK representative from London for £249 a year, and the two appointments can run side by side.
Can you act for a processor as well as a controller?+
Yes. Article 27(1) applies to "the controller or the processor". A processor outside the EU whose processing falls within Article 3(2) needs its own representative.
What languages do you work in?+
English. Correspondence arrives in the language the sender chooses and is forwarded as received. If a reply needs drafting or a document needs translating, that is quoted separately before any work is done.
Appoint us as your EU representative
Four details. A reply within one working day.
Sources, read on 30 September 2026
- Regulation (EU) 2016/679 (GDPR), Articles 3(2), 13, 14, 27, 30 and 83(4) and Recital 80, official text from the Publications Office of the European Union (CELEX 32016R0679).
- Competitor prices on the comparison page, each read from the provider’s own pricing page on the date shown there.