Your GDPR Representative in the EU & UK

If your company has no establishment in the EU or UK but offers goods or services to people there, or monitors their behaviour (for example through analytics, cookies, or advertising SDKs), Article 27 of the GDPR requires you to appoint a representative in that jurisdiction. This applies regardless of company size and regardless of whether you charge for your product — a free app with EU users can be in scope. It applies to both controllers and processors. The obligation is separate for the EU and the UK: EU GDPR and UK GDPR each have their own Article 27 requirement. Not sure whether it applies to you? Our 5-question self-assessment gives you an answer in two minutes.

Yes, but they are narrow. You are exempt only if ALL three of the following apply: your processing of EU/UK personal data is occasional; it does not include large-scale processing of special categories of data (such as health data) or data relating to criminal convictions; and it is unlikely to result in a risk to the rights and freedoms of individuals. In practice, the "occasional" criterion is the hurdle — if your product systematically collects data from EU or UK users, even in small volumes, your processing is not occasional. Public authorities are also exempt. If you believe you may qualify for the exemption, we would rather tell you that honestly than sign you up — take the self-assessment or ask us.

They are different roles under different articles, and one company may need either, both, or neither. A Data Protection Officer (Article 37) is an internal advisory role required when your core activities involve large-scale systematic monitoring or large-scale processing of special-category data — the DPO advises you and monitors your compliance from the inside. A Representative (Article 27) is an external local presence required when you have no EU/UK establishment — the representative is the addressee for authorities and data subjects. The two roles cannot be held by the same party: the European Data Protection Board considers combining them a conflict of interest, since a representative may be subject to enforcement proceedings concerning your compliance.

Failing to appoint a required representative is itself a GDPR violation, subject to fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher (Article 83(4)). The substantive violations a representative helps you manage — unlawful processing, ignored data subject rights — fall under the higher tier of up to €20 million or 4% of turnover. Beyond fines, the practical risks are often more immediate: EU business partners may refuse or suspend data transfers to a non-compliant company, and enterprise customers increasingly check for a named representative during procurement. Appointing a representative is one of the cheapest GDPR obligations to satisfy — and one of the most visible when missing.

Yes. Under the EDPB's Guidelines 3/2018 on territorial scope, the representative obligation applies to both controllers and processors. If you are a non-EU/UK processor and the processing you carry out for your clients relates to offering goods or services to people in the EU/UK or monitoring their behaviour, you need your own representative — independent of whether your clients have one. This affects B2B SaaS companies in particular: your EU customers' end users are in scope, and your EU business clients will often ask for your representative details during vendor review alongside a data processing agreement.

If you serve customers in both the EU and the UK, yes. Since Brexit, EU GDPR and UK GDPR are separate regimes with separate representative requirements: an EU representative must be established in an EU member state, and a UK representative in the United Kingdom. One cannot cover the other. Gabsor provides both from a single subscription — GAB COMPLIANCE LTD in Dublin, Ireland acts as your EU representative and GAB COMPLIANCE LTD in London, UK as your UK representative — so both appointments, privacy policy details, and authority communications are handled in one place.

Your representative is your official local presence: the named contact point that data subjects and supervisory authorities use to reach your company. Concretely, we receive and handle correspondence from authorities (such as the ICO, DPC, BfDI, or CNIL), acknowledge and relay data subject requests, make your records of processing activities available to authorities on request, and ensure responses go back within the legal deadlines. Our details appear in your privacy policy as required by Articles 13 and 14. The representative does not replace your own GDPR compliance — you remain responsible for how you process data — but it satisfies Article 27 and gives regulators and individuals a functioning channel to your business.

The correspondence is received by our team in the language it arrives in and assessed the same business day. You are notified immediately with a plain-English summary, the legal deadline, and what is being asked of you. We manage the exchange from there: drafting or reviewing the response with you, escalating to qualified legal counsel where a matter requires legal advice, and logging every step in your case file with the full correspondence history. You are never left to interpret a regulator's letter alone, and no deadline passes unnoticed — the entire exchange is tracked in your dashboard until the case is closed.

Individuals can submit access, erasure, portability, and other requests through your public intake portal or directly to us as your representative. Each request is logged with an automatic deadline (one month under GDPR), identity-checked, and tracked to completion. Our platform drafts policy-aligned responses for your review and keeps an evidence log for audits. The division of responsibility is clear: we manage the process, deadlines, and formal communication — decisions about the data itself, such as actually deleting a record from your systems, remain yours. You always know how many requests are open, who owns them, and how much time is left on each.

Three things: a signed Letter of Appointment (generated for you during signup, signed digitally), your company details, and a short description of your processing activities — what data you collect and why. If you already maintain a Record of Processing Activities, you can upload it; if not, our RoPA builder creates a compliant one from a guided questionnaire. You then add our representative details to your privacy policy using the snippet we provide. Most companies complete the entire process in about 5 minutes, and the appointment is active immediately.

Within about 5 minutes of signing up. The appointment itself is established by your signed Letter of Appointment and our acceptance — there is no waiting period or authority approval step. Once you update your privacy policy with our representative details and receive your Certificate of Representation, the Article 27 requirement is satisfied. If you are working against a deadline — an enterprise security review, a partner's vendor audit, an app store requirement — tell us at signup and we prioritise your onboarding.

No. Unlike some other EU regimes, GDPR has no registration or notification requirement for representative appointments. The appointment is evidenced by your written mandate (the Letter of Appointment) and made public through your privacy policy, which is where authorities look when they need your representative's details. This is also why updating your privacy policy is a required step of onboarding — an appointment that isn't published doesn't serve its purpose.

Article 27 applies per legal entity: each non-EU/UK entity that processes EU/UK personal data in scope needs its own representation. In practice, a US parent and its Australian subsidiary are two separate appointments, even if they share a product. Gabsor supports multi-entity setups from a single account — each entity gets its own Letter of Appointment, certificate, and privacy policy details, managed under one dashboard and one subscription with per-entity pricing. Tell us your group structure during onboarding and we will map out exactly which entities need coverage.

There is no lock-in: you can cancel at the end of your billing period. Two things matter when you do. First, if you remain in scope of Article 27, the obligation continues — you should have a successor representative appointed before the switch takes effect, and we hand over your case history and records in an exportable format to make that seamless. Second, your privacy policy must be updated to remove our details and name your new representative. If you are switching to Gabsor from another provider, the same process runs in reverse and typically completes within a day.

Article 27 doesn't have an approval or accreditation regime — a representative is established through your written mandate to a legally registered EU or UK entity. That's exactly what we are: GAB COMPLIANCE LTD in Dublin, Ireland (CRO 822233) as your EU representative and GAB COMPLIANCE LTD in London, UK (Companies House 17274988) as your UK representative, registered with the UK Information Commissioner's Office. Authorities correspond with a team that genuinely operates from Dublin and London, in the language the correspondence arrives in.

European data privacy professionals, based in Europe. Everything — from reading an authority letter to running our software platform — happens within Europe; nothing is outsourced overseas behind a European facade. Correspondence is handled in its original language, whether that's German from the BfDI, French from the CNIL, or English from the ICO and the Irish DPC. Where a matter requires legal advice, it is escalated to qualified legal counsel in Ireland. You can verify who we are: our entities and registrations are public, and the people answering your emails are the people named on this site.