Frequently Asked Questions

An EU Representative is a natural or legal person established in the EU who acts on behalf of a non-EU controller or processor under GDPR Article 27. They are your official point of contact for:

• EU supervisory authorities
• Individuals exercising their rights
• Formal compliance communications

The representative is your legal presence in the EU for Article 27 obligations.

Most likely, yes. If you meet any of these criteria:

• You offer goods or services to EU residents (even for free)
• You monitor the behavior of EU residents (analytics, tracking, profiling)
• You process personal data of EU-based individuals
• You do not have an established entity in the EU

GDPR Article 27 explicitly requires most non-EU companies in this situation to designate a representative. This is a legal mandate, not optional.

Non-compliance can have serious consequences:

• GDPR fines: Up to €20 million or 4% of global annual revenue
• Regulatory exposure: Formal investigations can begin from complaints
• Market access risk: Enterprise customers may block vendors with visible compliance gaps
• Legal action: EU authorities and consumers can pursue legal remedies
• Reputation: Significant damage to your brand's trustworthiness

No. One EU Representative covers all 27 EU member states. You designate a representative in one Member State and that designation is recognized across the EU/EEA.

This is one of the advantages of the EU's harmonized regulatory approach — one point of contact for the entire bloc.

We provide comprehensive representation services:

• Official designation: We become your named GDPR Article 27 representative
• Authority correspondence: We receive communications from EU supervisory authorities and forward them to you promptly. Correspondence from German authorities is handled in German.
• Documentation: We maintain the Article 30 record on the representative side and provide it to a supervisory authority on request
• Subject requests: We receive and forward data subject requests to you
• Designation letter: A signed designation letter within 24–48 hours of verification, refreshed on your plan's cadence
• Email support: Answers about your designation and forwarded messages, in English or German (72-hour target on Essential, 48 hours on Business, business days)

Substantive legal work is not part of the subscription — see "What is not included?" below.

The subscription does not include the substantive response to a data subject or a supervisory authority. Article 27 does not transfer that responsibility. Under Article 27(5) GDPR it remains with you as controller or processor, and appointing a representative does not by itself make you GDPR compliant.

Not included in the annual fee:

• Drafting or filing responses to supervisory authority inquiries
• Legal risk assessments
• Incident or breach response handling
• Data protection officer services
• Drafting or reviewing privacy notices, records of processing or other compliance documents

Legal support is available from FX Legal, the law firm of the attorneys involved in rep4eu, as a separate engagement: on your instruction, at agreed rates, with the scope and cost approved in writing before any work starts. See Section 3 of our Terms of Service.

Yes. We operate as an established EU legal entity with full legal capacity to act as a GDPR Article 27 representative.

Why this matters:

• Authorities need a real, reachable representative
• Data subjects must have a practical EU contact point
• Your contracts and privacy notices must name a legitimate EU entity

We can typically complete the setup within 24-48 hours of receiving your documentation. The process is:

1. You sign up and provide company information
2. We review and prepare designation documents
3. Both parties sign the representative agreement
4. You update your privacy policy/legal notices to name us
5. We notify relevant authorities if required

The designation letter applies from the date your first payment was confirmed. Do not name rep4eu in your privacy notice before you have the letter.

It depends on the structure:

• If your EU establishment already processes data on behalf of the parent company, you may not need a separate Article 27 representative for GDPR
• Many groups still choose an external representative to reduce operational and conflict risks
• Privacy notices and record-keeping still need to be consistent and audit-ready

We offer a free assessment to help you determine your exact obligations. Contact us to discuss your specific situation.

Authorities look at factual indicators that your business serves EU residents, such as:

• Shipping or service delivery to EU countries
• EU customers in your CRM or billing data
• Marketing activity reaching EU audiences
• Localized terms, currencies, or onboarding flows for EU users
• Tracking and analytics on EU visitors

Even a single EU customer can trigger obligations depending on your processing activities.

Not automatically. Article 27 is based on your processing context, not your headcount. Exemptions are narrow and usually require all of the following:

• Processing is genuinely occasional
• Processing is unlikely to create risk to rights and freedoms
• No large-scale processing of special categories of data

Most SaaS, ecommerce, and recurring-service models do not qualify for this exemption in practice.

Regulatory timelines depend on authority workload and case severity, but action can start quickly when:

• A data subject files a complaint
• A breach or incident becomes public
• Authorities perform a targeted inquiry

Having a representative already in place is the fastest way to reduce immediate exposure.

We offer two self-service plans designed for different needs:

Essential (€348/year$480/year£360/yearCHF 396/yearAED 1,752/yearAUD 684/yearSGD 612/yearR$2,472/year₹45,612/yearCAD 684/year, one annual charge): Full Article 27 representation across all 27 EU member states with 72-hour email support and an annual designation letter refresh.

Business (€696/year$960/year£720/yearCHF 792/yearAED 3,504/yearAUD 1,368/yearSGD 1,224/yearR$4,944/year₹91,224/yearCAD 1,368/year, one annual charge): Everything in Essential, with faster 48-hour email support and a semi-annual designation letter refresh.

For larger organizations, we also offer Enterprise plans with dedicated account management and custom documentation. Contact us for details.

See our pricing page for a detailed comparison.

No. We offer upfront annual billing only. Payment is due once per year for the selected plan. This keeps pricing simple and aligned with our compliance service period.

Twelve-month term, renewing automatically. Cancel up to one month before your renewal date and your representation runs to the end of the term you have already paid for.

The binding wording is in Section 7 of our Terms of Service.

Payments are non-refundable and we do not provide prorated credits for partially used service periods.

Yes! We offer special pricing for:

• Early-stage startups: 20% discount for companies with less than $1M in funding
• Nonprofits: 25% discount for registered 501(c)(3) organizations
• Volume: Discounts for companies with multiple entities

Contact us to discuss your situation.

The difference is critical when regulators come knocking:

• Mailbox service: Provides a postal address, scans mail, and forwards it to you. Often a virtual office or an offshore entity with no one accountable behind the address.
• rep4eu: A registered German GmbH with a real registered office in Erftstadt, with two lawyers admitted in Germany involved in running the service. We hold the designation, receive and forward authority and data subject correspondence, handle German correspondence in German, and maintain the Article 30 record on our side.

The substantive response to an authority or a data subject remains your responsibility in both models. What differs is who accepted the mandate — and, with rep4eu, that legal support is one instruction away as a separate engagement.

GDPR doesn't require your representative to be a lawyer. What matters is who accepted the mandate, because under Recital 80 the representative can itself be the target of enforcement.

• Your designation is held by Cloudkasten GmbH, a registered German GmbH, and two lawyers admitted in Germany are involved in running rep4eu
• The subscription itself is representation, receipt and forwarding, and record-keeping — not legal advice
• If you need a legal assessment or help drafting a response, the attorneys' law firm can take that on as a separate engagement, with scope and cost approved in writing first

Both attorneys are licensed German Rechtsanwälte with decades of data protection experience.

New EU regulations are expanding representative requirements beyond GDPR:

• Digital Services Act (DSA): Article 13 requires non-EU digital service providers to appoint an EU legal representative
• EU AI Act: Article 54 mandates non-EU AI providers to designate an authorised representative before placing AI systems on the EU market
• Swiss FADP: Article 14 introduces representative requirements similar to GDPR for non-Swiss controllers

The rep4eu subscription covers GDPR Article 27 only. Contact us if you need to discuss what the other regimes require.