rep4eu acts as your EU representative if GDPR Article 27 applies to your business outside the EU: a written designation, EU contact details and forwarding of what regulators and individuals send.
Plans from €348/year$480/year£360/yearCHF 396/yearAED 1,752/yearAUD 684/yearSGD 612/yearR$2,472/year₹45,612/yearCAD 684/year, billed annually. Any VAT is shown at checkout.
Operated by Cloudkasten GmbH, a registered company in Germany, with German-admitted lawyers involved in running the service.
Article 27 applies to controllers and processors established outside the EU whose processing falls under Article 3(2) of the GDPR. The test is what you do with the personal data of people in the EU, not the size of your company.
Payment is not required: free tiers and trials count. What matters is whether you evidently intend to serve people in one or more EU countries, for example:
A website that can merely be reached from the EU, or an email address, is not enough on its own (Recital 23).
Recital 24 asks whether people are tracked online, including profiling to make decisions about them or to analyse or predict their preferences and behaviour. The EDPB’s examples include:
This can apply without any EU sales, as long as the behaviour being tracked takes place in the EU.
Where the duty applies and no representative is designated, supervisory authorities can impose fines under Article 83(4)(a) of up to €10 million or 2% of worldwide annual turnover, whichever is higher. In 2021 the Dutch authority fined LocateFamily.com €525,000 for not designating one.
Location matters as well. Article 27(3) requires the representative to be established in a member state where the people whose data you process are. rep4eu is established in Germany, so it suits businesses whose EU activities include people in Germany.
The free check gives an indication, not legal advice.
Read the Article 27 regulations guide for the statutory detail, or whether B2B SaaS triggers the GDPR. By sector: SaaS, ecommerce, fintech, healthtech. By country: United States, United Kingdom, Canada, UAE, Switzerland, or all industries and countries.
Every plan includes the service below. Essential and Business differ only in support response targets and in how often your letter is re-issued.
A PDF naming your company as controller or processor and Cloudkasten GmbH as your EU representative, with the effective and expiry dates of your term. It is the written designation Article 27 requires, and you can show it to authorities, customers and auditors.
Our postal address in Erftstadt, Germany, and a dedicated forwarding email address for your privacy notice, with ready-to-use wording in English and German.
Emails are forwarded to your GDPR contact automatically, typically within minutes and at the latest the next business day. Post is scanned and forwarded within three business days. Each item is logged in your portal.
If an authority contacts us about you, we inform you promptly, forward the request in full, confirm that we are your representative and coordinate next steps with you. On your written instructions we relay your response. Correspondence from German authorities is handled in German.
We maintain the record of processing activities required under Article 30, based on the information and updated records you supply, and make it available to supervisory authorities on request.
Answers about your designation, the privacy-notice wording and forwarded messages: 72-hour target on Essential, 48 hours on Business, in business days. Your portal holds every letter version and the communications log, and links to your invoices.
Full scope: Terms of Service, sections 2 and 3.
Supervisory authorities and individuals in the EU can address your representative in addition to or instead of you (Article 27(4)). This is what happens next.
Messages arrive at your forwarding address or at our office in Erftstadt. Each one is recorded in your portal log with sender, subject and time.
Emails reach your named GDPR contact automatically, typically within minutes and at the latest the next business day. Post is scanned and forwarded within three business days.
Only you hold the data and decide what happens to it. For data subject requests, Article 12(3) gives you one month from receipt, extendable by two further months where necessary if you tell the person within the first month. For authorities, we confirm that we are your representative and relay your response on your written instructions.
If a matter needs legal judgement, the attorneys’ law firm can take it on as a separate engagement, with scope and cost agreed in writing first. We tell you when a request goes beyond the subscription.
Designating a representative does not give you a main establishment in the EU, so the one-stop-shop mechanism of Article 56 does not apply to you, and any supervisory authority can address your representative (Recital 80).
Further reading: handling a supervisory authority inquiry · managing data subject requests · representative vs EU establishment
Article 27(1) requires the designation to be in writing. Payment alone does not complete it: your representation starts once your company is verified and your designation letter is issued.
Review the conditions on this page or take the free check. It gives an indication, not a legal determination; if an exemption might apply to you, ask your own adviser.
Take the free checkGive your legal entity name, country of incorporation and email, then pay the annual fee through Stripe. Right after payment, add the registered address, registration number and a contact for GDPR correspondence.
View plansWe check that your company exists and that your details match public records, automatically where possible and otherwise from incorporation documents you upload. Automated checks are typically completed within 24 hours and manual reviews within 48 hours, counted in business days. We may ask for more information.
After successful verification we accept the designation and issue your letter. It applies from the subscription start date it states, which is the date your first payment was confirmed. Until the letter is issued, do not name rep4eu as your representative.
Name rep4eu in your privacy notice using the wording from your letter, as Articles 13(1)(a) and 14(1)(a) require; our Terms ask you to do this within 14 days of receiving the letter. Add the representative to your Article 30 records too.
If we cannot verify your company, or decline the designation, the contract ends and we refund the fee for the current term in full, unless the failure results from false or misleading information you provided (Terms, section 4).
Articles 13(1)(a) and 14(1)(a) require your privacy notice to give the identity and contact details of your representative. Your designation letter contains the exact wording in English and German, with your dedicated forwarding address. It follows this pattern:
EU representative (Article 27 GDPR)
[Your legal entity] has designated the following
representative in the European Union pursuant to
Article 27 GDPR:
rep4eu — Cloudkasten GmbH
Seestr. 20 G
50374 Erftstadt
Germany
[your forwarding address]@rep4.eu
Individuals in the EU and supervisory authorities
may contact our EU representative on all issues
related to our processing of personal data, in
addition to contacting us directly.Also add the representative to your Article 30 records and to any vendor questionnaire that asks for it. More on the document itself: what an Article 27 designation letter contains.
One fixed annual fee per plan, paid in advance. Every plan includes the full Article 27 service described above, for every EU member state and the EEA.
Article 27 representation for one company, with the full service and email support.
Choose EssentialFor teams in procurement and security reviews, where response speed and a recently dated letter matter.
Choose BusinessFor groups with several entities, or documentation that has to fit an existing compliance programme.
Request a quotePlans are billed annually in advance. Twelve-month term, renewing automatically. Cancel up to one month before your renewal date and your representation runs to the end of the term you have already paid for. Fees for time already paid are not refunded. No setup fees; any VAT is shown at checkout. For businesses only. Terms, sections 6 and 7.
These roles are often confused, and each has its own legal basis. rep4eu provides the first one only.
Your contact point in the EU for supervisory authorities and individuals, designated in writing and acting on your mandate. It does not advise you or take over your responsibility.
An independent function that informs and advises you and monitors your compliance, required only in the cases in Article 37. The EDPB considers the representative role incompatible with that of an external DPO established in the EU. Representative vs DPO.
Advice on your processing, audits, impact assessments and transfers, and drafting privacy notices, records or responses. Not part of the subscription; the attorneys’ law firm offers it as a separate engagement. Representative vs legal counsel.
A business outside the UK that offers goods or services to people in the UK, or monitors their behaviour there, may need a separate representative in the UK. rep4eu does not provide it. UK businesses that need an EU representative can use rep4eu.
Other representative duties, such as under the Swiss data protection act (Switzerland), the Digital Services Act or the AI Act, are separate appointments. Comparing EU representative providers? See Prighter, DataRep, VeraSafe, EDPO or all comparisons.
Statements about the law link to official texts and regulator guidance. Statements about the service summarise our Terms of Service and the designation letter.
Last updated 22 September 2026. Service details on this page summarise our Terms of Service and the designation letter. This page is general information about the Article 27 designation duty, not legal advice. Questions about the service? Contact us.
A written Article 27 designation, EU contact details and forwarding of every regulator and data subject message, from a registered company in Germany. Plans from €348/year$480/year£360/yearCHF 396/yearAED 1,752/yearAUD 684/yearSGD 612/yearR$2,472/year₹45,612/yearCAD 684/year, billed annually.