How US Companies Selling in France Can Appoint an EU GDPR Article 27 Representative

• GDPR Article 27 requires non-EU companies offering goods/services or monitoring individuals in the EU to appoint an EU representative.
• Exemptions exist for occasional, low-risk, non-sensitive processing and public authorities.
• REP27, EU Shield, and rep4eu are established providers with different prices and service inclusions.
• The representative must be in an EU country covering your customer base (e.g., France).
• Non-compliance can result in administrative fines under GDPR Article 83.
• Providers differ in speed, transparency, and included compliance support.

Updated 27 October 2026 · 5 sources checked

Providers compared

Prices as published on each provider's website on 27 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article 27 GDPR Explained

GDPR Article 27 is a cornerstone for non-EU businesses interacting with EU residents. If your US company offers goods or services to people in France or elsewhere in the EU, or monitors their behavior (e.g., via analytics, cookies, or targeted marketing), you must appoint a representative established in the EU. This applies whether you sell through your own website, a marketplace like Amazon, or even by direct outreach.

Article 27(1) requires a written mandate for the representative, who acts as your local contact for EU data subjects and supervisory authorities. The representative must be established in an EU member state where your customers are located (Article 27(3)), so for France, your representative must be in an EU country covering French data subjects. The representative’s details must appear in your privacy notice and be accessible to both individuals and authorities.

There are exemptions (Article 27(2)): you do not need a representative if your processing is only occasional, does not include large-scale processing of special categories of data (like health, race, or religion) or criminal data, and is unlikely to risk individuals’ rights and freedoms. Public authorities are always exempt (Article 27(2)(b)).

Failure to appoint a representative can result in administrative fines under Article 83, which covers infringements of the GDPR. There is no grace period: you must appoint a representative as soon as you are subject to the GDPR due to your activities.

• Key legal references: GDPR Article 27, GDPR Article 83

How to Choose an EU Representative: Decision Matrix and Practical Considerations

Choosing the right EU representative is critical for compliance and business continuity. The provider must be established in an EU member state where your data subjects are located, and should offer verifiable, transparent, and prompt service. Consider your business model, customer base, and the level of compliance support you need.

Practical tips:

• Check if the provider’s address and company details are publicly verifiable (important for trust and marketplace acceptance).
• Consider the speed of appointment and whether you receive a certificate or public verification (useful for marketplaces and audits).
• Evaluate if you need extras like Article 30 record custody or annual compliance reviews.
• For multi-jurisdiction sales (EU and UK), consider providers that offer both services in one contract.

What the Price Really Includes: Detailed Provider Comparison

EU representative services vary widely in what is included for the published price. Some offer only the basic legal appointment, while others bundle compliance extras. Below is a detailed comparison based on available data:

REP27’s base price covers the essentials for GDPR Article 27: a signed designation, certificate with QR code (helpful for marketplaces), public verification, and privacy notice wording. EU Shield includes Article 30 record custody and an annual compliance review—valuable for companies needing ongoing compliance support. rep4eu highlights live coverage and market entry support, but does not specify extras in the available data.

Always confirm what is included and request a contract or terms of service before purchase. Some features (e.g., record keeping, compliance reviews) may be optional or cost extra.

Hidden Costs, Exclusions, and What Providers Usually Do Not Say

While published prices may seem straightforward, hidden costs and exclusions are common. Here’s what to watch for, based on available data:

• Article 30 record keeping: Not included by REP27, included by EU Shield. If you need your records of processing activities managed, check if this is part of the package.
• Annual compliance review: Included by EU Shield, not by REP27 or rep4eu. This can be important for ongoing compliance, especially if your business or data processing changes frequently.
• Additional services: Appointments for product responsible person (GPSR), cosmetics, AI Act, etc., are separate and priced individually by all providers.
• Notice periods and per-request fees: Not specified in the available data. Some providers may require notice before cancellation or charge for additional tasks—always review the contract.
• Liability limits: Article 27(5) states the representative is not liable for your GDPR breaches. Providers rarely highlight this, but it means you remain responsible for compliance and any fines.

Practical advice:

• Request a full list of included and excluded services before signing.
• Ask about notice periods, per-request fees, and support response times.
• Be wary of providers that cannot prove their establishment in the EU or whose company details are not publicly verifiable.

How Appointment Works: Step-by-Step Checklist for US Companies

1. Assess your obligations: Use the decision matrix above to determine if you need an EU representative. If in doubt, consult a compliance expert or use a provider’s free check tool.
2. Choose a provider: Compare REP27, EU Shield, and rep4eu for price, included features, and transparency. Ensure the provider is established in an EU country covering your customer base.
3. Prepare your file: Gather your company’s legal name, establishment address, contact details, description of your processing activities, and details about your EU customers (e.g., which countries, volume, nature of data).
4. Submit to provider: Send your file to the provider. REP27 performs a human review within 24 working hours; timelines for others may vary.
5. Receive designation and certificate: Once approved, the provider signs the designation. REP27 issues a certificate with a QR code and public verification page. Use these for marketplaces and audits.
6. Update your privacy notice: Insert the representative’s name, address, and contact details in your privacy notice, as provided by the provider.
7. Maintain documentation: Keep the designation, certificate, and any correspondence for authorities and marketplace requests.
8. Review annually: If your processing changes or you expand into new EU countries, update your representative appointment as needed.

Checklist for today:

1. Review your EU sales and data processing activities.
2. Select and contact a provider.
3. Prepare and submit your company file.
4. Receive and implement your designation and certificate.
5. Update your privacy notice and inform your team.

Risks, Fines, and Enforcement: What Happens If You Ignore Article 27?

Non-compliance with GDPR Article 27 carries significant risks. Supervisory authorities in any EU country where you have customers can investigate and enforce the requirement. Fines for non-compliance are covered under GDPR Article 83, which allows for administrative fines up to 20 million euros or 4% of global turnover for the most serious infringements. While failure to appoint a representative is not always treated as a top-tier violation, it can lead to:

• Direct fines for non-compliance with Article 27
• Orders to stop processing or selling in the EU until compliant
• Removal or suspension from marketplaces (Amazon, Etsy, eBay) if you cannot prove compliance
• Loss of trust with EU customers and partners

Authorities may contact your representative directly, but they can also pursue your company for enforcement and fines. The representative is not liable for your actions (Article 27(5)), but is your official contact point for all GDPR matters in the EU. Providers rarely highlight that you remain fully responsible for compliance and any resulting penalties.

To minimize risk:

• Appoint a representative as soon as you begin offering goods/services or monitoring individuals in the EU
• Keep your documentation up to date and accessible
• Respond promptly to any requests from your representative or authorities

Realistic Scenarios: Which Obligation Applies and Simplest Compliant Route

• Scenario 1: US SaaS company with French users
  Your SaaS platform collects analytics and offers services to users in France. You must appoint an EU GDPR Article 27 representative. The simplest route: choose a provider (e.g., REP27), submit your company and processing details, receive your signed designation and certificate, and update your privacy notice. No exemption applies unless your processing is truly occasional and low-risk.
• Scenario 2: Chinese Amazon seller shipping to France
  You sell physical products to French customers via Amazon. You need both a GDPR Article 27 representative (for personal data processing) and a GPSR responsible person (for product safety compliance). These are separate appointments and fees. Choose providers that offer both services (REP27 covers both), and ensure your product labels and privacy notices are updated accordingly.
• Scenario 3: UK online shop with French customers
  Post-Brexit, your UK-based shop sells to France. You are considered a non-EU business and must appoint an EU GDPR representative. Select a provider, complete the appointment, and update your privacy notice. If you also sell to the UK, consider a provider offering both EU and UK representation for efficiency.

In all cases, keep documentation ready for authorities and marketplaces. If you only sell B2B and never process EU individual data, or your processing is truly occasional and low-risk, you may not need a representative. When in doubt, consult a compliance expert or use a provider’s eligibility check.