How to Switch or Replace an EU GDPR Representative or GPSR Responsible Person

• Switching requires a new written mandate (GDPR Art. 27(1))
• Update privacy notices and product labels with new details
• Notify your old representative to end the previous mandate
• Check what’s included: request handling, certificates, support
• Prices and included services differ significantly by provider

Updated 29 October 2026 · 8 sources checked

Providers compared

Prices as published on each provider's website on 29 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires (GDPR Article 27, GPSR Article 16)

For companies outside the EU selling to or tracking people in the EU, GDPR Article 27(1) requires the appointment of an EU-based representative in writing. This representative acts as a contact point for data protection authorities and data subjects. The representative must be established in a Member State where the data subjects are located (Art. 27(3)). For product sellers, GPSR Article 16 requires a responsible person established in the EU to be named on product labels and documentation. These requirements apply to most non-EU companies offering goods or services to EU consumers or monitoring their behavior online. Exemptions exist under GDPR Article 27(2) for occasional processing, non-large-scale processing of special categories of data, and activities unlikely to create risks for individuals. Public authorities are also exempt. However, most regular online sellers and service providers will not qualify for these exemptions and must appoint a representative.

When switching representatives, the law does not specify a formal process for the transition, but you must ensure that your new representative is appointed in writing, and that all public-facing documents (such as privacy notices and product labels) are updated promptly. This ensures authorities and individuals can contact the correct representative at all times.

How to Choose a New Representative or Responsible Person

Choosing the right provider is critical for compliance and smooth operations. Start by confirming that the provider is legally established in the EU (for GDPR) or UK (for UK GDPR) and can provide a written mandate. Check if they cover all the countries where your customers are located, as required by GDPR Article 27(3). Assess what is included in the price: some providers, like REP27, offer a verifiable certificate, unlimited request handling, and ready-made text for privacy notices and product labels. Others may only provide a virtual address or charge extra for handling requests or issuing certificates.

Consider the provider's support model: REP27 promises human review and fast onboarding (within 24 hours), while others like rep4eu offer a 72-hour email response. EU Shield includes professional liability coverage, which may be relevant for companies seeking extra assurance. Gabsor and Usantis offer compliance tools and privacy policy snippets, which can be helpful for companies needing additional documentation support.

Always check the provider’s public registration, ability to issue certificates, and whether they charge extra for requests, certificates, or support. This will help avoid hidden costs and ensure ongoing compliance.

What the Price Really Includes

Published prices for GDPR and GPSR representative services can be misleading if you do not look closely at what is actually included. For example, REP27’s base price (from €290/year) covers the written mandate, a verifiable certificate, unlimited request handling, and ready-made text for your privacy notice or product labels. There are no stated extra fees for requests or certificates. In contrast, Usantis charges $30–80/month for a virtual address, but offers limited or no request handling—meaning that if authorities or data subjects contact them, you may need to pay extra or handle the request yourself. EU Shield’s €490/year fee includes an EU address, process service, ROPA storage, and professional liability coverage, but details on extra fees are not published. Rep4eu covers all 27 EU states and provides a signed designation letter and correspondence handling for €348/year, with support via email (72-hour response). Gabsor’s $79/month plan includes both EU and UK representation, compliance tools, and a privacy policy snippet, but support and extra fees are not detailed on their public page.

Always request a full breakdown of what is included, especially if you expect to receive frequent requests from authorities or data subjects, or if you need certificates for marketplaces. Some providers may charge extra for each request, each certificate, or for handling more than one entity or product line. Others may limit the number of supported users or team members. Transparency and verifiability are key—REP27, for example, provides a public verification page for every appointment, which is essential for regulatory checks and marketplace onboarding.

Hidden Costs and Exclusions

When switching or appointing a new representative, hidden costs and exclusions can cause compliance gaps or unexpected expenses. Some providers may advertise a low base price but charge extra for handling requests from authorities, issuing certificates, or supporting more than one legal entity or product. For example, Usantis’s published price covers only a virtual address, with limited or no request handling included. EU Shield and rep4eu do not publish details about extra fees or exclusions, so you must request this information before signing up. Gabsor’s plan includes compliance tools but does not specify if there are per-request or per-certificate charges.

REP27 clearly states that unlimited requests and certificate issuance are included in the price, but does not provide legal advice or court representation. This is a common exclusion—most representatives do not assume your legal liability or represent you in court. You remain responsible for compliance and for responding to regulatory investigations or enforcement actions. Notice periods for cancellation and minimum contract lengths are not always published, so clarify these terms before switching. If you are switching providers, ensure there is no overlap or gap in representation, as this could lead to non-compliance.

• Check for per-request or per-product fees
• Ask about notice periods for termination
• Clarify limits of liability and exclusions (e.g., no legal advice or court representation)
• Confirm if certificates and public verification are included

How the Appointment Works: Step by Step

Switching or appointing a new GDPR representative or GPSR responsible person involves several concrete steps. Here’s how to do it:

1. Identify your obligations: Use a provider’s free check or consult their onboarding team to confirm if you need a GDPR representative, GPSR responsible person, or both. REP27 offers a free review of your business activities and customer base.
2. Compare providers: Review the comparison table above and request detailed service descriptions and terms from each provider.
3. Onboard with the new provider: Complete their onboarding form, providing details about your company, products/services, and where you operate. REP27 performs a human review within 24 working hours.
4. Sign the written mandate: The provider will send you a mandate to sign. This is a legal requirement under GDPR Article 27(1) and GPSR Article 16.
5. Receive your certificate and supporting documents: REP27 sends a signed letter, a certificate with a QR code and verification code, and ready-made text for your privacy notice or product labels. Other providers may issue a signed designation letter or compliance badge.
6. Update your privacy notice and product labels: Replace the old representative’s details with your new provider’s information in all public-facing documents and online policies.
7. Notify your previous representative: Inform your old provider in writing that their mandate is terminated. This avoids confusion and ensures only your new representative is listed in official documents.
8. Retain all documentation: Keep copies of the signed mandate, certificate, and proof of updates to your privacy notice and labels. These may be requested by authorities or marketplaces.

Checklist to follow today:

1. Identify if you need a GDPR/GPSR representative
2. Compare providers and request full service details
3. Onboard and submit required documents
4. Sign the mandate and obtain certificate
5. Update all public-facing notices/labels
6. Inform your old provider in writing
7. Retain proof of appointment and updates

Risks, Fines, and What Providers Usually Do Not Say

Failing to appoint or update your EU representative or responsible person can result in serious regulatory consequences. Under GDPR, authorities may contact your representative directly (Article 27(4)), and if they cannot reach you or your representative, you may face investigations or fines. Appointment of a representative does not transfer your legal liability—GDPR Article 27(5) makes it clear that you remain responsible for compliance and any enforcement action taken by authorities. The same principle applies under the GPSR for product compliance.

Providers rarely highlight certain exclusions and risks:

• Exclusions of liability: Representatives do not take on your legal responsibility or pay fines on your behalf.
• Notice periods for cancellation: Some providers may require advance notice to terminate your contract; this is not always stated upfront.
• Per-request or per-product fees: Some providers may charge extra for handling requests, issuing certificates, or supporting multiple products or entities.
• Service limitations: Most representatives do not provide legal advice or court representation. You must engage a law firm separately if you need legal defense or advice.

To minimize risks:

• Ensure your provider issues a verifiable certificate and is established in the required jurisdiction
• Keep your privacy notice and product labels up to date
• Retain all documentation and proof of compliance

Realistic Scenarios: What to Do

• US SaaS company with EU users: You process personal data of EU residents but have no EU office. You must appoint a GDPR representative in the EU. Choose a provider (e.g., REP27, rep4eu), complete onboarding, sign the mandate, update your privacy notice with the new contact details, and keep the certificate for verification by authorities or clients.
• Chinese Amazon seller shipping to EU: You sell consumer products directly to EU customers via Amazon. You must appoint a GPSR responsible person in the EU and display their details on your product labels. Choose a provider (e.g., REP27), sign the mandate, update your labels, and keep the certificate for marketplace checks. If you already use an EU-based importer, you may not need a separate responsible person.
• UK online shop selling to EU: You sell both digital services and physical goods to EU customers. You need both a GDPR representative and a GPSR responsible person. One provider can cover both roles (e.g., REP27), but you must sign separate mandates for each obligation. Update your privacy notice and product labels, and retain all certificates and supporting documents.

In all scenarios, ensure you follow the step-by-step checklist above and clarify with your provider what is included in the price and what support is available if you receive requests from authorities or data subjects.