How to Switch or Replace Your EU GDPR Representative or GPSR Responsible Person

• Switching requires a new written mandate and updated documentation.
• GDPR Article 27 and GPSR require EU-based representation for non-EU businesses.
• Provider services and inclusions vary—compare carefully before switching.
• REP27 offers fast, verifiable certificates and public verification.
• Exemptions exist for occasional, low-risk processing, but most sellers need a rep.

Updated 27 October 2026 · 5 sources checked

Providers compared

Prices as published on each provider's website on 27 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article 27 GDPR and GPSR Explained

Under Article 27 of the General Data Protection Regulation (GDPR), any business not established in the EU that offers goods or services to people in the EU, or monitors their behavior, must appoint a representative in the Union. This representative acts as a local point of contact for data subjects and supervisory authorities. The representative must be established in one of the EU Member States where the data subjects are located. The appointment must be made in writing, and the representative’s details must be published in your privacy notice. Exemptions exist for processing that is occasional, does not involve large-scale special category or criminal data, and is unlikely to create risk for individuals. Public authorities are also exempt.

The General Product Safety Regulation (GPSR), Regulation (EU) 2023/988, requires non-EU manufacturers and sellers of consumer products to appoint a responsible person in the EU. This person’s name and address must appear on product labels and be available to authorities and marketplaces. The responsible person ensures product compliance, handles documentation, and acts as a contact for safety issues. Not appointing a representative or responsible person can result in fines, product delisting, or blocked sales.

• GDPR Article 27: Applies to non-EU controllers/processors offering goods/services or monitoring behavior in the EU.
• GPSR Article 16: Applies to non-EU manufacturers and sellers of consumer products.
• Key requirements: Written mandate, EU establishment, public contact details, and timely response to authorities.

For both GDPR and GPSR, the representative or responsible person does not assume your legal liability but is a mandatory point of contact for compliance and enforcement. Failing to appoint or update your representative can lead to significant business and legal risks.

How to Choose a New Representative or Responsible Person

When switching your EU GDPR representative or GPSR responsible person, it is crucial to select a provider that meets both legal requirements and your business needs. Here are the main factors to consider:

• EU Establishment: The provider must be established in an EU Member State where your customers are located. For example, REP27’s mandates are signed by Europe Services SE in Prague, Czech Republic, covering all EU countries.
• Speed and Documentation: How quickly can the provider issue a new mandate and certificate? REP27 and GDPR Gateway Limited both promise designations within 24 hours after receiving complete information.
• Scope of Service: Does the provider cover all your obligations (GDPR, GPSR, cosmetics, AI Act, etc.)? Some, like REP27, offer multi-service coverage with separate certificates for each regulation.
• Transparency and Verification: Can anyone verify your appointment online? REP27 provides public verification, which is valuable for authorities and marketplaces.
• Included Services and Support: Check if the price includes privacy notice wording, product label details, compliance reviews, or support for multiple products/entities.

Always request a clear service description and ask about any extra fees, notice periods, or limits on support. If you need to cover both GDPR and GPSR, confirm that your provider can issue separate, verifiable certificates for each obligation.

What the Price Really Includes (and Hidden Costs)

Published prices for GDPR and GPSR representation vary widely, from €290/year (REP27) to €860/year (GDPR Gateway Limited), or $79/month (Gabsor). However, the actual value depends on what is included in the base price and what might incur extra costs. Here’s how to assess the real cost:

• Mandate and Certificate: All listed providers include a written mandate and confirmation letter. REP27 and GDPR Gateway Limited offer certificates and privacy notice wording.
• Public Verification: REP27 offers public verification of your appointment, which is essential for transparency with authorities and marketplaces. Others may not specify this feature.
• Annual Renewal: Most providers charge annually and require renewal to maintain compliance. GDPR Gateway Limited explicitly includes annual renewal confirmation.
• Product or Entity Limits: REP27’s GPSR responsible person service covers unlimited products per plan, while other providers may have limits (not specified—ask before signing).
• Compliance Tools: Gabsor includes compliance badges, Trust Center, and ROPA builder, which may be useful for some businesses but are not legal requirements.
• Hidden Fees: Some providers may charge extra for additional entities, team members, or per-request support. Always ask for a detailed breakdown and written confirmation of what is included.

Providers rarely advertise notice periods for switching or per-incident support fees. If you anticipate frequent changes or high regulatory contact, clarify these terms in advance. For product sellers, ensure that label updates and documentation changes are included in the service.

How Appointment and Switching Works: Step-by-Step Guidance

Switching your EU GDPR representative or GPSR responsible person is a multi-step process that requires careful coordination to avoid compliance gaps. Here’s a practical, step-by-step guide:

1. Identify Your Obligations: Use a compliance check (such as REP27’s free review) to confirm which regulations apply: GDPR, GPSR, cosmetics, AI Act, etc.
2. Choose a New Provider: Select a provider established in the required EU country, with a service scope matching your needs. Compare speed, documentation, and included features.
3. Complete Onboarding: Fill out the provider’s onboarding form with company details, establishment, and product or service information. REP27 and others review your file before signing.
4. Mandate Signature: The provider issues a written mandate, usually within 24 hours for REP27 and GDPR Gateway Limited. You receive a signed letter, certificate, and privacy notice or label wording.
5. Update Documentation: Immediately update your privacy notice, website, and product labels with the new representative’s details. Use the exact text provided by your provider.
6. Notify Previous Provider: Inform your old representative or responsible person that you are switching. Check if your contract requires a notice period or formal termination.
7. Redirect Regulatory Contacts: Ensure all correspondence from authorities, marketplaces, or consumers is redirected to your new representative. For product sellers, update your Amazon, eBay, or marketplace account details.
8. Keep Records: Store your new certificate, mandate, and correspondence for audit purposes. Use public verification links if available (as with REP27).

Checklist for Switching:

1. Confirm which obligations you must cover.
2. Compare providers for EU establishment, speed, and inclusions.
3. Sign a new mandate and receive documentation.
4. Update all public-facing materials (privacy notice, labels, marketplace accounts).
5. Notify your previous provider and redirect contacts.
6. Retain proof of compliance and verification certificates.

Switching is straightforward but must be managed carefully to avoid compliance gaps or confusion for authorities and customers.

Risks, Fines, and What Happens If You Get It Wrong

Failing to appoint or properly update your EU GDPR representative or GPSR responsible person carries significant risks. Under GDPR Article 83, non-compliance can result in administrative fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher. Product regulations like GPSR can also lead to product delisting, blocked sales, or recalls if you lack a valid responsible person in the EU.

• Regulatory Fines: Supervisory authorities can impose substantial fines for missing or invalid representation. These penalties apply even if your business is outside the EU.
• Marketplace Consequences: Marketplaces such as Amazon and eBay require proof of a valid responsible person for product listings. Failure to update this information can result in product removal or account suspension.
• Business Disruption: Without a valid representative, authorities may block imports, delay shipments, or refuse to process regulatory requests. This can halt your EU business operations.
• Liability: The representative does not assume your liability. You remain responsible for compliance, data protection, and product safety. Legal actions can still be initiated against your business directly.
• Reputational Risk: Lack of transparency or failure to respond to regulatory requests can damage your reputation with customers, partners, and authorities.

To avoid these risks, ensure your new provider is established in the required EU country, offers public verification, and covers all your obligations. Keep all documentation up-to-date and respond promptly to any regulatory inquiries.

Decision Matrix: Who Needs an EU Representative or GPSR Responsible Person?

Not every business needs an EU GDPR representative or GPSR responsible person. Use this matrix to determine your obligations:

Exemptions apply for public authorities and for processing that is occasional, low-risk, and does not involve special categories or criminal data. Most regular sellers to the EU, especially those using online marketplaces or handling consumer data, must appoint a representative or responsible person.

What Providers Usually Do Not Say

• REP27: Does not provide legal advice or court representation; only the legal representative/responsible person role is covered. Clients remain responsible for compliance and regulatory responses.
• Notice Periods: Most providers do not specify minimum contract terms or notice periods for switching. Always request these terms in writing to avoid overlap or gaps in representation.
• Per-Request Fees: Extra charges for additional support, document updates, or urgent requests are rarely advertised. Ask for a full fee schedule before signing.
• Liability Limits: The representative does not assume your legal liability. You must maintain your own compliance and respond to regulatory actions.
• Documentation Updates: Changing provider requires immediate updates to privacy notices, labels, and marketplace accounts. Failure to update can result in non-compliance or product delisting.
• Verification: Not all providers offer public verification of your appointment. This feature is important for transparency with authorities and marketplaces.

Before appointing or switching providers, clarify all terms, fees, and support limits in writing. Ensure your new provider’s details are published and verifiable as required by law.

Realistic Scenarios: What Applies and What to Do

• Scenario 1: US SaaS Company with EU Users
  A US-based SaaS platform collects personal data from EU users. It does not have an EU establishment. The company must appoint an EU GDPR representative. REP27, EU Shield, Gabsor, or GDPR Gateway Limited can be chosen. After switching, the company updates its privacy notice with the new representative’s details and keeps the certificate for audits.
• Scenario 2: Chinese Amazon Seller Shipping to EU
  A Chinese manufacturer sells consumer products to EU customers via Amazon. The seller must appoint a GPSR responsible person for product labels and, if collecting customer data, a GDPR representative. REP27 covers both obligations. The seller updates Amazon account details and product labels after switching providers, ensuring ongoing compliance and uninterrupted sales.
• Scenario 3: UK Online Shop Selling to EU
  A UK-based online retailer sells directly to EU consumers. Post-Brexit, the UK is not part of the EU, so the shop must appoint an EU GDPR representative. The retailer selects a provider, signs a new mandate, updates its privacy notice, and informs the previous representative. If selling physical products, it may also need a GPSR responsible person.

In all scenarios, the key steps are: appoint a compliant provider, update all required documentation, and keep proof of compliance accessible for authorities and marketplaces.