How to Verify Your GDPR EU Representative or GPSR Responsible Person

• Article 27 GDPR requires a written, verifiable EU representative for non-EU companies.
• REP27 provides a certificate with online verification for each appointment.
• Check company details in public registers for authenticity.
• Compare what is included: not all providers offer public verification.
• Exemptions apply for occasional, low-risk processing only.

Updated 2 November 2026 · 6 sources checked

Providers compared

Prices as published on each provider's website on 2 November 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article 27 GDPR and GPSR

For any business outside the EU or UK that targets European customers, understanding the legal requirements for appointing a representative is essential. Article 27 of the General Data Protection Regulation (GDPR) obliges controllers and processors without an EU establishment to designate a representative in writing, established in a member state where the data subjects are located. This representative acts as a local contact for authorities and individuals regarding data protection matters. The General Product Safety Regulation (GPSR) similarly requires a responsible person for non-EU product sellers, ensuring there is a local, accountable contact for product safety issues.

• Article 27(1): Controllers/processors outside the EU must appoint a representative in writing.
• Article 27(3): The representative must be established in a relevant EU member state.
• Article 27(4): Supervisory authorities and data subjects may contact the representative in addition to or instead of the controller/processor.
• Article 27(2): Exemptions exist for processing that is occasional, not large-scale, and unlikely to risk individuals' rights and freedoms.
• GPSR: Requires a responsible person for product compliance and safety for non-EU manufacturers placing products on the EU market.

Failure to comply with these requirements can result in significant administrative fines: up to €20 million or 4% of annual global turnover, whichever is higher, for GDPR breaches. The rules are designed to ensure that EU authorities and consumers always have a reliable, local point of contact for data protection and product safety issues, even when the actual business is located outside the EU.

For companies selling to the EU via online platforms or directly, appointing a compliant, verifiable representative or responsible person is not just a formality—it is a legal necessity. Always check the official text or consult a specialist to confirm which obligations apply to your business model and data flows.

How to Choose and Verify a Real, Active Representative

Choosing a legitimate GDPR or GPSR representative is critical for compliance and for building trust with EU authorities, marketplaces, and customers. Here’s how to ensure your provider is real and active:

1. Certificate with Public Verification: The most robust proof is a signed certificate with a QR code or unique verification link. REP27 issues such certificates, allowing anyone (including authorities and marketplaces) to instantly confirm the appointment’s validity online. Always request a sample before committing.
2. Check Company Details in Public Registers: Verify the provider’s legal entity in the relevant country’s public register. For example, REP27’s EU appointments are signed by Europe Services SE, which is registered in Prague and can be confirmed in the Czech commercial register. This transparency is crucial; a provider that cannot be publicly checked may not be accepted by authorities.
3. Confirm Scope and Validity: Ensure the certificate or mandate clearly states the type of appointment (GDPR, GPSR, etc.), the covered period, and the legal entity responsible. Public verification pages should display the client’s name, the service, and validity dates, but not sensitive internal data.
4. Direct Contact: Reliable providers publish their contact details and respond to verification requests. If you receive a document that cannot be verified or does not name the correct company, contact the provider directly for confirmation.

Below is a comparison of what is included, not included, or may incur extra fees for each provider (based on available data):

Always ask for documentation and a demonstration of the verification process before appointing a provider. This step is essential for avoiding invalid or fraudulent appointments.

What the Price Really Includes (and Hidden Costs)

Provider pricing can be misleading if you do not examine what is actually included. The published price may only cover the basic appointment, while essential features—such as public verification, certificate issuance, or updates—might cost extra or not be available at all.

• Certificate and Public Verification: REP27 includes a verifiable certificate as standard. For others, check if this is part of the package or an optional extra.
• Updates and Changes: If your company details change, ask whether updates to the mandate or certificate are included or charged separately.
• Annual Reviews and Compliance Checks: EU Shield advertises an annual compliance review in its price. For other providers, this may not be included or may incur extra fees.
• Forwarding Correspondence: Some providers, like EU Shield, specify that data subject and authority correspondence is forwarded within one business day. For others, ask if this is included or if there are per-request fees.
• Multi-Regulation Coverage: Only some providers (e.g., REP27, Regingada) offer appointments for multiple regulations (GDPR, GPSR, AI Act, etc.). If you need more than one type of representative, confirm whether this is possible and what it costs.

Hidden costs may include:

• Per-request fees for forwarding or responding to data subject or authority requests.
• Charges for updating company details or certificates.
• Additional fees for compliance documentation or annual reviews.
• Costs for covering multiple regulations or jurisdictions.

Always request a full, itemized price list and clarify what is included before signing. If a provider cannot or will not specify, proceed with caution.

How Appointment Works: Step-by-Step

Appointing a GDPR representative or GPSR responsible person is a formal process. Here’s how it works with reputable providers such as REP27, and what you should expect at each step:

1. Identify Your Obligations: Use free tools or consult the provider to determine which regulations apply to your business (GDPR, GPSR, AI Act, etc.).
2. Choose a Provider: Select a provider that covers the required regulations and offers verifiable documentation.
3. Submit Company Details: Complete a file with your legal entity, establishment details, product or service information, and relevant documentation.
4. Human Review: A person (not an automated system) reviews your file for completeness and compliance. REP27 typically completes this within 24 working hours.
5. Mandate Signing: The provider’s authorized signatory signs the appointment letter or mandate. This document names the provider as your official representative or responsible person.
6. Certificate Issuance: You receive a signed certificate with a QR code or verification code. This certificate is used for privacy notices, product labels, or marketplace compliance forms.
7. Public Verification: Anyone can check the validity of your appointment using the code or link. The verification page shows your company name, the type of appointment, and the validity period.
8. Update Your Notices: Insert the representative’s details and verification line into your privacy notice, product label, or marketplace profile as required.

Checklist for buyers:

1. Determine which EU/UK rules apply to your business.
2. Gather all company and product/service documentation.
3. Research providers and check public register entries.
4. Request a sample certificate and test the verification process.
5. Clarify what is included in the price and any extra fees.
6. Sign the mandate and update your compliance documentation.

Risks, Fines, and What Providers Usually Do Not Say

Appointing a non-compliant or unverifiable representative exposes your business to significant risks:

• Fines: Under GDPR, non-compliance with Article 27 can lead to fines up to €20 million or 4% of your global turnover, whichever is higher. GPSR violations can result in product bans or recalls.
• Marketplace Delisting: Major platforms like Amazon and eBay require proof of a valid EU representative or responsible person. Failure to provide this can lead to account suspension or product removal.
• Legal Actions: Authorities or consumers may initiate legal actions against your company if the representative cannot be reached or verified.

What providers usually do not say:

• Exclusions: Most providers, including REP27, do not offer legal advice or court representation. Their role is strictly as a contact point as defined by the law.
• Notice Periods: Contracts may require advance notice to terminate or change the appointment. Always check the terms before signing.
• Liability Limits: The representative does not assume your compliance liability. The responsibility for GDPR or GPSR compliance remains with your company.
• Per-Request Fees: Some providers may charge for each data subject or authority request forwarded, or for updates to your records. These are not always disclosed upfront.

Carefully review the provider’s terms and ask explicit questions about exclusions, liability, and extra fees. A transparent provider will answer clearly and provide documentation.

Decision Matrix: Do You Need a Representative?

Not every non-EU company needs a GDPR or GPSR representative. The table below helps you decide based on your business model, sales channels, and customer base:

Always confirm your obligations using the official text or a qualified compliance check. If in doubt, use the free check offered by providers like REP27 or consult a specialist.

Realistic Scenarios and Simplest Compliant Route

• US SaaS company with EU users: The company offers a cloud-based service to EU customers but has no EU office. Under GDPR Article 27, it must appoint an EU representative. The simplest route is to appoint a provider like REP27, receive a verifiable certificate, and update the privacy notice with the representative’s details and verification link.
• Chinese Amazon seller: The seller lists consumer electronics on Amazon.de and ships directly from China. Both GDPR and GPSR apply: GDPR for customer data, GPSR for product safety. The seller should appoint a provider covering both roles (REP27 and Regingada offer multi-regulation coverage), then provide the certificate to Amazon and update product listings as required.
• UK online shop selling to EU: After Brexit, a UK-based online shop selling to EU customers must appoint an EU GDPR representative. The simplest route is to appoint REP27 or a similar provider, obtain a certificate, and update the website and privacy notice accordingly.

In all scenarios, the key steps are: determine which rules apply, select a provider with public verification, obtain the certificate, and update compliance documentation. This ensures both legal compliance and smooth operation on EU marketplaces and platforms.