One Provider for All EU Representative Obligations: GDPR, GPSR & NIS2

• REP27 and EU Shield cover GDPR, GPSR, and NIS2 for non-EU companies.
• Europe Cyber-Safe and eugpsr.eu do not offer all three services together.
• Annual prices (Oct 2026): REP27 from €290, EU Shield €490, Europe Cyber-Safe from €4,450.
• Each service covers different legal obligations—see the decision matrix.
• Hidden costs and extra fees are rarely disclosed publicly.
• Not all companies need all three services—check requirements by business model.

Updated 31 October 2026 · 7 sources checked

Providers compared

Prices as published on each provider's website on 31 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Articles & Obligations

Non-EU companies face several EU legal obligations if they interact with the EU market. The three most common representative requirements are:

• GDPR Article 27: Non-EU companies that process personal data of EU residents must appoint an EU representative. This applies if you offer goods or services to people in the EU, or monitor their behavior, regardless of whether you have an EU office. Fines for non-compliance can reach €20 million or 4% of global turnover (source).
• GPSR Article 16: Non-EU companies selling physical products to EU consumers must appoint a responsible person in the EU before placing products on the market. This person’s details must appear on product labels and documentation (source).
• NIS2 Article 26: Non-EU providers of essential or important digital services (such as cloud, DNS, CDN, managed services, or online platforms) must appoint an EU representative to ensure compliance with cybersecurity requirements (source).

These obligations are distinct and can apply simultaneously. For example, a US SaaS company serving EU users may need both a GDPR and NIS2 representative, while a non-EU Amazon seller shipping goods to the EU may need both GDPR and GPSR representatives. Each law has its own requirements and penalties for non-compliance.

Authorities and marketplaces may verify your representative at any time. Failing to appoint a valid representative can result in fines, product delisting, or service suspension. The table below summarizes which providers cover which obligations:

How to Choose the Right Provider

Choosing the right provider depends on your business model, the markets you serve, and the obligations you face. Here’s how to make an informed decision:

• Coverage: Check if the provider offers all the representative roles you need. Only REP27 and EU Shield cover GDPR, GPSR, and NIS2 together. Others may only cover one or two.
• Transparency: Prefer providers with published prices and clear descriptions of what is included. Some list only the base service, with extra fees for additional products or urgent processing.
• Speed: If you need to be compliant quickly (for example, to list on Amazon or launch a new service), check how fast the provider can issue your certificate. REP27 typically signs within 24 hours after review.
• Verification: Ensure the provider issues a certificate and a public verification code. This is often required by marketplaces and authorities.
• Legal establishment: The provider must be established in the EU (for EU obligations) and be verifiable in public registers. REP27’s EU designations are signed by Europe Services SE, a Czech public limited company.

Here’s a comparison of what’s included, not included, and potential extra fees for each provider:

Always request a sample contract and ask about any additional costs or exclusions before signing.

What the Price Really Includes

Published prices may only cover the basic appointment. To avoid surprises, clarify what is included in the annual fee:

• Certificate of appointment: Required for compliance and often requested by marketplaces.
• Unlimited products/services: Some providers (like REP27 on certain plans) allow unlimited products; others may charge per product or per service.
• Document templates: For privacy notices, product labels, or website disclosures—these help you update your compliance documents quickly.
• Verification code or online check: Essential for proving compliance to authorities or platforms.
• Support: Some providers include support for regulatory questions or updates; others may charge extra.

Below is a summary of what is typically included or may incur extra fees (where known):

Always ask for a detailed quote and a list of what is included before committing.

Hidden Costs & What Providers Usually Do Not Say

Many providers do not publish all potential costs or contract terms. Here are common hidden aspects to watch for:

• Extra fees for additional products/services: Some providers charge per product, per service, or for each new product added during the year.
• Urgent processing or amendments: Fast-track processing or changes to your certificate may incur extra charges.
• Notice periods for cancellation: Contracts are typically annual. Check if there are minimum notice periods or auto-renewal clauses.
• Limits on liability or support: Providers may limit their liability or restrict the support they offer as part of the standard fee.
• Exclusions: Some services (like cosmetics, AI Act, or UK representation) may not be included and require separate contracts.

Providers rarely disclose these details on their main pages. Always request the full contract, read the terms, and ask about:

• What happens if you need to add or remove products?
• Are there fees for document re-issuance or urgent requests?
• Is there a minimum contract term or notice period?
• What support is included, and what is paid?

Transparency varies. REP27, for example, provides public verification and clear documentation, but full details of extra fees are available only on request. EU Shield and others also require direct inquiry for a complete fee structure.

How Appointment Works: Step by Step

1. Identify obligations: Determine if you need a GDPR, GPSR, and/or NIS2 representative. Use the decision matrix below for guidance.
2. Choose a provider: Compare coverage, price, and speed. Only REP27 and EU Shield offer all three services together.
3. Submit company details: Provide information about your business, products/services, and contact persons. This may include company registration, product lists, and privacy policy details.
4. File review: The provider reviews your file for completeness and eligibility. REP27 typically completes this within 24 working hours.
5. Sign the designation: The provider’s statutory body signs the appointment letter. For REP27, this is Europe Services SE for EU obligations.
6. Receive certificate: You receive a signed certificate, QR code, and verification code. These are used in privacy notices, product labels, and for marketplace compliance.
7. Public verification: Anyone can check your appointment status online using the verification code (REP27 offers this feature).
8. Update compliance documents: Add the representative’s details to your privacy notice, product labels, and website as required by law or platforms.

This process ensures you are compliant and ready for audits or marketplace checks. Always keep your certificate and verification code accessible.

Risks, Fines, and What Happens If You Ignore These Duties

Ignoring EU representative obligations is risky and can have severe consequences:

• GDPR: Fines up to €20 million or 4% of global annual turnover for non-compliance with Article 27. Authorities may also restrict your data processing or ban your services in the EU.
• GPSR: Products without a valid responsible person can be delisted from marketplaces, blocked at customs, or recalled. Marketplaces like Amazon require proof of a responsible person for non-EU sellers.
• NIS2: Non-EU providers of essential/important services risk suspension of their digital services or platforms, as well as regulatory fines, if they lack an EU representative.

Authorities and marketplaces are increasingly checking compliance. For example, Amazon, Etsy, and eBay may require a certificate or verification code before allowing listings from non-EU sellers. If you cannot provide this, your products or services may be removed.

In addition to financial penalties, non-compliance can damage your reputation and limit your ability to access the EU market. The cost of appointing a representative is minor compared to these risks.

Decision Matrix: Do You Need These Services?

Review your business activities carefully. If in doubt, consult the provider or legal counsel before proceeding.

Checklist: How to Get Compliant Today

1. Assess your obligations: Do you process EU personal data, sell physical products, or provide digital services to the EU?
2. Identify applicable laws: GDPR Article 27, GPSR Article 16, NIS2 Article 26.
3. Compare providers: Use the table above to find those covering all your needs. Only REP27 and EU Shield cover all three.
4. Request a contract: Ask for terms, notice periods, and a full fee breakdown.
5. Prepare your documents: Gather company registration, product/service lists, and privacy policy details.
6. Submit your application: Complete the provider’s online form or email the required documents.
7. Review and sign: The provider reviews your file, then issues a signed certificate and instructions.
8. Update your compliance materials: Add the representative’s details to privacy notices, product labels, and your website.
9. Keep records: Store your certificate and verification code for audits or marketplace requests.
10. Monitor renewals: Set reminders for annual renewal and check for any changes in your business that affect compliance.

Realistic Scenarios: What Applies and How to Comply

• US SaaS provider with EU users: Must appoint a GDPR Article 27 representative. If classified as an essential/important service under NIS2, must also appoint a NIS2 representative. REP27 or EU Shield can provide both. Steps: assess obligations, choose provider, submit details, receive certificate, update privacy notice and website.
• Chinese Amazon seller: Needs a GPSR responsible person for product sales into the EU. If tracking or profiling EU buyers, also needs a GDPR Article 27 representative. REP27 and EU Shield offer both; eugpsr.eu covers only GPSR. Steps: select provider, submit product and company info, receive certificate, update product labels and Amazon account.
• UK online shop selling to EU: Needs GDPR Article 27 representative if processing EU personal data, and GPSR responsible person if selling physical goods. REP27 and EU Shield are suitable. Steps: identify obligations, choose provider, provide details, receive certificate, update compliance documents.

Each scenario shows that the simplest compliant route is to use a provider covering all relevant obligations, ensuring you have certificates and up-to-date documentation for authorities and marketplaces.