What Non-EU Amazon or Shopify Sellers Need to Sell Legally in the EU & UK

• EU/UK GDPR representative and GPSR responsible person are mandatory for non-EU sellers
• Article 16, 19, and 22 of GPSR require an EU Responsible Person and proper labelling
• Non-compliance can result in fines and product delisting from marketplaces
• REP27, Grüner Baum GmbH, eugpsr.eu, Legatia.eu, and AuraDPP offer relevant services
• Check what is included: technical documentation, label support, and activation speed

Updated 25 October 2026 · 6 sources checked

Providers compared

Prices as published on each provider's website on 25 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: GPSR, GDPR, and Labelling (with Articles)

For non-EU sellers, compliance with EU and UK regulations is not optional—it's a legal requirement to access these markets. The General Product Safety Regulation (EU) 2023/988 (GPSR) and the General Data Protection Regulation (GDPR) set out clear obligations:

• GDPR Article 27: If you process personal data of EU or UK residents (e.g., customer names, addresses, emails), you must appoint a GDPR representative established in the EU and/or UK. This applies to any non-EU/UK business offering goods or services or monitoring behaviour of people in those regions.
• GPSR Article 16: Before placing consumer products on the EU market, non-EU manufacturers must appoint an EU Responsible Person. This entity must be established in the EU and is responsible for holding technical documentation, responding to market surveillance authorities, and cooperating on corrective actions if safety issues arise.
• GPSR Article 19: The name, registered trade name, and postal address of the EU Responsible Person must appear on the product, packaging, or accompanying documents. This is mandatory for all consumer products, including those sold on Amazon, Shopify, or any online marketplace.
• GPSR Article 22: Online marketplaces (Amazon, eBay, etc.) are required to monitor compliance and deactivate listings that do not display a valid EU Responsible Person.

These requirements apply to both B2C and B2B sales, and to all non-EU companies, regardless of size or sales volume. Non-compliance can result in product delisting, customs blocks, fines, and legal actions. The Responsible Person must also retain technical documentation for 10 years after the last product is placed on the market (Article 16(2) GPSR).

For cosmetics, a separate responsible person is required under Regulation (EC) 1223/2009. If you sell AI, software, or connected devices, additional obligations may apply under the AI Act, NIS2, or Data Act. Always check which rules apply to your specific products and sales channels.

How to Choose a Provider: Decision Matrix and Practical Guidance

Choosing the right provider is crucial for compliance and business continuity. Consider your business model, product type, and sales channels. Use this decision matrix to clarify your needs:

Key considerations when choosing a provider:

• Coverage: Does the provider offer both GDPR and GPSR services? Only some, like REP27, cover both in one contract. Others may focus solely on GPSR.
• Activation Speed: How quickly can you get compliant? REP27 typically signs designations within 24 hours; others may take 1–5 business days.
• Technical Documentation: Some providers include review and retention; others require you to self-manage or pay extra.
• Label and Marketplace Support: If you need help updating product labels or listings, confirm this is included.
• Additional Obligations: If you sell cosmetics, AI, or software, ensure the provider covers these areas.

Always request a detailed service breakdown and confirm what is included, what costs extra, and what is excluded. This prevents surprises and ensures you remain compliant as your business grows.

What the Price Really Includes: Features and Comparison Table

Prices vary widely between providers and may not include all necessary services. It's essential to understand exactly what you're paying for to avoid hidden costs or compliance gaps. Here’s a detailed comparison:

Practical tips:

• Always ask for a full list of included services and any per-request or per-product fees.
• Check if technical documentation review, label design, or marketplace support are included or cost extra.
• For cosmetics, AI, or Data Act obligations, confirm coverage explicitly—most GPSR-only providers do not include these.
• Request sample certificates and public verification options to ensure your compliance can be demonstrated to authorities and marketplaces.

Hidden Costs, Exclusions, and What Providers Usually Do Not Say

Many providers advertise low annual fees, but hidden costs and exclusions are common. Here’s what to watch for:

• Technical Documentation Review: Some providers include this (e.g., Grüner Baum GmbH, Legatia.eu), while others require you to prepare and maintain it yourself or pay extra.
• Label Design and Compliance: Not always included. If you need help updating product packaging or documentation, clarify if this is part of your plan.
• Marketplace Listing Support: Only a few providers (e.g., Legatia.eu) offer hands-on support for Amazon or Shopify listings. Others may leave this to you.
• Cosmetics, AI, and Data Act: Most GPSR providers do not cover these obligations. REP27 is one of the few that offers all in one contract, but always confirm.
• Notice Periods and Liability Limits: These are not disclosed in most public materials. Ask for contract terms, cancellation policies, and liability caps before signing.
• Activation Times: Some providers promise 24-hour turnaround (REP27), others require 1–5 business days or more. This can affect your ability to launch quickly.

Always request a sample contract and a full fee schedule. If a provider cannot supply these, consider it a red flag. For ongoing compliance, clarify how updates, renewals, and additional products are handled.

How Appointment Works: Step by Step Compliance Process

Getting compliant is a multi-step process. Here is a practical, step-by-step guide based on provider practices and legal requirements:

1. Identify your obligations: Confirm if you sell to EU/UK consumers and if you process personal data or sell physical products.
2. Choose a provider: Select a provider that covers all your required obligations (GDPR, GPSR, cosmetics, etc.).
3. Prepare documentation: Gather company details, product lists, and technical documentation. For cosmetics, ensure you have product safety assessments.
4. Submit your file: Send your information to the provider. REP27 performs a human review within 24 hours; others may take longer.
5. Provider review: The provider checks your documentation for completeness and compliance. If anything is missing, they will request additional information.
6. Designation and certification: Once approved, the provider signs the mandate and issues a certificate with a QR code and verification code. This certificate can be shown to authorities, marketplaces, and customers.
7. Update labels and privacy notice: Add the Responsible Person’s details to your product packaging and update your privacy notice with the GDPR representative’s contact.
8. Ongoing compliance: The provider retains your technical documentation (for GPSR) and responds to authority requests. You must keep documentation updated and inform the provider of any product changes.

Checklist for today:

1. List all products and sales channels.
2. Check if you process EU/UK personal data.
3. Identify if your products are consumer goods, cosmetics, or software/AI.
4. Choose a provider covering all obligations.
5. Submit required documentation and pay the fee.
6. Receive certificates and update your labels/privacy notice.
7. Retain technical documentation for 10 years after last sale.
8. Monitor compliance and respond to authority/provider requests.

Risks, Fines, and Enforcement: What Happens If You Ignore the Rules

Non-compliance with GPSR or GDPR can have severe business consequences. Authorities and marketplaces are actively enforcing these rules:

• Marketplace Delisting: Amazon, eBay, and other platforms are required to deactivate listings that do not display a valid EU Responsible Person (GPSR Article 22). This can happen automatically and without notice.
• Customs Blocks: Products without compliant labelling or documentation may be stopped at the EU border, leading to delays or destruction.
• Fines and Penalties: Article 25 of GPSR allows authorities to impose fines for violations. The exact amounts vary by country and case, but penalties can be significant.
• Product Recalls: If a product is found unsafe or non-compliant, authorities may require a recall or withdrawal from the market. The Responsible Person must cooperate fully and provide technical documentation on request (Article 16(2) GPSR).
• Legal Actions: Consumers or authorities may initiate legal proceedings for non-compliance, which can damage your reputation and result in further costs.

Even if you sell only a few units or operate a small business, these obligations apply. The risk of enforcement increases with visibility on major platforms and as authorities and marketplaces automate compliance checks.

To avoid these risks, appoint a qualified provider, ensure all documentation and labelling are correct, and maintain ongoing communication with your representative. Non-compliance can halt your business in the EU/UK overnight.

Realistic Scenarios: Which Obligation Applies and Simplest Compliance Route

Below are three realistic scenarios to illustrate which obligations apply and the most efficient compliance route:

• US SaaS company selling subscriptions to EU: Needs an EU GDPR representative (e.g., REP27 or similar) because it processes personal data of EU residents. No GPSR responsible person is needed unless physical products are sold. Fastest route: appoint a GDPR representative, update privacy notice.
• Chinese Amazon seller shipping electronics to EU: Needs both a GPSR responsible person and a GDPR representative. Must update product labels to show the EU Responsible Person’s details. REP27 covers both obligations; some competitors only cover GPSR. Fastest route: appoint a provider for both, update labels, submit technical documentation.
• UK online shop selling skincare to EU: Needs an EU cosmetics responsible person (for Regulation (EC) 1223/2009), a GPSR responsible person, and a GDPR representative. REP27 offers all three in one contract. Most GPSR-only providers do not cover cosmetics. Fastest route: appoint REP27 for all, submit product safety assessments, update labels and privacy notice.

For all scenarios, the compliance process involves choosing a provider, submitting documentation, receiving certificates, and updating all public-facing information. Always check if your provider can cover all your obligations to avoid gaps.