"We were told we needed a GDPR rep three days before launch. They had our appointment filed before we finished the onboarding call."
Marco Tollo
Head of Legal · Series B AI infrastructure
If you process the personal data of anyone in the EU and you don't have an entity there, Article 27 GDPR requires a named representative. We become yours — on your privacy page, in your footer, on record with every DPA. In your timezone.
Article 27 is one of the most-overlooked and most-fined obligations in the GDPR. Enforcement is rising and the first thing a regulator checks is whether you have one.
Article 27 applies when you process personal data of people in the EU and you have no establishment there. Tick the boxes above to see whether this obligation lands on your company.
Or 2% of global turnover — whichever is higher. For Art. 27 non-appointment specifically.
Or 4% of global turnover, for the underlying data protection breach that brought you to the DPA's attention.
Growth in Article 27 enforcement actions across EU DPAs since the first major rulings in 2023.
From the DPA's first letter to a formal finding — if you have no named representative to respond.
A real legal entity registered as your Art. 27 representative. Listed on your privacy page, footer, and in your Article 30 records.
Display the EU Presence GDPR Verified badge on your website and privacy policy. It links to your public compliance page, signals legal compliance to customers and partners.
EU residents can contact us directly to exercise Article 15–22 rights. Every request routes to your DSR inbox, verified.
Create and manage your Record of Processing Activities with a guided wizard and stay up to date as you scale. Article 30, covered.
If something goes wrong, we file the 72-hour notification with the correct lead DPA. Drafts pre-approved by you.
Included: annual compliance review, policy template library, and a dedicated privacy counsel on Slack or email.
Article 27 requires a representative in a member state where affected data subjects are. We cover all 27 — plus the UK, under the parallel UK GDPR Art. 27 obligation.
Every DPA letter that lands on our desk gets a response in the same language, within statutory deadlines, with a summary in English for you. You see the inbox. You never see the paperwork.
30 minutes. We map your data flows, confirm Art. 27 scope, and pick the right member state for your primary appointment.
You'll receive a one-page Letter of Appointment. Once signed, we're officially appointed as your representative.
We provide the privacy-policy language, update your Art. 30 records, and (where required) file the appointment with the local DPA.
From day one, every DPA inquiry and data subject request routes to us. You get monthly summaries and an annual compliance review.
// Drop this into your privacy policy EU Representative (Art. 27 GDPR) World Presence j.d.o.o. Ulica Brune Bušića 42 10000 Zagreb, Croatia Email: dpo@eupresence.com Ref: ACME-GDPR-2026 // Also added to your Art. 30 record // and filed with the lead DPA.
| Capability | EU Presence | Solo-practitioner rep | Mail-forward service |
|---|---|---|---|
| Named Art. 27 entity | ✓ Registered in DE | ✓ | ~ Varies |
| Native-language DPA response | ✓ 24 EU languages | ~ 1–2 languages | ✕ |
| Avg. response time to DPA | ✓ 4 hours | ~ 3–5 days | 7–14 days |
| DSR inbox & verification | ✓ Built-in | ✕ Forwarded raw | ✕ |
| Article 30 records maintained | ✓ | ~ At extra cost | ✕ |
| 72-hour breach filing | ✓ Pre-drafted | ~ Hourly billing | ✕ |
| Audit-ready archive | ✓ Full export | ✕ | ✕ |
| Annual compliance review | ✓ Included | ✕ | ✕ |
From pre-launch AI startups to Series C fintechs — Article 27 appointments filed in under 48 hours.
"We were told we needed a GDPR rep three days before launch. They had our appointment filed before we finished the onboarding call."
"The DPA sent us a letter in Italian. They had a translated response out before we'd even read the original."
"We compared three options. EU Presence was the only one that actually responded to DPAs — not just forwarded mail."
"Named rep in Berlin, 48 hours. Our privacy policy went from red-flagged to audit-ready in a week."
One price. Every company size. Named Art. 27 representative with full DPA correspondence, DSR handling, and audit-ready archive — included.
The standard compliance stack for US companies with real EU exposure. One onboarding, one invoice, one team.
Article 27 coverage, 27 member states, named EU entity.
Hosted trust hub, unified DSR inbox, versioned policies, sub-processor log.
If users post or trade on your platform — Article 13 legal rep + notice endpoint.
If anyone in the EU can sign up, buy, or even load a cookie on your site, and you don't have an EU entity — yes. "Targeting" under the GDPR is interpreted broadly. The safest baseline: if you can't geo-block, you need a representative.
Totally different roles. A DPO advises you on compliance (often internal, Article 37). A Representative is the legal EU-side contact for authorities and data subjects (Article 27). You may need neither, either, or both. We offer both.
Art. 27 says "a member state where affected data subjects are." In practice, we default to Germany or Ireland — both have well-regarded DPAs, English-friendly practice, and broad enforcement precedent. We'll recommend the right one on your discovery call.
Yes — since Brexit, UK GDPR Art. 27 is a parallel obligation. We cover both with a single engagement and one invoice.
Forward it to your EU Presence counsel. We take over the correspondence from there, coordinate with you on substantive responses, and handle the language and deadline mechanics.
Yes. Representative appointments are terminable with 30 days' notice. We help with the handover and file the change with your lead DPA. No punitive clauses.
30-minute discovery call. Appointment filed within 48 hours. A named representative, in your privacy policy, by end of week.