If your business is established outside the European Union but offers goods or services to individuals in the EU, the General Data Protection Regulation (GDPR) may require you to appoint a representative within the EU.
EaseCert provides an EU GDPR Representative service under Article 27 of Regulation (EU) 2016/679 for eligible non-EU businesses. EaseCert GmbH, established in Germany, acts as your designated point of contact in the European Union for data subjects and competent data protection supervisory authorities.
Our service is provided for a one-time fee with no annual subscription, giving non-EU businesses a practical way to meet their EU representative obligation while maintaining a clear European contact point.
Who Needs an EU GDPR Representative?
Article 27 GDPR can apply to businesses that are established outside the EU but fall within the territorial scope of the GDPR under Article 3(2).
This can include non-EU companies that:
- offer goods to individuals located in the EU;
- offer services to individuals located in the EU;
- operate online shops targeting EU customers;
- process personal data in connection with those EU sales or services; or
- monitor the behaviour of individuals within the EU.
Typical examples include companies based in the United States, United Kingdom, Switzerland, Canada, Australia, Japan and other non-EU countries selling directly to European consumers.
Article 27 contains an exemption for certain processing that is occasional, does not include large-scale processing of special categories of personal data or criminal-conviction data, and is unlikely to result in a risk to individuals. EaseCert can review your business circumstances as part of the onboarding process to determine whether our Article 27 representative service is appropriate.
What Is an EU GDPR Representative?
An EU GDPR Representative is a person or organisation established within the European Union that has been formally designated in writing by a non-EU controller or processor pursuant to Article 27 GDPR.
The representative provides an accessible point of contact within the EU for matters relating to the company's processing of personal data.
This is different from appointing a Data Protection Officer (DPO). EaseCert acts as your Article 27 EU Representative and does not become your DPO, controller, processor or general legal representative.
What Is Included?
Appointment of EaseCert GmbH as Your EU Representative
EaseCert GmbH, established in Germany, is formally appointed as your EU Representative pursuant to Article 27 GDPR through a written mandate.
EU Contact Point
You receive the necessary EaseCert representative information for inclusion in your privacy documentation and other relevant communications.
This allows customers, data subjects and competent supervisory authorities in the European Union to contact your designated EU representative.
Contact With EU Data Subjects
EaseCert acts as an EU contact point for data subjects contacting your business in relation to matters covered by the GDPR.
Where we receive a relevant request or communication, we forward and coordinate it with your designated company contact so that your organisation can assess and fulfil its obligations.
Contact With Data Protection Authorities
EaseCert acts as a contact point for competent EU data protection supervisory authorities regarding processing activities falling within the scope of your Article 27 appointment.
Relevant communications are documented and forwarded to your designated contact for appropriate action.
Article 30 Record of Processing Activities
Where applicable, EaseCert supports the maintenance and availability of the information required for your Record of Processing Activities (RoPA) under Article 30 GDPR.
We provide the required structure and maintain the information supplied by your organisation for purposes of the representative function. Your company remains responsible for providing complete, accurate and current information regarding its processing activities.
Representative Details for Your Privacy Notice
We provide the representative information required for your privacy documentation so that your EU Representative can be clearly identified to relevant data subjects.
This can include:
- EaseCert GmbH;
- German business address;
- dedicated electronic contact information; and
- the company's role as EU Representative pursuant to Article 27 GDPR.
One-Time Fee, No Annual Subscription
EaseCert provides its EU GDPR Representative service for a one-time fee.
There are no annual representative fees or recurring subscription charges for the standard service.
Your appointment remains subject to the terms of the representative mandate and continued compliance with the service conditions.
Your Responsibilities
Appointing an EU Representative does not transfer your responsibilities under the GDPR to EaseCert. Your company remains responsible for complying with the GDPR as the relevant controller or processor.
To enable EaseCert to perform the representative function, you must provide accurate and current information regarding your organisation and relevant processing activities.
You must also inform EaseCert of material changes, including changes to:
- your company details;
- EU markets in which you operate;
- categories of personal data processed;
- purposes of processing;
- categories of data subjects;
- processors or relevant recipients;
- international data transfers; and
- other information relevant to your Article 30 processing records or Article 27 representation.
What Is Not Included?
The EU GDPR Representative service is a representation and contact-point service. It is not an unlimited GDPR legal or consultancy service.
Unless separately agreed, the service does not include:
- legal advice or legal representation;
- appointment as your Data Protection Officer (DPO);
- drafting or comprehensive revision of privacy policies;
- Data Protection Impact Assessments (DPIAs);
- drafting Data Processing Agreements (DPAs);
- comprehensive cookie or consent-management audits;
- management of personal data breaches;
- regulatory investigations or enforcement proceedings;
- litigation or representation before courts;
- complex or unusually extensive data-subject requests; or
- ongoing GDPR consultancy unrelated to the Article 27 representative function.
Where additional compliance work is required, EaseCert can review the scope and provide a separate quotation where the requested work falls within our services.
How the Process Works
1. Place Your Order
Purchase the EU GDPR Representative service and provide your company contact details.
2. Complete the GDPR Information Request
We collect the information required to understand your EU activities, relevant processing operations and representative requirements.
3. Eligibility and Documentation Review
EaseCert reviews the supplied information and confirms the appropriate scope of the Article 27 appointment.
4. Representative Mandate
The written representative mandate is prepared and executed between your company and EaseCert GmbH.
5. Representative Details Issued
Once the appointment is complete, we provide the EaseCert details that can be incorporated into your privacy notice and relevant GDPR documentation.
6. Ongoing EU Contact Point
EaseCert remains your designated EU Representative in accordance with the mandate and acts as the European contact point for relevant data-subject and supervisory-authority communications.
Why Choose EaseCert?
EaseCert specialises in helping companies established outside the European Union manage EU regulatory requirements through a practical, centralised compliance approach.
For businesses already using EaseCert for EU product compliance, adding GDPR representation allows regulatory contact functions to be coordinated through the same German organisation.
- EU-established representative: EaseCert GmbH is established in Germany.
- One-time fee: no annual representative subscription for the standard service.
- Clear onboarding: structured collection of the information required for your appointment.
- Practical support: direct coordination of relevant communications received in the EU.
- Centralised compliance: particularly suitable for international ecommerce businesses already working with EaseCert on EU market-access requirements.
Frequently Asked Questions
Is an Article 27 Representative the Same as a DPO?
No. An EU Representative under Article 27 GDPR and a Data Protection Officer are different functions. Appointment of EaseCert as your EU Representative does not constitute appointment of EaseCert as your DPO.
Can I Put EaseCert in My Privacy Policy?
Yes. Following formal appointment, we provide the relevant EaseCert GmbH representative details for inclusion in your privacy documentation.
Do I Need to Provide a Record of Processing Activities?
You must provide EaseCert with sufficient and accurate information concerning the processing activities covered by the appointment. Where an Article 30 Record of Processing Activities is required, EaseCert can maintain the relevant record for purposes of its representative function based on information supplied by your organisation.
Do You Prepare the Article 30 Record for Me?
We provide the structure required for the representative service and can organise the information supplied during onboarding into the relevant processing record. Your company remains responsible for ensuring that the underlying information is complete, accurate and kept current.
How Quickly Can EaseCert Be Appointed?
For straightforward cases, the appointment can normally be completed within a few business days after we receive the required company information, processing information and signed documentation.
Is There an Annual Fee?
No. EaseCert's standard EU GDPR Representative service is provided for a one-time fee. There is no annual subscription for the standard representative service.
Does Appointing EaseCert Make My Business GDPR Compliant?
No. Appointment of an EU Representative fulfils the representative function under Article 27 where that obligation applies. Your organisation remains responsible for its wider obligations under the GDPR, including having appropriate legal bases for processing, providing required privacy information, implementing data protection measures and responding appropriately to data-subject rights.
Start Your EU GDPR Representative Appointment
If your company is established outside the European Union and sells goods or provides services to customers in the EU, EaseCert can assess your Article 27 representative requirement and establish your EU contact point through EaseCert GmbH in Germany.
One-time fee. No annual subscription. EU representation through EaseCert GmbH in Germany.
Legal Basis
The EU Representative requirement is established under Articles 3 and 27 of Regulation (EU) 2016/679 (General Data Protection Regulation). Record-keeping obligations are addressed under Article 30 GDPR. Further guidance on the territorial scope of the GDPR and the role of non-EU organisations' representatives is provided by the European Data Protection Board (EDPB).
Official sources:
- Regulation (EU) 2016/679 (GDPR) – EUR-Lex
- EDPB Guidelines 3/2018 on the Territorial Scope of the GDPR
EaseCert's EU GDPR Representative service supports the representative function established by Article 27 GDPR. It does not constitute legal advice, DPO services or a guarantee of an organisation's overall GDPR compliance.