Is your company based outside the EU, but your customers are within the European Union? Then Art. 27 GDPR requires you to appoint a representative in the EU. Rechtsanwaltskanzlei Matutis, a German law firm specialised in data protection law, acts as your EU GDPR representative for a flat fee of 350 EUR per year, for companies from the United States, the United Kingdom, Switzerland, Canada, Australia, India, the United Arab Emirates, Brazil and every other country outside the EU.
Who needs an EU GDPR representative?
Companies outside the European Union that process personal data of individuals located in the EU must appoint a representative within the EU if the data processing is related to offering goods or services to data subjects in the EU, irrespective of whether a payment is required, or to monitoring the behaviour of data subjects as far as their behaviour takes place within the EU (Art. 3(2) and Art. 27(1) GDPR). Typical signs: a German- or French-language website, prices in euros, shipping to EU countries, EU-specific advertising, or analytics and tracking of EU users. Companies with a subsidiary or branch in an EU Member State do not need a representative. The criteria, exceptions and tasks are explained under What is the legal situation?, and the position for individual countries under EU representative by country.
What is included
- Written mandate as EU representative pursuant to Art. 27(1) GDPR, with a bilingual contract (German and English)
- Point of contact in the EU for all supervisory authorities of the Member States and for data subjects
- Receipt, review, scanning and same-day email forwarding of letters and emails addressed to us as your representative
- Deadline alerts for data subject requests (one month, Art. 12(3) GDPR) and authority inquiries
- Sample paragraph naming us as your EU representative, for the corresponding section of your privacy policy (Art. 13(1)(a), 14(1)(a) GDPR); drafting or reviewing the privacy policy itself is not part of the flat fee
- Free initial assessment of whether your company needs a representative at all
What it costs
The annual fee is 350 EUR for every company outside Germany; because the service is provided by a German law firm to a business customer abroad, no German VAT is added, so net equals gross. Payment is possible by wire transfer or by credit card or PayPal. Forwarding of original letters by post is charged at 2 EUR per item plus postage; responding to authorities on your behalf is agreed separately. Full details: What does it cost and what is included?
How the appointment works
- You send us your company details and website through the inquiry form below; we confirm whether a representative is required.
- You receive the contract and the written mandate and sign electronically.
- You add our contact details to your privacy policy and record of processing activities, and we are your EU representative from that day.
The process usually takes a few days and requires no registration with any authority. Details: How to appoint an EU GDPR representative. What else you need to do as a non-EU company subject to the GDPR, from the record of processing activities to data breach notifications, is summarised under What else does your company need to do?
Why Kanzlei Matutis
Rechtsanwalt Cornelius Matutis is a German attorney and certified specialist in intellectual property law (Fachanwalt für Gewerblichen Rechtsschutz). The firm, based in Potsdam near Berlin with branch offices in Switzerland and Austria, focuses on data protection, IT and trademark law and advises companies in Germany, Austria and Switzerland on the GDPR, including as external Data Protection Officer and in proceedings before supervisory authorities. As your EU representative you deal with a law firm that is itself bound by professional secrecy and that understands what a German supervisory authority expects when it writes to a representative. German-language information about this service is available at dsgvo-vertreter.eu.
Frequently asked questions
An EU GDPR representative is a natural or legal person established in the European Union who is designated in writing by a company outside the EU to act as its point of contact for supervisory authorities and data subjects on all issues related to the processing of personal data (Art. 4(17) and Art. 27 GDPR). The representative does not take over the company’s legal responsibility; the company remains the controller or processor.
Every company without an establishment in the EU whose processing of personal data relates to offering goods or services to people in the EU, or to monitoring their behaviour there (Art. 3(2) GDPR), must appoint a representative under Art. 27(1) GDPR. The only exceptions are public authorities and processing that is occasional, does not include large-scale sensitive data and is unlikely to result in a risk (Art. 27(2) GDPR).
Kanzlei Matutis charges a flat fee of 350 EUR per year, with no German VAT for business customers outside Germany (reverse charge). Scanning and forwarding of incoming mail by email is included. Forwarding original letters by post costs 2 EUR per item plus postage. Responding to authorities on your behalf is charged separately on request.
No. The EU representative under Art. 27 GDPR is a contact point and acts under the company’s mandate. The Data Protection Officer under Art. 37 GDPR is an independent internal advisor and compliance monitor. The European Data Protection Board considers the two roles incompatible in one person. A company may need one, both or neither.
No. Adequacy decisions under Art. 45 GDPR for countries such as Switzerland, the United Kingdom, Canada, Israel, Japan, South Korea, New Zealand, Argentina or Brazil concern transfers of personal data from the EU to that country. They do not change the territorial scope of the GDPR under Art. 3(2) GDPR. A company from one of these countries that targets people in the EU still needs an EU representative.
The representative must be established in one of the Member States where the data subjects whose data is processed are located (Art. 27(3) GDPR). A representative in Germany, the largest EU market, satisfies this requirement for a company that serves customers in Germany and other Member States; a separate representative in every country is not required.
Failure to appoint a representative is an infringement of Art. 27 GDPR and can be fined with up to 10 million EUR or 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4)(a) GDPR). Supervisory authorities have imposed fines on non-EU companies for this reason. In addition, enforcement proceedings may be directed at the representative (Recital 80 GDPR).
Usually a few days. After your inquiry we check whether a representative is required, send you the contract and the written mandate, and you sign electronically. You then add our details to your privacy policy and record of processing activities. No registration with any authority is needed.
Not automatically. We receive, scan and forward all correspondence to you without undue delay. Substantive review and monitoring of deadlines are not part of the base fee. Responding to a supervisory authority or data subject is your responsibility as controller or processor. If you want us to draft or send the response for you, we do this under a separate agreement at the usual rates of our firm.
We correspond in English and German. All supervisory authorities in the EU accept English, and German is the language of the authorities most likely to contact a representative based in Germany.
Make an inquiry
Simply fill out the following form. We will tell you whether your company needs an EU representative and send you the contract and mandate.
Your data will only be used to respond to your inquiry. In this regard, please refer to our Privacy Policy.