Canadian companies that sell to customers in Germany and the European Union, whether through an online shop, a software product, an app or an education platform, are subject to the GDPR for that part of their business and must appoint a representative in the EU under Art. 27 GDPR if they have no EU establishment. Kanzlei Matutis, a German data protection law firm in Potsdam, acts as EU representative for Canadian companies for 350 EUR per year.
Does a company from Canada need an EU representative?
Yes, if it has no establishment in the EU and its processing of personal data relates to offering goods or services to people in the EU or to monitoring their behaviour there (Art. 3(2) in conjunction with Art. 27(1) GDPR). Examples: an Ontario e-commerce company shipping outdoor equipment to Germany with a German-language shop; a Montreal SaaS provider with EUR pricing and EU customers; a Vancouver edtech company whose platform tracks the learning behaviour of users in the EU. A Canadian company that already has a subsidiary, branch or office in an EU Member State does not need a representative; that EU entity is the point of contact. The exceptions of Art. 27(2) GDPR (occasional, low-risk processing without large-scale sensitive data; public authorities) are narrow and rarely apply to a business that actively markets to the EU. The full criteria are explained on the page What is the legal situation?.
PIPEDA, the EU adequacy decision and Art. 27 GDPR
Canadian private-sector data protection is governed federally by the Personal Information Protection and Electronic Documents Act (PIPEDA), supervised by the Office of the Privacy Commissioner of Canada, and by provincial laws such as Quebec’s Law 25, Alberta’s PIPA and British Columbia’s PIPA. The European Commission has recognised Canada as providing adequate protection for data transfers to organisations subject to PIPEDA (Decision 2002/2/EC under what is now Art. 45 GDPR). This adequacy decision is frequently misunderstood: it concerns transfers of personal data from the EU to Canada. It does not change the territorial scope of the GDPR under Art. 3(2) GDPR and does not exempt a Canadian company from the obligation to appoint an EU representative. Canadian companies that target the EU market need both: PIPEDA compliance at home and GDPR compliance, including the representative, for their EU-related processing.
What we do as EU representative for Canadian companies
Rechtsanwaltskanzlei Matutis is a German law firm in Potsdam, near Berlin, specialised in data protection law. Under a written mandate pursuant to Art. 27(1) GDPR we act as your point of contact in the EU for all supervisory authorities of the Member States and for data subjects. Letters and emails addressed to us are checked, scanned and forwarded to your contact person without undue delay; we point out deadlines, such as the one-month period for data subject requests under Art. 12(3) GDPR. Given the time difference of six to nine hours, forwarded mail reaches you at the start of your working day. We communicate in English and German. We do not replace your Data Protection Officer and do not take over your compliance decisions; the difference is explained on the page EU representative vs. Data Protection Officer.
Cost for companies from Canada
The annual flat fee is 350 EUR. Because the service is provided by a German law firm to a business customer outside Germany, German VAT is not charged (reverse charge), so net equals gross. We invoice in EUR; payment by wire transfer or by credit card or PayPal is possible. Forwarding of scanned mail by email is included; postal forwarding of originals is charged at 2 EUR per item plus postage. Full details: What does it cost and what is included?
Next step
Send us your company name, website and a short description of your activities in the EU via the inquiry form. We confirm whether a representative is required in your case and send you the contract and written mandate. The complete process is described on the page How to appoint an EU GDPR representative. Other countries: EU representative by country.