Agreement and Power of Attorney for the Appointment as GDPR Representative

Art. 27 (1) GDPR requires you to designate your representative in writing. That written designation is the power of attorney (Annex 1). It is the document we show a supervisory authority that wants to know whether we really act for you. The service agreement governs the relationship between you and the firm, i.e. services, fees, term and liability. The two belong together, and the power of attorney expires automatically when the agreement ends.

You fill in your company details in the agreement and the power of attorney, i.e. company name, address, register, authorised signatory and the e-mail address to which we should forward correspondence. Then you sign both documents and return them to us by e-mail, scanned or digitally signed. The signature of one legal representative of your company is sufficient. No registration with any authority is required.

Usually not. A scanned or digitally signed copy is sufficient for concluding the agreement and for our day-to-day work. Only if a supervisory authority expressly requests the original or a certified translation will we ask you for it. In practice this is very rare.

The agreement starts when both parties have signed and runs for one year. It is extended by a further year each time unless it is terminated in text form, for example by e-mail, no later than three months before the end of the contract year. Termination for good cause remains possible for both parties at any time.

The base fee is EUR 350 net per contract year. It is payable annually in advance, the first time upon conclusion of the agreement, in each case within 14 days of receipt of the invoice. As you are a business established outside the EU, the place of supply under Section 3a (2) of the German VAT Act is at your seat. We therefore charge no German VAT, so net equals gross. Taxes or withholdings in your own country are borne by you, and payments must reach us in full.

The designation itself, the function as point of contact for supervisory authorities and data subjects, receipt of post and e-mails, scanning and forwarding to you, transmission of your reply to the authority or the data subject if you prefer not to reply directly, keeping your record of processing activities and making it available to an authority on request, and answering simple queries from the authority about the representative and how to reach you.

Everything that goes beyond the point-of-contact function and that you ask us to do, such as immediate support in a data breach, substantive review of enquiries, drafting replies to authorities or data subjects, substantive statements, representation in proceedings, advice or on-site appointments. We bill these services on a time basis at half the firm’s hourly rate, currently EUR 250 net per hour instead of EUR 500, in 15-minute increments. For on-site appointments we add EUR 0.30 per kilometre driven. Physical forwarding of letters costs EUR 2 plus postage, parcels or documents of more than 30 pages EUR 5 plus postage.

Only at the start of a new contract year and only if we inform you in text form no later than four months before the end of the current year. You then still have time to terminate in good time. Within a running contract year the price is fixed.

We are your point of contact in the EU under Art. 27 (4) GDPR. Correspondence from supervisory authorities and data subjects arrives with us, we scan it and forward it to you by e-mail without undue delay and no later than the second business day. We cooperate with the authority under Art. 31 GDPR and make your record of processing activities available to it on request under Art. 30 (4) GDPR. That is exactly what the GDPR requires of a representative, no more and no less.

We do not review forwarded correspondence on its substance, we do not calculate or monitor deadlines and we do not reply on the merits. We are not your data protection officer under Art. 37 GDPR, not a processor under Art. 28 GDPR, and we do not monitor or advise on your processing on an ongoing basis. We also do not make declarations binding on you and do not make acknowledgements. Each of these services can be requested separately if you need it.

You briefly confirm receipt of each forwarded item and tell us within ten business days whether and how you have replied. The reply itself is given within the statutory deadline or the deadline set by the authority. For requests from data subjects the one-month period of Art. 12 (3) GDPR applies. Replies to authorities are sent to us in copy. So that we can reach you reliably, the e-mail address stated in the agreement must be read on every business day.

First, your company details in the agreement and the power of attorney. Within four weeks of signing you send us your record of processing activities under Art. 30 GDPR in English or German, because as representative we must be able to present it to an authority on request. Whenever it changes, you send us the updated version. You also inform us if your company name, address, authorised signatories or contact e-mail change, if you set up an establishment in the EU, or if you no longer process data of persons in Germany.

Under Art. 13 (1) (a) and Art. 14 (1) (a) GDPR you must state the representative’s name and contact details. The appropriate wording is: Our representative in the Union pursuant to Art. 27 GDPR is Rechtsanwalt Cornelius Matutis, Berliner Straße 57, 14467 Potsdam, Germany, e-mail mail@matutis.de. Further details such as telephone numbers only by arrangement. Beyond this reference the firm’s name may not be used, in particular not for advertising or as an indication that your processing has been reviewed.

Under Recital 80 GDPR, supervisory authorities may direct enforcement measures against the representative if the represented company infringes the GDPR. The representative, however, cannot vouch for processing it neither controls nor reviews. You therefore indemnify us against claims, fines, penalty payments and costs that are brought against us because of your processing. The indemnification does not apply where we ourselves have caused something intentionally or by gross negligence. This is market standard and the precondition for offering the designation at an annual flat fee at all.

For financial losses caused by negligence we are liable up to EUR 1,000,000 per claim. That is four times the minimum insurance sum under Section 51 (4) of the German Federal Lawyers’ Act (BRAO) and the amount Section 52 (1) no. 2 BRAO provides for a pre-formulated limitation of liability. Insurance cover exists for this amount. The limitation does not apply to intent, gross negligence or personal injury. We are not liable for the content of your replies, for deadlines missed on your side or for your company’s infringements of the GDPR.

Yes. As a German attorney I am bound by professional secrecy, and the agreement additionally obliges us to keep confidential everything we learn in the course of the designation. Towards supervisory authorities and data subjects, however, we may disclose what the GDPR requires of a representative, such as the existence of the designation, how to reach you and the record of processing activities. To that extent you release us from professional secrecy in the agreement.

Data from enquiries by data subjects or authorities are processed by us as an independent controller solely to forward them to you and to perform our duties under Art. 27 GDPR. There is no processing on your behalf, so no data processing agreement is required. Forwarding to your seat outside the EU is a third-country transfer under Art. 44 et seq. GDPR. Ensuring that this transfer is permissible is your responsibility as recipient.

The power of attorney covers both. You designate us in the capacity in which you process the data, i.e. as controller and, insofar as you process data on behalf of others, also as processor. You do not need to decide between the two.

No, and that is intentional. The power of attorney is limited to the point-of-contact function, i.e. receiving correspondence, cooperating with the authority and transmitting your replies. Legally binding declarations, acknowledgements, settlements, legal remedies or representation in proceedings are not covered. For those we need a separate power of attorney, which we are happy to send you on request. Legal action against your company itself remains unaffected in any case under Art. 27 (5) GDPR.

Then your obligation to designate a representative ceases. You inform us and may terminate the agreement with one month’s notice to the end of a month. Base fees already paid are not refunded. The same applies if you no longer process data of persons in Germany.

When the agreement ends, the designation ends and the power of attorney expires. You remove the reference to us from your privacy policy and all other documents within 14 days and, insofar as you remain obliged to do so, designate a new representative. We may inform authorities and data subjects that the designation has ended. Correspondence that still arrives afterwards is returned to the sender or forwarded to you without obligation.

In particular if you fail to pay the annual fee for more than 14 days despite a reminder, if your statements about establishment or data subjects are incorrect, if you repeatedly fail to reply to enquiries from supervisory authorities in time, if proceedings are initiated against us on account of your processing, or if insolvency proceedings are applied for in respect of your assets.

The agreement and the power of attorney are governed by German law. The place of jurisdiction is Potsdam, Germany, under Art. 25 of Regulation (EU) No 1215/2012. The contract language is German. The English version serves information purposes only, and in the event of discrepancies the German text prevails. The German version is available on our German site dsgvo-vertreter.eu.

The agreement is deliberately lean and calculated for the annual flat fee. Deviating arrangements in individual cases are possible, for example on additional services or a fixed quota of advisory hours, and are recorded in text form. Simply mention it in the inquiry form.

Usually a few days. After your inquiry we check free of charge whether you need a representative at all. You then receive the agreement and the power of attorney completed with your details for signature. As soon as the signed documents reach us you are designated and can name us in your privacy policy. The invoice follows after return of the documents.