Mexican companies that reach customers in Germany and the European Union, for example exporters of food and beverages with EU online shops, software and nearshoring service providers, tourism and hospitality businesses marketing to European travellers, and consumer brands, process personal data of people in the EU and are subject to the GDPR for that activity. Where the company has no EU establishment, Art. 27 GDPR requires an EU representative. Kanzlei Matutis, a German law firm specialised in data protection, provides this service for Mexican companies for 350 EUR per year. We correspond in English and German.
Does a company from Mexico need an EU representative?
Yes, if it has no establishment in the EU and its processing of personal data relates to offering goods or services to people in the EU or to monitoring their behaviour there (Art. 3(2) in conjunction with Art. 27(1) GDPR). Examples: a Jalisco spirits producer selling to consumers in Germany through a German-language shop with EUR pricing; a Mexico City software company with EU customers; a Cancún or Oaxaca hotel group with a German booking site and remarketing to visitors from the EU. A Mexican company that already has a subsidiary, branch or office in an EU Member State does not need a representative; that EU entity is the point of contact. The exceptions of Art. 27(2) GDPR (occasional, low-risk processing without large-scale sensitive data; public authorities) are narrow and rarely apply to a business that actively markets to the EU. The full criteria are explained on the page What is the legal situation?.
Mexican data protection law and the GDPR
Mexican private-sector data protection is governed by the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), which was comprehensively reformed in 2025. There is no EU adequacy decision for Mexico under Art. 45 GDPR; transfers of personal data from the EU to Mexico require standard contractual clauses or another safeguard under Art. 46 GDPR. The Mexican “aviso de privacidad” does not replace the GDPR information duties under Art. 13 GDPR for EU customers, and compliance with the LFPDPPP does not exempt a Mexican company from Art. 27 GDPR. A Mexican company that targets people in the EU needs an EU representative in addition to its domestic compliance.
What we do as EU representative for Mexican companies
Rechtsanwaltskanzlei Matutis is a German law firm in Potsdam, near Berlin, specialised in data protection law. Under a written mandate pursuant to Art. 27(1) GDPR we act as your point of contact in the EU for all supervisory authorities of the Member States and for data subjects. Letters and emails addressed to us are checked, scanned and forwarded to your contact person without undue delay; we point out deadlines, such as the one-month period for data subject requests under Art. 12(3) GDPR. With a time difference of seven to eight hours, our afternoon overlaps with your morning; forwarded mail received later in our day is in your inbox when you start work. We communicate in English and German. We do not replace your Data Protection Officer and do not take over your compliance decisions; the difference is explained on the page EU representative vs. Data Protection Officer.
Cost for companies from Mexico
The annual flat fee is 350 EUR. Because the service is provided by a German law firm to a business customer outside Germany, German VAT is not charged (reverse charge), so net equals gross. We invoice in EUR; payment by international transfer or by credit card or PayPal is possible. Please instruct your bank so that the full EUR amount is credited. Forwarding of scanned mail by email is included; postal forwarding of originals is charged at 2 EUR per item plus postage. Full details: What does it cost and what is included?
Next step
Send us your company name, website and a short description of your activities in the EU via the inquiry form. We confirm whether a representative is required in your case and send you the contract and written mandate. The complete process is described on the page How to appoint an EU GDPR representative. Other countries: EU representative by country.