Appointing Kanzlei Matutis as your EU representative under Art. 27 GDPR takes a few days and no visit to Germany. This page describes the complete process, what we need from you, and what happens afterwards.
Step 1: Inquiry and conflict check
You send us your company name, country, website and a short description of what you do in the EU through the inquiry form or by email to mail@matutis.de. We check two things: whether your company actually falls under Art. 3(2) GDPR and therefore needs a representative at all, and whether there is any conflict of interest on our side (for example, if we already represent a direct competitor in a dispute). If a representative is not required in your case, we tell you so; there is no charge for this assessment.
Step 2: Contract and written mandate
We send you our representation contract (PDF, German and English) together with the written mandate that Art. 27(1) GDPR requires (“shall designate in writing”). Both documents are signed electronically or by exchange of scanned copies; original signatures by post are not necessary. The contract runs for one year and renews automatically unless terminated. The annual fee of 350 EUR is invoiced on conclusion; details and payment options are explained on the page What does it cost and what is included?.
Step 3: Publication in your privacy policy
Once the mandate is signed, you add our contact details to your privacy policy, as Art. 13(1)(a) and Art. 14(1)(a) GDPR require. We provide a sample paragraph for this section; it is shown on the page What else does your company need to do?. Drafting or reviewing your privacy policy as a whole is not included in the annual fee; we can do this under a separate engagement if you wish. You also enter our details as EU representative in your record of processing activities under Art. 30(1)(a) GDPR, and we ask you to send us a current copy of that record, because supervisory authorities may request it from us.
What we need from you
- Full legal name, registered address and registration number of your company
- Name and email address of your contact person for data protection matters (and of your DPO, if you have one)
- The website(s) and services through which you address people in the EU
- A current copy of your record of processing activities (Art. 30 GDPR), which you may send after signing
What happens during the year
From the day of appointment we are your contact point in the EU. Letters and emails from supervisory authorities or data subjects arrive at our office in Potsdam, are checked by us, scanned and forwarded to your contact person without undue delay. Forwarding by email is included in the annual fee. If an authority sets a deadline, we point this out to you immediately, because deadlines under the GDPR are short: a data subject request must be answered within one month (Art. 12(3) GDPR), and a personal data breach must be notified within 72 hours (Art. 33(1) GDPR). Responding to the authority remains your task, unless you instruct us separately to do so for you.
Changing your representative
If you currently have another EU representative and want to switch, the process is the same. The previous mandate is terminated under its own terms, you update your privacy policy with our details, and from that moment we are your point of contact. No notification to a supervisory authority is required for the change; the representative is not registered anywhere, which is why the correct publication in the privacy policy matters.
Ending the mandate
The mandate ends when you stop addressing the EU market, when you establish a subsidiary or branch in the EU (in which case Art. 27 GDPR no longer applies, because you now have an establishment in the Union), or when either side terminates the contract. In all cases you remove our details from your privacy policy and we stop accepting mail on your behalf at the end of the contract period.