The General Data Protection Regulation applies to companies outside the European Union as soon as they offer goods or services to people in the EU or monitor their behaviour there (Art. 3(2) GDPR). The Swiss Federal Act on Data Protection takes the same approach for Switzerland. A company in the United States, the United Kingdom, Canada, Australia or Asia with a European customer base therefore has European obligations, and in the first step usually three practical questions. Does it need a representative in the EU or in Switzerland, is its website and privacy policy fit for European users, and what does it do when a European customer or authority writes to it. Rechtsanwaltskanzlei Matutis answers these questions in English and at fixed fees.
Representation in the EU and in Switzerland
Our most requested service for companies outside Europe is the appointment as EU representative under Art. 27 GDPR for a flat fee of 350 EUR per year. For companies that also serve customers in Switzerland we act as representative in Switzerland under Art. 14 of the Swiss Data Protection Act through our Swiss branch office, likewise for 350 EUR per year. Both appointments can be combined.
Website and documents
With the website privacy compliance package for 300 EUR we draft the privacy policy and the legal notice your site needs for German and EU visitors and check the cookie consent, the contact form, the newsletter sign-up and the analytics tools against German supervisory practice. A data processing agreement under Art. 28 GDPR, drafted or reviewed, costs 300 EUR. If you want your social media presence checked as well, the social media compliance check covers your website and two accounts for 300 EUR.
When someone writes to you
A data subject access request from an EU resident must be answered within one month (Art. 12(3) GDPR), and a wrong or late answer is one of the most frequent reasons for complaints to supervisory authorities. We prepare the complete answer for 150 EUR, see data subject access request. Letters from a supervisory authority are handled as a separate mandate, which we quote in advance.
Data protection officer and accessibility
Companies with a presence in Germany that must appoint a data protection officer under Art. 37 GDPR and § 38 BDSG can appoint us as external data protection officer for an annual fee of 1,800 EUR. Since June 2025 websites and apps that sell to consumers in Germany must be accessible under the Barrierefreiheitsstärkungsgesetz. Our accessibility check tells you for 250 EUR whether the law applies to you and what has to be changed.
Our background
Rechtsanwalt Cornelius Matutis advises companies on the GDPR since it took effect in 2018, acts as external data protection officer for companies in Germany and Austria and represents clients in proceedings before German supervisory authorities. The firm is based in Potsdam near Berlin and has branch offices in Hallein in Austria and Felsberg in Switzerland. All services on this page are provided in English. The German-language presentation of our data protection practice is at matutis.de, a link that takes you to our German website.