Rechtsanwaltskanzlei Matutis acts as EU representative under Art. 27 GDPR for companies outside the European Union at a flat fee of 350 EUR per year. This page explains how the representative fits into the other obligations of a non-EU company and when the appointment is the right step. The detailed description of the service, the legal background by country and the answers to the usual questions are on our dedicated website art27gdpr-representative.com. You can instruct us from either site, the form below reaches the same desk.
Where the representative fits in
A company outside the EU that falls under the GDPR has four things to put in place. It needs a privacy policy that meets Art. 13 GDPR, a record of its processing activities under Art. 30 GDPR, a process for answering data subject requests within one month, and, unless an exception applies, a representative in the EU under Art. 27 GDPR. The representative is the only one of these four that cannot be done in-house, because it must be a person or firm established in a Member State. Many of our clients therefore start with the representative and add the privacy policy or the website compliance package afterwards.
Who needs it
The appointment is required when a company without an establishment in the EU offers goods or services to people in the EU, whether or not payment is involved, or monitors their behaviour in the EU, for example through analytics and advertising tools (Art. 3(2), Art. 27(1) GDPR). It is not required for public authorities or where the processing is occasional, does not involve special categories of data on a large scale and is unlikely to result in a risk (Art. 27(2) GDPR). In practice an online shop that ships to Germany, a SaaS provider with EU customers or an app with EU users needs a representative, a company that merely receives an occasional email from Europe does not. Whether your case is one or the other we tell you free of charge when you send us your website.
What you get for 350 EUR per year
The written mandate as your representative, our contact details for your privacy policy, and the handling of everything that arrives at the representative. Letters and emails from supervisory authorities and from data subjects are checked, scanned and forwarded to you by email on the day they arrive, with the deadline marked. Responding to an authority on your behalf is a separate mandate that we quote in advance. No German VAT is added for clients outside Germany, so 350 EUR is the full amount. The contract runs for one year and renews unless terminated.
Representative, not data protection officer
The representative under Art. 27 GDPR is often confused with the data protection officer under Art. 37 GDPR. The representative is a contact point in the EU acting under your mandate, the data protection officer is an independent adviser and monitor inside your organisation. A company outside the EU rarely needs a data protection officer under the GDPR, but if it does, the two roles should not be combined in one person. We offer both services separately.
Switzerland
If your company also serves customers in Switzerland, Swiss law requires a separate representative in Switzerland under Art. 14 of the Federal Act on Data Protection. An EU representative does not cover this. Through our Swiss branch office we provide the Swiss representative as well, and the two appointments are frequently combined.
Prices are net attorney fees. For business clients outside Germany no German VAT is added.
How to instruct us
Send us your company details and website through the form below. We confirm whether a representative is required and send you the contract and the written mandate for electronic signature. The appointment is usually completed within a few days. Full details of the service are at art27gdpr-representative.com, the German-language information at dsgvo-vertreter.eu, a link that leads to a German-language website. You are welcome to write to us in English at any time.