Named EU contact for non-EU controllers and processors that offer goods or services to people in the European Union. Regulator liaison, data subject handling, Article 30 records and documentation in one annual fee.
One business day reply. Clear next steps and indicative pricing.
If you process personal data of people in the EU, monitor their behaviour, or offer goods and services to them, Article 27 applies. Limited exemptions exist for occasional and low-risk processing.
The representative is mandated in writing, named in the privacy notice and the Article 30 record, and responds to enquiries from supervisory authorities and individuals in EU languages.
We are established in Croatia and act for clients targeting the EU broadly. The representative address is published in your privacy notice and shared with supervisory authorities on request.
Annual fixed fee. Mandate, address, inquiry handling, supervisory authority liaison, Article 30 record on file.
EU rep service plus a senior privacy advisor on call. The combined retainer covers programme support and breach triage.
Independent assessment of whether Article 27 applies to your processing and what the appointment should look like.
The EU representative role only works if it is operational. We publish an email and a postal address, monitor both, log every inquiry and respond inside the GDPR timelines. Supervisory authorities get a real contact, not a forwarding address.
EDPB and national authorities coordinate on cases involving non-EU controllers. The representative becomes the first point of contact in cross-border procedures.
Non-EU AI providers also need an EU authorised representative for the AI Act regime. The two roles overlap but are governed by different obligations.
Authorities check the representative line on the privacy notice as part of routine reviews. Missing or generic placeholders trigger follow-up.
Non-EU controllers and processors that offer goods or services to people in the EU, or monitor the behaviour of people in the EU. The targeting test is the EDPB Guidelines 03/2018. Limited exemptions exist for occasional and low-risk processing.
A subsidiary works only if it has operational capacity and authority. A law firm is legally permitted but rarely delivers the operational response a controller needs. A dedicated EU representative service is built for the role.
Monitors the published EU address and email. Triages every inquiry from data subjects and supervisory authorities. Coordinates DSR responses inside the GDPR deadlines. Produces the Article 30 record on supervisory request. Flags scope changes that affect the appointment.
The mandate, privacy notice text and Article 30 starter can be in place within 7 business days. Faster turnaround is possible where the existing privacy programme is already documented.
If you are a non-EU provider of an AI system covered by the AI Act, yes. The AI Act introduces a separate authorised representative obligation. We cover both roles in one engagement where the same entity is providing AI systems and processing personal data.
Annual fixed fee for the EU representative service, priced on the volume of inquiries expected and the breadth of EU markets you serve. We do not charge per request inside reasonable volumes. Higher-volume programmes use a tiered model.
Mandate template for non-EU controllers appointing an EU representative under Article 27 GDPR.
Step-by-step assessment of whether Article 3(2) applies to your processing and whether a representative is required.
Plain-language paragraph for the privacy notice, naming the representative and explaining the appointment.
External DPO service for organisations under Article 37 obligation or seeking senior privacy leadership.
Open practice →AI Act conformity, governance and the authorised representative role for non-EU AI providers.
Open practice →Independent GDPR audit covering Article 30 records, DPIA programme, transfer mechanism and DSR workflow.
Open practice →Send the brief. We respond with a scoped agenda for the first call.