EU Representative (GDPR Article 27)
If your US or Canadian business offers goods or services to people in the EU — or monitors them — GDPR Article 27 requires a representative established in the Union. We act as that representative, overseen by a Data Protection Officer designated with the CNIL.
🛡 Overseen by a Data Protection Officer designated with the CNIL
What is an EU representative?
An EU representative is the local point of contact required by Article 27 of the GDPR for organisations established outside the European Union that process the personal data of people in the EU. The representative liaises with supervisory authorities and data subjects on your behalf.
It is a named, mandated function — not just a mailbox. Authorities and individuals in the EU must be able to reach your representative on all GDPR matters, in the local language.
What we do as your EU representative
- ✓ Act as your official point of contact for EU supervisory authorities
- ✓ Handle requests from data subjects (individuals) located in the EU
- ✓ Maintain a copy of your record of processing activities (Article 30)
- ✓ Publish your representative contact details, as the GDPR requires
- ✓ Route and escalate authority communications to your team
Do US or Canadian companies need an EU representative?
In most cases, yes. If you are not established in the EU and you offer goods or services to people in the EU/EEA (even for free), or you monitor their behaviour, Article 27 applies — regardless of company size, unless a narrow exemption applies. Common triggers:
- 📦 Selling or shipping to customers in the EU
- 🌐 A website or app used by people in the EU
- 📊 Tracking EU visitors (analytics, ads, cookies)
- ☁️ Offering a SaaS or online service accessible in the EU
Backed by a CNIL-designated DPO
Many representative services are little more than a forwarding address. Ours is overseen by a Data Protection Officer formally designated with the CNIL — France's data protection authority — with recognized expertise in healthcare and occupational-health (SPST) compliance. That means genuine expertise when an authority or a data subject comes knocking.
Real expertise behind every mandate
Unlike faceless "representative-in-a-box" providers, DataShield is overseen by a Data Protection Officer designated with the CNIL — France's data protection authority — with recognized expertise in healthcare and occupational-health (SPST) compliance.
- Overseen by a Data Protection Officer designated with the CNIL
- Sector expertise in healthcare & occupational health (SPST)
- Laurent de Cavel — Founder & designated Data Protection Officer
How it works
Answer a few plain questions about your business
Get an instant, itemized quote — no black box
Sign online; we publish your representative contact
EU representative — frequently asked questions
Is an EU representative mandatory?
If you are outside the EU and you target or monitor people in the EU under the GDPR, Article 27 makes it mandatory — with only a narrow exemption for occasional, low-risk processing.
What is the difference between an EU representative and a DPO?
An Article 27 representative is your local contact point in the EU for non-EU organisations. A DPO oversees your overall compliance programme. They are different roles — we can provide both.
Does appointing a representative make us GDPR-compliant on its own?
No. The representative is one required element. Full compliance also covers records, privacy notices, data-subject requests, security and more — which our external DPO service handles.
How much does an EU representative cost?
It depends on your size and obligations, which is why we built an instant, itemized online quote — no "contact us for pricing".
Can one representative cover several EU countries?
Yes. A single representative covers the EU/EEA; our pricing simply scales with the number of countries you target.
Appoint your EU representative today
Instant quote, no commitment — overseen by a CNIL-designated DPO.
Get my quote →