Under EU GDPR Article 27 and the UK GDPR equivalent, any organisation without a physical establishment in the EU or UK that offers goods, services, or monitors behaviour there must appoint a written Representative. The Representative acts as your local point of contact for data-protection authorities (DPAs) and data subjects, keeps your Record of Processing Activities (RoPA) available for inspection, and helps demonstrate accountability. Without one you risk enforcement notices and fines, and many marketplaces now insist on proof before allowing listings.

As soon as we receive your signed agreement and payment, we issue your Certificate of Representation—usually within 24 hours. You can then add our details to your privacy notice immediately.

The moment a DSAR arrives at our representative inbox we time stamp it and forward the full request to your nominated contact so your 30-day response clock starts without delay. On higher tier plans we can also help you draft or review the reply before it’s sent.

We store all correspondence in an ISO 27001-certified environment, encrypt data in transit and at rest, and retain it only for the statutory period. Access is restricted to vetted compliance staff.

Absolutely. Plans renew annually; cancel any time before the renewal date and no further fees will be charged. We simply cease acting as your Representative and you remove our details from your privacy notice.

No caps, throttles, or hidden fees. We’ll receive and forward every regulator letter, complaint, or DSAR we get on your behalf, whether that’s two per year or two hundred.

No. An Article 27 Representative is a local liaison for regulators and data subjects; a DPO is an internal governance role focused on your compliance programme. Some organisations need both, some need only one.

No. We act solely as your Article 27 Representative, not as a controller or processor. You remain fully responsible for compliance; we facilitate communication with authorities and data subjects.