EU GDPR Representative, Article 27

A statutory checkbox, held by a law firm

UK companies since Brexit, US software and e-commerce businesses, and technology companies worldwide sell to people in the Union without an office in it. Article 27 of the GDPR requires each of them to designate an EU representative: a named contact in the Union for supervisory authorities and for the people whose data they process. Kleanthous & Platis, a law firm in Nicosia, acts as that representative from Cyprus, a common law, English speaking Member State.

How to appoint us

The fee is fixed at €750 per company per year, published below. Request the appointment online and, after a conflict and client check, we return the signed representative agreement within one business day, together with the exact wording for your privacy notice. Or contact Klitos Platis directly at klitos@kleanthousplatis.com or call +357 22 680 330.

Request the appointment

The obligation

Who needs one, and who is exempt

The GDPR reaches companies with no presence in the Union through Article 3(2): it applies where processing relates to offering goods or services to people in the Union, or to monitoring their behaviour within it. A store that ships to the Union, a SaaS product with European users, an app whose analytics profile European visitors: each is within it.

For those companies Article 27 requires a representative in the Union, designated in writing. The exemption in Article 27(2) is narrow and cumulative: processing that is occasional, includes no large-scale special category or criminal conviction data, and is unlikely to result in a risk to the rights and freedoms of individuals. A business processing customer or user data as part of its ordinary operations rarely fits all three limbs.

The obligation is checked by counterparties more often than by regulators: enterprise customers, app store reviews and privacy audits ask who your Article 27 representative is, and a blank answer stalls the deal.

The service

What the appointment includes

A written representative agreement, signed and returned within one business day of our confirmation, with the exact wording to add to your privacy notice and records. From then on we are your point of contact in the Union: supervisory authorities and data subjects may address us on all issues related to the processing, in addition to or instead of you.

Anything that arrives is notified to you by email on the same business day and forwarded, with the document following by courier where there is an original. We hold your record of processing activities under Article 30, kept from the copy you provide and produce it to a supervisory authority on request. Renewal is handled by us, so the appointment never lapses while you need it.

Cyprus

Why a representative in Cyprus works

Article 27(3) requires the representative to be established in one of the Member States where the people whose data you process are. Where a company serves or monitors people across the Union, any Member State qualifies, and Cyprus offers what a non-EU legal team actually wants from the choice: an English speaking, common law jurisdiction, in the Union, with correspondence handled by a regulated law firm rather than a mailbox service.

The honest limit: where processing targets only specific Member States and Cyprus is not among them, a Cyprus representative is the wrong answer, and we say so at the checking stage rather than take the appointment.

Fees

A fixed annual fee per company

The fee is €750 per company per year, plus VAT where it applies. It is the whole of the cost: there is no charge for receiving, notifying or forwarding correspondence, and no charge arises if nothing ever arrives.

Where a group needs several entities represented, ask: we quote a reduced fee per additional entity appointed under the same arrangement.

Appoint us online

Request the appointment

Tell us who the company is and what it does with data from the Union. We run a conflict and client check and reply within one business day with the representative agreement for signature, the exact wording for your privacy notice, and a secure link to settle the fixed fee.

If a customer contract or an audit is waiting on the answer, say so in the notes and copy the request to klitos@kleanthousplatis.com.

Your name *

Please enter your name.

Work email *

Please enter an email address we can reply to.

Company to be represented, and where it is established *

e.g. "Example Inc., Delaware, USA" or "Example Ltd, London, UK".

Please name the company and its country.

What the company does

Any office, branch or subsidiary in the EU?

Health, biometric or other special category data at scale?

Needed in place by

Notes

Anything else that matters: roughly how many people in the Union you serve or monitor, which countries, whether an audit or a contract is waiting.

Fields marked * are required. Please do not send personal data or internal documents at this stage.

We are not your representative, and no fee is due, until we confirm in writing after a conflict and client check and the representative agreement is signed by both sides.

Common questions

Does my company need an EU representative?

If it has no establishment in the Union but offers goods or services to people in the Union, or monitors their behaviour, Article 27 requires it to designate a representative in the Union in writing. The exemption in Article 27(2) covers only processing that is occasional, includes no large-scale special category or criminal conviction data, and is unlikely to result in a risk to the rights and freedoms of individuals. A business processing customer or user data as part of its ordinary operations rarely fits that exemption.

Can the representative be in Cyprus?

Yes. Article 27(3) requires the representative to be established in one of the Member States where the data subjects are. Cyprus is a Member State, so where a company serves or monitors people across the Union, a representative in Cyprus satisfies the Article. Where processing targets only specific other Member States and not Cyprus, we say so and decline rather than leave a compliance gap.

What does the representative actually do?

The representative is the company's point of contact in the Union: named in the privacy notice, addressed by supervisory authorities and by data subjects on all issues related to the processing, and holding the record of processing activities under Article 30. When a letter or request arrives we notify the company the same business day and forward it, and we hold the record so it can be produced to an authority on request.

Is an EU representative the same as a Data Protection Officer?

No. The representative under Article 27 is a contact point in the Union for a company established outside it. A Data Protection Officer under Article 37 is an oversight role with independence requirements, and some companies need both. Acting as your representative does not make us your DPO, and the two should not be combined in one appointment.

What does it cost and how fast is it in place?

A fixed fee of €750 per company per year, plus VAT where it applies, with no charge for receiving and forwarding correspondence. After a conflict and client check we return the signed representative agreement within one business day, together with the exact wording to add to your privacy notice.

We are a UK company. Do we need this after Brexit?

Since the end of the transition period the United Kingdom is a third country, so a UK company with no EU establishment that offers goods or services to people in the Union, or monitors them, needs an EU representative under Article 27 like any other non-EU company. The reverse also exists: the UK GDPR requires a UK representative of EU companies serving the UK, which is a separate appointment we do not provide.

Who leads this work

Between them the partners bring more than 40 years of practice in Cyprus. Every matter is run by one of them.

Andreas Kleanthous

Partner

Litigation, personal injury and insurance claims, debt recovery, administrative law, real estate, wills and probate.

Klitos Platis

Partner

Litigation, corporate and commercial matters, property and construction, including pleadings, interim applications and trial preparation.

The obligation is in Regulation (EU) 2016/679, Articles 3(2), 27 and 30, with the guidance in EDPB Guidelines 3/2018 on territorial scope. This page is general information, not legal advice on whether your company is within Article 27; that question is answered at the checking stage before we accept an appointment.

Request a consultation

Tell us briefly how we may assist

A few sentences is enough: who the company is, what it does with data from the Union, and when the appointment has to be in place. We reply within one business day. Please do not send personal data or internal documents until we confirm we can act.

Request a consultation

Or write to us directly at office@kleanthousplatis.com, or call +357 22 680 330.

A statutory checkbox, held by a law firm

Who needs one, and who is exempt

What the appointment includes

Why a representative in Cyprus works

A fixed annual fee per company

Request the appointment

Andreas Kleanthous

Klitos Platis

The Cyprus Presence Pack

Cyprus Process Agent Services

Technology & E-commerce

Tell us briefly how we may assist