EU GDPR Representative

A statutory checkbox, held by a law firm

UK companies since Brexit, US software and e-commerce businesses, and technology companies worldwide sell to people in the Union without an office in it. Article 27 of the GDPR requires each of them to designate an EU representative: a named contact in the Union for supervisory authorities and for the people whose data they process. Kleanthous & Platis LLC, a law firm in Nicosia, acts as that representative from Cyprus, a common law, English speaking Member State.

Who needs one, and who is exempt

The GDPR reaches companies with no presence in the Union through Article 3(2): it applies where processing relates to offering goods or services to people in the Union, or to monitoring their behaviour within it. A store that ships to the Union, a SaaS product with European users, an app whose analytics profile European visitors: each is within it.

For those companies Article 27 requires a representative in the Union, designated in writing. The exemption in Article 27(2) is narrow and cumulative: processing that is occasional, includes no large-scale special category or criminal conviction data, and is unlikely to result in a risk to the rights and freedoms of individuals. A business processing customer or user data as part of its ordinary operations rarely fits all three limbs.

The obligation is checked by counterparties more often than by regulators: enterprise customers, app store reviews and privacy audits ask who your Article 27 representative is, and a blank answer stalls the deal.

What the appointment includes

A written representative agreement, signed and returned within one business day of our confirmation, with the exact wording to add to your privacy notice and records. From then on we are your point of contact in the Union: supervisory authorities and data subjects may address us on all issues related to the processing, in addition to or instead of you.

Anything that arrives is notified to you by email on the same business day and forwarded, with the document following by courier where there is an original. We hold your record of processing activities under Article 30, kept from the copy you provide and produce it to a supervisory authority on request. Renewal is handled by us, so the appointment never lapses while you need it.

Why a representative in Cyprus works

Article 27(3) requires the representative to be established in one of the Member States where the people whose data you process are. Where a company serves or monitors people across the Union, any Member State qualifies, and Cyprus offers what a non-EU legal team actually wants from the choice: an English speaking, common law jurisdiction, in the Union, with correspondence handled by a regulated law firm rather than a mailbox service.

The honest limit: where processing targets only specific Member States and Cyprus is not among them, a Cyprus representative is the wrong answer, and we say so at the checking stage rather than take the appointment.

A fixed annual fee per company

The fee is €750 per company per year, plus VAT where it applies. It is the whole of the cost: there is no charge for receiving, notifying or forwarding correspondence, and no charge arises if nothing ever arrives.

Where a group needs several entities represented, ask: we quote a reduced fee per additional entity appointed under the same arrangement.

Request the appointment

Tell us who the company is and what it does with data from the Union. We run a conflict and client check and reply within one business day with the representative agreement for signature, the exact wording for your privacy notice.

If a customer contract or an audit is waiting on the answer, say so in the notes and copy the request to klitos@kleanthousplatis.com.