Selling into the EEA from Switzerland, the USA, the UK or Singapore? Then you need a designated EU point of contact. SIDD takes on the mandate through its Munich entity, a fixed CHF 600/year, appointed within 48 h. Note: we are not your sales representative and not a member of the European Parliament, we are your legal representative under Art. 27 GDPR.
Working for regulated industries and SMEs
Brief definition
An EU representative (Art. 27 GDPR) is a natural or legal person established in the EU who represents a third-country company vis-à-vis European supervisory authorities and data subjects. They serve as the point of contact for authority enquiries, keep the records of processing activities (ROPA) available locally, and enable data subjects to exercise their GDPR rights, they are neither a sales representative nor a member of the European Parliament.
The European legislator requires a representative in the EU so that data protection authorities have an accessible point of contact within their jurisdiction and data subjects can effectively exercise their rights. The representative is subject to EU law and cannot evade official proceedings.
Answer the following five questions. If you answer one of them with "Yes", you are obliged under Art. 27 GDPR to designate an EU representative.
Does your company have no establishment in the EU?
Do you offer goods or services to persons in the EEA (including via a website, an online shop or an app)?
Do you monitor the behaviour of persons in the EEA (e.g. tracking, analytics, profiling)?
Is the processing not merely occasional or does it involve special categories (Art. 9) or criminal data (Art. 10)?
Are you not a public authority or public body?
A "Yes" answer to 1 plus at least one of 2 or 3 (and 4 + 5) triggers the obligation to designate a representative. In the event of a breach, fines of up to EUR 20 million or 4% of worldwide annual turnover may apply.
We carry out the mandate through our Munich-based company, as a legal person, not via a private registered address.
Note: maintaining and drawing up the records of processing activities remains the responsibility of the controller (your company outside the EU). We recommend combining this with our Data Protection Advisor (Switzerland) oder Data Protection Officer (EU).
Under Art. 27(5) GDPR, the designation of a representative does not affect the liability of the controller or processor themselves, both remain primarily responsible. However, the representative can be addressed directly by supervisory authorities and is the addressee for enforcement measures. Recital 80 makes clear that the representative is subject to enforcement measures in the same way as the controller. In recent years, supervisory authorities (in particular the Bavarian LfD and the HmbBfDI) have repeatedly imposed fines on representatives where the mandate existed only formally.
Consequence: you should choose a representative with documented processes, a duty of confidentiality and legal competence, not just a letterbox address.
If you sell into both the EEA and the United Kingdom, you need both. The mandates are separate.
More details on our UK representative page. On request, we handle both mandates from a single source.
Fixed annual price, no hidden costs. Reduced group rates available for corporate groups on request.
EU representative · Standard
600 CHF / year
Per represented company. All requests from the EEA are forwarded to you.
Group rate
On request
For group structures with several subsidiaries outside the EU.
Tip: If you provide your own email address in your privacy notices, the majority of data-subject requests will reach you directly, we remain the escalation point and contact for authorities.
Four steps to an established EU representation. Typical duration: 48 hours until live designation.
Digital service agreement with a clear scope of services as Art. 27 representative.
You provide your records of processing activities (or commission a Data protection workshop).
You name our Munich company as your EU representative in your privacy notices.
Incoming requests are communicated to you promptly and coordinated jointly.
An Art. 27 mandate is a liability and authority-facing function, not a mailbox: these six points show why third-country companies entrust it to SIDD.
In your privacy notices we name our own company in Munich as a legal entity with a business address, no third-party mailbox address and no private registered address. This is the robust point of contact that supervisory authorities expect under Art. 27 GDPR .
The mandate is managed by Dr. Dominic Staiger as a lawyer and is subject to professional secrecy under Art. 321 SCC. Authority requests and data-subject information passing through us are therefore especially protected.
Authority requests are given an initial assessment by a doctorate-level data-protection lawyer (Dr. iur., LL.M., CIPP/E), not merely forwarded. This way you avoid the formal sham mandate against which the LfD Bayern and HmbBfDI have already imposed fines.
Digital contract, fixed annual flat fee from CHF 600, no setup fee: within 48 hours our Munich business details are available for your privacy notices. A dedicated contact person, with an initial response within 24 hours.
We operate our own companies in Munich and London and handle mandates in CH, EU, UK and US. If you sell into the EEA and the United Kingdom, we take on both separate representations, the EU one under Art. 27 GDPR and the UK one under Art. 27 UK GDPR, coordinated through a single point of contact.
Incoming requests from the EEA are received, documented and escalated to you in a traceable manner. In the event of enforcement by an authority under Recital 80, this verifiability is what distinguishes a representative from a mere address.
Our tool: LexCommand
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
For the Art. 27 mandate, concretely: when a supervisory authority enquiry arrives from the EEA, LexCommand grounds our first assessment in the governing norm, every reference to Art. 27 GDPR or recital 80 carries a retrievable source, kept cleanly separate from the UK GDPR.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
A fixed 600 CHF per year and per represented company. Reduced group rates apply for corporate groups. No setup fee, no hidden costs.
Your company remains responsible as the controller or processor. However, the EU representative is also an addressee for enforcement measures (Art. 27(5) GDPR, Recital 80). We reduce the risk through documented processes and an initial review of requests.
In theory yes, in practice not advisable. Their private registered address would then have to appear in your privacy notice. We designate our Munich company as a legal entity with a business address.
Contract signing and provision of the business details for your privacy notice take place within 48 hours of receiving your engagement.
Possibly yes, it depends on your processing activities. The EU representative does not replace a DPO under Art. 37 GDPR. We are happy to handle the dual mandate from a single source, see Data Protection Officer (EU).
We receive the request, document it, conduct an initial review and agree the response with you. For complex requests, we recommend extending the engagement with a data-protection advisor mandate or hourly-rate consulting.
Order online now. You receive the contract digitally, our Munich business details for your privacy notice and a dedicated point of contact.