GDPR Representation Service

Including UK and EU countries

Ask About Representation

Do you need to appoint a Representative under GDPR?

Article 27 of the GDPR (General Data Protection Regulation) states that organisations will have to appoint a representative under certain conditions.

This means that you will likely need someone to act on your behalf when either customers or EU Regulators (European Union Regulators) have questions about your data processing activities.

We work with an orgnisation called DataRep who have a local presence in all 27 EU member states, the UK and EEA (Norway and Iceland).

As part of this relationship, we will ensure that your ROPA (Record of Processing Activities) is accurate, and information requests can be fulfilled in a timely, frictionless manner. Additionally, by working through us, we can offer you rates not available to most businesses.

What services will you recieve from GDPR representation?

Local Representation across EU

DataRep has contact locations in every EU member state, two EEA member states (Norway and Iceland) and the UK, giving your business an address for data requests in each of those countries.

DataRep considers providing a contact location across all relevant countries an essential part of the Data Protection Representative service, and your customers in Europe will expect this too – most Representatives only offer contact locations in a few EU member states, which may not meet good practice requirements (See European Data Protection Board guidance 03/2018).

Unlimited Communication

Post-Brexit Cover

Active Enquiry Management

Article 30 Record Retention

The Data Protection Representative is required by Article 30 of GDPR to hold a copy of their client’s Records of Processing Activities (ROPA) for review by the local EU Data Protection Authorities.

We hold the Article 30 records of our clients securely in preparation for such a request, and will let you know if and when they are requested by an Authority. We do not charge to update the Article 30 records of processing we hold.

Translation & Language Services

Who are DataRep?

Based in Dublin, Ireland, and with representation in 30 countries thanks to their unique network of contact locations established in all 27 EU countries, Norway & Iceland in the EEA, and the UK (through their sister company DataRep UK), DataRep was created to meet their clients’ need to have a Data Protection Representative in the EU to provide the representation necessary to meet their obligation under Article 27 of GDPR.

Their aim is to provide the best Data Protection Representative service in the market, and with our contact location network, logical and reasonable pricing, customer-branded landing pages and easy facilitation of contact between their clients and their customers, we truly believe that their service is the best available. They will ensure that you, as their client, have the most-convenient routes of communication with your customers and the Data Protection Authorities in the EU, EEA and UK, and that you remain compliant even if your data subject demographics change between countries over the course of their appointment.

Ask About Representation

Article 27: Representatives of controllers or processors not established in the Union

Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
The obligation laid down in paragraph 1 of this Article shall not apply to:a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
b) a public authority or body.
The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.
The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

If you’re still uncertain or would like clarification on what a GDPR Data Representative does or which options are most suitable to your particular requirements, please chat to one of our Privacy and Data Protection experts today.