FAQ

Under Article 27 of the GDPR, companies established outside the European Union (EU) must appoint an EU representative if they:

• Offer goods or services to individuals in the EU, even if provided for free.
• Monitor the behaviour of individuals within the EU, such as cookie profiling.

The GDPR representative requirement applies to both data controllers and processors, meaning it covers businesses that process personal information for their own purposes as well as those processing it on behalf of another company.

For example, you need a GDPR representative if you run an online shop or marketplace targeting EU customers, provide a cloud-based software solution, or offer an AI service on a SaaS basis.

Under Article 27 of the GDPR, you do not need to appoint a GDPR representative if you data processing:

• is occasional, non-systematic;
• does not include large-scale processing of sensitive data (e.g. health, religion, ethnicity) or information related to criminal convictions;
• is unlikely to result in a risk to the rights and freedoms of individuals.

In practice, meeting all these criteria is challenging, and the exemption from the GDPR representative requirement is rarely applicable for most businesses.

If you fail to appoint a GDPR representative as required under Article 27, your business can face significant fines and penalties. The GDPR imposes fines of up to €10 million or 2% of your global annual turnover, whichever is higher. Additionally, non-compliance can lead to reputational damage.

A GDPR representative acts as a contact point between your business and EU data protection authorities and individuals. Kanto, as your GDPR representative:

• Receives inquiries from authorities and individuals addressed to your business and facilitates communication with your business.
• Assists with maintaining records of processing activities to ensure they meet GDPR requirements.
• Facilitates communication and cooperation with EU supervisory authorities during investigations or audits.

These are mandatory tasks of a GDPR representative.

A GDPR representative should be appointed in an EU Member State. You are not required to have a representative in each Member State. A single representative will cover all other Member States.

If a large portion of your customer base is in a specific Member State, it is advisable to appoint your representative there. With Kanto, your GDPR representative will always be accessible.

Yes, you are required to make the details of your GDPR representative public. This information must be included in your privacy notice and other relevant communications with data subjects. The purpose is to ensure that individuals and data protection authorities can easily contact your representative regarding any data protection issues.

No, you are not specifically obliged to notify data protection authorities of your GDPR representative. However, you must ensure that the representative’s contact details are readily available in your privacy notice and other communications with data subjects.

Your GDPR representative does not assume your legal liability for GDPR compliance. This is explicitly outlined in the GDPR provisions. Kanto facilitates communication with data protection authorities and data subjects with your business.

Kanto provides a range of services as your GDPR representative, including:

• Facilitating communication with EU data protection authorities and data subjects.
• Assisting in creating and maintaining records of processing activities required from you by the GDPR.
• Facilitating cooperation with EU supervisory authorities during investigations or audits.

Additionally, Kanto’s group companies are eligible to serve as your UK representative and Swiss representative.

Kanto serves as your reliable GDPR representative.

Within Kanto Group, you can receive advice on your general GDPR compliance from our team of legal experts and IAPP-certified privacy professionals.

Yes, Kanto Group can serve as your Data Protection Officer (DPO). The DPO oversees your data protection strategy and ensures compliance with GDPR across your entire organisation.

By appointing us as your DPO, you benefit from our extensive expertise and dedicated focus on maintaining your data protection standards.

You must appoint a GDPR representative in writing. Kanto facilitates this process with electronic signatures, ensuring a smooth, paperless experience.

To appoint a GDPR representative, please contact us at:

We look forward to assisting you with your GDPR compliance needs.

Our prices start at EUR 1,500 and are flexible depending on your company’s size. For detailed pricing information and to find the plan that best suits your business, please contact us.