Frequently Asked Questions

Yes. There is no minimum threshold. Even one EU customer or user triggers GDPR obligations if you process their personal data. The only narrow exemption (Article 27(2)(a)) is for occasional, low-risk processing — which rarely applies to commercial businesses.

Technically yes, but it carries significant risk. If they’re unavailable during a regulator inquiry, move away, or simply miss an email, you face the consequences. Professional services like EU Shield have SLAs, backup personnel, and compliant processes that individuals cannot provide.

With EU Shield, the entire process takes about 15 minutes. Fill out the form, sign the designation agreement, and you’re active by the next business day. Your privacy policy update takes another 10 minutes.

We receive the communication, log it, and forward it to you within 24 hours with context and recommended response timelines. You handle the substantive response; we handle the logistics.

No. An EU Representative (Article 27) is a mandatory point of contact for non-EU businesses. A DPO (Articles 37-39) is an internal compliance advisor. Different legal bases, different roles. Some businesses may need both.

Yes. The UK is a third country under EU GDPR. UK companies selling into the EU need an EU Representative. Note: you may also need a UK Representative under UK GDPR.

If you have a genuine establishment in the EU, you don’t need a separate Article 27 representative — your EU establishment serves that function. However, you must still comply with all other GDPR obligations.

Up to €10 million or 2% of global annual turnover (whichever is higher). Beyond fines, you risk regulatory investigation, reputational damage, and potentially data processing bans.

Yes. With EU Shield, you can cancel anytime. We provide a 30-day money-back guarantee if you’re not satisfied. We’ll help transition to a new provider if needed.

Yes. Our representative service covers all EU member states. We’re established in the EU and can represent you regardless of where your data subjects are located.

Yes, under Article 3(2) of GDPR. Any non-EU company offering goods or services to EU residents, or monitoring their behavior, falls under GDPR — with or without a US office.

Yes. GDPR has no small business exemption. The requirements scale with risk, but the obligation to have a representative applies to anyone processing EU residents’ data commercially.

Under the EU General Product Safety Regulation (EU 2023/988), every product sold to EU consumers must have a responsible economic operator established in the EU. If you are a non-EU seller, you must appoint an EU Authorized Representative and show their details on your product and marketplace listings. EU Shield provides this service for €490/year covering all 27 member states.

Yes. Amazon and other marketplaces require valid EU Responsible Person details in your compliance fields for products sold to EU customers. Listings without them can be restricted or suspended.

Yes. They are separate services — Article 27 covers personal data obligations, GPSR covers product safety obligations — and each is €490/year flat. Many sellers need both.