Your legal representative in Europe
Your EU Representative under the GDPR
Processing personal data of Europeans but have no establishment in the EU? Then the GDPR requires you to appoint a representative who is based in Europe. We take on that role, with name and address.
Short answer
If you process personal data of people in the EU without an EU establishment, Article 27 of the GDPR requires you to appoint a representative in the Union. Chuyenso takes on that role with a Belgian address, a written mandate, the processing register, and handling requests. Subscriptions start from €1.850 per year, certified by an EADPP.
Do you recognize any of these situations?
No European Establishment
You sell to European customers or track European visitors on your website, but you have no office, branch, or entity within the EU. Under GDPR Article 27, you are then required to appoint a representative in the Union in writing.
A questionnaire on your desk
A European buyer or distributor sent you a supplier questionnaire about your data flows, sub-processors, and EU representative. You have two weeks to respond, and you don’t know where to start.
An upcoming audit
An acquisition, investment round, or certification process is on the horizon, and privacy is on the checklist. You need compliant documentation—not a policy copied from the internet.
Data you no longer oversee
You’re not entirely sure which tool stores which data, where it’s located, or who has access. Every new SaaS tool adds another layer to a system that no one has fully mapped out.
Our expertise
How we can help you
EU Representation (Article 27)
We act as your appointed representative in the European Union, with a Belgian address for your privacy policy, a formal mandate, and a point of contact for stakeholders and regulators. We maintain your processing register and handle incoming requests.
Requests from data subjects
Access, rectification, erasure, restriction, objection, and portability. We handle these requests, verify identities, monitor deadlines, and ensure a compliant response is sent. You provide the data; we handle the rest.
Mapping data flows
We outline which system contains which data, where it is physically stored, who has access, and the legal basis for processing. Not the organizational chart: the actual data flows, including helpdesk, analytics, and that shared drive.
Data Transfer Outside Europe
Transferring personal data outside the EU is allowed, but not without proper safeguards. We arrange the Standard Contractual Clauses, conduct the Transfer Impact Assessment, and document why the structure is sustainable.
Data breaches & incidents
The GDPR gives you 72 hours to report a data breach to the supervisory authority. That’s shorter than it sounds when it starts on a Friday evening. We write the playbook, set up contact routes, and are the number you call when things go wrong.
European Infrastructure
Privacy isn’t just about documentation. We move your site and data to European LiteSpeed servers with hourly external backups, set up tracking via your own servers, and run AI models on your own infrastructure. This ensures both your policy and your infrastructure are compliant.
What does it cost?
One-year subscription, no project with an end date
As long as you process European data, this role must be fulfilled. That’s why we work with a yearly subscription.
EU Scan
€1.950 one-time
No representation needed yet, but want to know where you stand?
- Three sessions over three weeks
- Where you stand today and what the gaps cost
- 90-day plan with compliance summary for your European buyer
- Discounted if you choose a subscription within 30 days
Basic
€1.850 per year
- Written appointment and Belgian address in your privacy statement
- Point of contact for data subjects and supervisors
- Register of processing activities
- Up to 10 data subject requests per year
Comprehensive
€4.500 per year
Everything from Basic, plus:
- Annual audit of your data flows
- Support for DPIAs
- Data transfer documentation with transfer impact assessments
- Incident response plan and unlimited requests from stakeholders
All prices exclude VAT in euros. Cancellable annually. VAT exemption for non-European businesses. Prices apply per legal entity.
Step-by-step plan
From ‘we’re not sure’ to a documented dossier
In 5 phases to a dossier you can present to a European buyer or supervisor
1Introduction and scoping · week 1
One hour-long conversation and a quick scan. Do you process personal data of people in the EU, and if so: whose, for what purpose, and through which systems? We assess your website, sales channels, and tools against Article 3 of the GDPR.
By the end, you’ll know whether Article 27 requires you to appoint a representative, if you additionally need a DPO, and where your biggest exposure lies. Sometimes the answer is ‘less than you thought.’ We’ll tell you that, and then it ends here.
2Data flows and legal bases · week 2 to 3
We identify which data your systems contain, where they are stored, who has access, how long you retain them, and the legal basis. We interview your IT manager, someone from marketing, and someone from sales or support.
You receive a processing register and a data flow map that you can share.
3Appointment, documents, and contracts · week 3 to 4
We draft the written mandate and provide the text and contact details for your privacy statement. Additionally, we rewrite your privacy statement to align with the correct legal grounds, process contracts, and where necessary, standard contractual clauses with a transfer impact assessment.
If you work with a lawyer, we prepare the dossier so they only need to review it.
4Implementation, training, and incident playbook · week 5 to 6
We implement technical measures: retention periods, access rights, European hosting, or first-party tracking. We draft the incident response plan with the 72-hour clock and provide your team with a practical half-day training.
5Continuous Representation
We serve as your point of contact in your privacy statement, handle requests from data subjects, keep the processing register up to date, and are the number you call when something goes wrong. Once a year, we review together which tools, markets, and data have been added.
174
satisfied customers
105
returning customers
8
Certifications
28K+
working hours at companies
FAQ
Frequently Asked Questions
What is an EU Representative under the GDPR?
Article 27 of the GDPR requires organizations outside the European Union that offer goods or services to people in the EU, or monitor their behavior, to appoint a representative in writing who is established in an EU member state. This representative serves as the contact point for data subjects and supervisory authorities and maintains the record of processing activities.
Is my European distributor or lawyer sufficient?
Usually not. A representative requires a written appointment, establishment in the correct member state, the role of contact point for stakeholders and supervisory authorities, and inclusion in your privacy statement. A distributor, law firm, or group company does not automatically fulfill this role.
Is an EU representative the same as a DPO?
No, and you might need both. The Representative is your point of contact within the Union because you are not established there yourself. The Data Protection Officer (DPO) is a supervisory role mandated by Article 37, based on your core activities and the scale of your data processing.
We comply with our own national privacy laws. Is that sufficient?
Usually not. The GDPR applies extraterritorially: it follows the individual, not the border. For example, Vietnam’s PDPL (effective since January 1, 2026) is based on the GDPR but not identical, and Mexico’s revised LFPDPPP from March 2025 does not fully cover European requirements.
What if there’s a data breach?
A 72-hour notification period applies to the supervisor. We draft the playbook beforehand, are available in the contact line, and guide the notification. This is included in the comprehensive subscription.
How soon can you get started?
The appointment itself takes just days. The underlying scan of data flows, legal bases, and transfers typically takes three weeks.
Ready to start a project with us?
Whether you want to confirm if Article 27 applies to you or need a representative immediately: we’ll take a non-binding look.