Benefits of our GDPR Representative service:
- Full compliance with Article 27 EU/UK GDPR
- Act as a one-stop shop for all EU member states
- Easy access and availability at any time for data subjects and authorities
- Unlimited requests from data subjects
- Unlimited requests from supervisory authorities
- Support when a data breach occurs
- Quick and efficient onboarding
How Our GDPR Representative Service Works
As your GDPR Representative, we act as your point of contact in the EU and/or the UK. The Representative plays a pivotal role as the bridge between your organisation and the diverse stakeholders in the EU/UK, including data subjects and authorities. Appointing a Representative is mandatory for most companies located outside the EU/UK that want to do business in the EU/UK as specified in Article 27 of the GDPR (more information in the FAQ below).
Privacy Experts Ready to Respond
We believe that a GDPR Representative should be the least of your worries. When you engage Vivenics as your GDPR Representative, you can have complete confidence that you are fulfilling your obligations under Article 27 GDPR. Furthermore, you gain access to a dedicated team of privacy experts ready to respond to any request. Our experts are certified by the International Association of Privacy Professionals (IAPP) and have extensive experience in the field of privacy and data protection. Notably, their background is in the Life Sciences industry, which enables them to support Life Sciences companies optimally and align their responses and actions with your processes, GxP requirements, and quality system.
A Tailored Approach to Fit Your Needs
At Vivenics, we value long-term relationships, and invest in getting to know your organisation from the outset. Our service starts with an onboarding assessment, where we look into your operational activities, identify how we can support you most effectively, and flag any significant compliance risks. We also appoint a lead contact person that is at your service at any time necessary. Upon formalizing the Representative appointment through a signed mandate form, we are ready to go. We provide you with a certificate showing that you have appointed us as GDPR Representative, which you can share with your partners. We also provide regular reports about requests each quarter – or more often if needed.
A GDPR Representative should be the least of your worries
Frequently Asked Questions
The obligation to appoint a GDPR Representative is stated in art. 27 of the EU and UK GDPR. If your organization meets the following criteria, you are obligated to appoint an EU GDPR Representative:
- Your organization is located outside the EU/UK and has no EU/UK establishment.
- Your organization processes personal data of people in the EU/UK, because you offer them services or goods, or monitor their behaviour.
- The processing of personal data is not unlikely to result in privacy risks. Note that even occassional or small-scale processing can create risks, and risks are almost certainly present when processing sensitive data, such as health data.
If you are located outside the EU and UK and meet the criteria above, you need to appoint a Representative in both the EU and the UK.
Your GDPR Representative can be a person or an expert organization like Vivenics. A Representative needs to have specific skills and has potential liabilities to act on your behalf. Hiring an expert company with both legal, business and IT knowledge is usually the best choice.
Of course, your Representative must have an in-depth knowledge of the GDPR. Excellent communication skills and knowing the culture of your European customers is also important, next to the right approach that fits your business. Some companies use a rigid automated approach, while others handle requests personally and engage in conversation with the customer. As the GDPR representative is your point of contact for your customers with respect to privacy, you should consider this carefully.
Additionally, the Representative can be approached by supervisory authorities and should be able to adequately answer them without leaving you in trouble. Look for companies that have experience with compliance and government oversight.
The EU GDPR Representative should be located in the EU, Norway, Liechtenstein or Iceland (the European Economic Area). The UK GDPR Representative should be located in the United Kingdom. You need both GDPR Representatives when you process personal data of both the European Economic Area and UK inhabitants, and are not located there.
Ideally, your GDPR Representative should be close to the customers in a country that you’re doing most business in. If you’re doing business in multiple EU countries, it’s best to choose one of them. In that case, a digitally, internationally and trade oriented country like the Netherlands is a good choice.
After you have selected a qualified GDPR representative, you are ready to appoint the Representative. This is done using a GDPR Representative agreement that defines the details and conditions of the service, as well as the protection and confidentiality of your data. You then mandate the Representative to be addressed by authorities and the people you process personal data from. Subsequently, you and your Representative work together to meet all requirements from the GDPR.
To represent you in the EU and/or the UK, your GDPR representative needs information regarding your processing activities and your level of compliance with GDPR. In the Vivenics service, this is part of the onboarding (as outlined above).
Contact us below to appoint your GDPR Representative or learn more.
Get in Touch with an Expert
Want to get more information or request a proposal? Use the form below or email to gdprteam@vivenics.com.