Any company outside the EU that processes personal data of people in the EU must appoint a representative established in the Union. That duty comes from Article 27 GDPR and applies regardless of company size or revenue. It is separate from product safety rules such as the GPSR, and separate from appointing a data protection officer.

Usantis is not itself the representative. Article 27(3) requires a representative established in the Union, so a US provider cannot fill that role. Usantis provides a named individual established in Germany, appointed by power of attorney, and operates the platform around that appointment.

What a mandate includes

• A named representative established in Germany, appointed by power of attorney
• A physical EU postal address that receives correspondence from supervisory authorities and data subjects
• Receipt, translation and forwarding of data subject requests, tracked against the statutory deadline
• A hosted compliance page, a request form and a trust badge to link from your privacy notice
• The exact wording to publish under Articles 13 and 14, which require the representative's identity and contact details in the privacy notice itself

Pricing

Standard is $490 per year, billed annually, and covers 10 data subject requests per year under fair use, with translation from 5 languages. Premium is $99 per month or $990 per year and adds unlimited requests, a faster response time, translation from all 24 EU languages, a custom domain for the compliance page and support in the event of a data breach.

Where the data lives

The platform runs on servers in Germany. Payments run through Stripe, electronic signatures through Skribble, transactional email through Resend.

A free checker on the website answers in under a minute whether Article 27 applies to a given company.