If your company has no office in the EU and you cold email people there, GDPR Article 27 requires you to name a representative in the EU, in writing, and the UK GDPR has the same rule for prospects in the UK. The one exemption open to a business is for occasional processing, which the European Data Protection Board reads as not regular and outside your normal course of business, so weekly outbound does not fit it. The small-company plans I priced on 21 October 2026 cost €150 to €1,920 a year. Locatefamily.com was fined €525,000 in the Netherlands for having no representative there.
It is easy to treat GDPR for cold email as one question: may I send this? That answer mostly sits in each country’s electronic marketing rules, covered in which cold email law applies to you. Article 27 asks something else: once a person in Europe sits in your CRM, who in Europe answers for you?
If cold email is how you sell, it is not occasional, and the exemption needs it to be.
Key numbers
| Item | Number |
|---|---|
| GDPR fine ceiling for breaching Article 27 (or 2% of worldwide annual turnover, whichever is higher) | €10 million |
| UK GDPR fine ceiling for the same breach (or 2% of worldwide annual turnover, whichever is higher) | £8.7 million |
| Dutch fine on Locatefamily.com, no EU representative (announced 12 May 2021) | €525,000 |
| Extra penalty for every two weeks without one (capped at €120,000) | €20,000 |
| Dutch people listed on Locatefamily.com | About 700,000 |
| Prighter EU representative, under 10 employees (€39 a month billed monthly, before VAT) | €420 a year |
| Prighter EU representative, 10 to 49 employees (the UK service costs the same) | €852 a year |
| Prighter EU and UK together, under 10 employees (10% off each) | €756 a year |
| EDPO EU representative, up to 50 employees (UK £1,080, with 10% off a second service) | €1,920 a year |
| DataRep, up to 1,000 people in the EU, EEA and UK (no sensitive data) | €150 a year |
| DataRep, up to 50,000 people (€1,000 up to 100,000) | €750 a year |
| Latest point for the Article 14 notice (and within one month of getting the data) | The first message |
Read on 21 October 2026 from the GDPR on EUR-Lex, the UK GDPR on legislation.gov.uk, EDPB Guidelines 3/2018, the Dutch Data Protection Authority’s 12 May 2021 release, ICO guidance and the pricing pages of Prighter, EDPO and DataRep.
What Article 27 asks of a sender outside the EU
Article 3(2) brings a company with no establishment in the Union under GDPR when its processing relates to offering goods or services to people in the Union, whether or not they pay, or to monitoring their behaviour there. A cold email is addressed to a named person in the Union and offers a service. Where Article 3(2) applies, Article 27 says the controller or the processor shall designate in writing a representative in the Union, established in a Member State where those people are.
Regulators and the people on your list can contact the representative in addition to or instead of you on all issues related to the processing, and it does not shield you: the designation is without prejudice to legal action against you. Article 14 puts it in front of the people you email. When the data came from a list rather than from the person, you owe them your identity and contact details and, where applicable, your representative’s, at the latest with your first message to them and within one month of getting the data. In practice that means your first cold email, or the privacy notice it links to.
Why weekly outbound is not occasional
Article 27(2)(a) exempts processing that is occasional, does not include large-scale processing of special category or criminal offence data, and is unlikely to result in a risk to people’s rights. All three must hold. Names, work emails and job titles are not special category data, so a B2B list usually clears the second test. Regular outbound fails the first. The EDPB says processing can only be considered occasional if it is not carried out regularly and occurs outside the regular course of business. A sequence that sends every weekday is regular, and selling is the course of business. The UK regulator’s own example is a sales firm in Ireland with a regular client base in the UK: it must appoint a UK representative.
The text has no B2B carve-out to lean on. The EDPB’s 28-page guidance on territorial scope never uses the terms B2B or business-to-business, and a buyer in Berlin is a person in the Union like any other.
The €525,000 case
In a release dated 12 May 2021, the Dutch Data Protection Authority announced a €525,000 fine on Locatefamily.com because it had no representative in the EU. The site published people’s addresses and sometimes phone numbers, often without their knowledge, and about 700,000 of them were Dutch. People who wanted their details removed had no one in the EU to ask. The authority added an order: name a representative by 18 March 2021, or pay €20,000 for every two weeks without one, up to €120,000.
A bought or scraped prospect list has the same two ingredients: details held by a company outside the EU that the people never gave it, and, without a representative, no one in the EU for them to ask. Whether buying the list is lawful at all is a separate question: see whether buying B2B email lists is legal.
Europe is a small slice of our list, so our processing there is occasional.
The EDPB’s test is regularity, not volume: not carried out regularly and outside the regular course of business.
Appoint one in writing, put its details in the privacy notice your emails link to, and keep the mandate on file.
Article 14 wants those details with the first message when the data came from a list.
What a GDPR representative costs
Three providers I checked publish prices, and they meter two different things. Prighter prices by headcount: its EU service costs €420 a year billed annually under 10 employees (€39 a month billed monthly), €852 for 10 to 49 and €2,040 for 50 to 249, before VAT. Its UK service costs the same, and taking both under 10 employees comes to €756 a year, with 10% off each. EDPO also prices by headcount: up to 50 employees, €1,920 a year for the EU and £1,080 for the UK, with 10% off the second service.
DataRep prices by your list. Its 12-month appointment, with contact points across the EU, EEA and UK, costs €150 if you hold data on no more than 1,000 people there, €750 up to 50,000, €1,000 up to 100,000 and €2,000 up to 300,000, with no sensitive data. For a five-person agency holding 40,000 prospects in the EU and UK, that is €750 at DataRep against €756 for Prighter’s EU and UK pair. The dearest plan in this list, €2,040, is 0.4% of the Dutch fine.
If you run outbound for clients
Agencies do not get out of this by working for someone else. The EDPB says that when a controller’s processing targets people in the Union, any processor instructed to carry it out falls under Article 3(2) for that processing, and Article 27 puts the duty on the controller or the processor. A US client that hires a US agency to email Europe has two companies to check, not one.
How I would set it up
I have delivered 500+ projects, and for a sender outside Europe I would do it in this order:
Count people, not campaigns
Pull the number of EU and UK contacts you hold today. DataRep’s tiers break at 1,000, 50,000 and 100,000 people; Prighter’s and EDPO’s break on your headcount.
Price both units before you sign
Prighter’s EU price under 10 employees stays €420 however big your list grows. DataRep’s stays €150 up to 1,000 people, however many staff you have. Run both numbers.
Name it before the first send
Put the representative’s details in the privacy notice your emails link to. Article 14 wants them with the first message when the data came from a list.
Keep the consent question separate
A representative does not make the email lawful. Whether you may send at all is a separate rule in each country.
The representative is one line of the setup. The rest is the email infrastructure we build: sending domains and mailboxes in accounts you own, kept apart from your main domain, with authentication and warm-up done before the first campaign.
The bottom line
If you cold email people in the EU or the UK from a company with no establishment there, plan on a representative in each. Under 10 employees, Prighter’s pair costs €756 a year, about what DataRep charges for up to 50,000 people, and DataRep’s €150 plan works while your list stays at 1,000 people or fewer. A program that sends every week is not occasional. Name the representative where your first email can point to it, and keep it separate from the consent rules. I am not a lawyer, and this is not legal advice.