Data protection for companies working with Europe

Updated 24 October 2026 · by Dr Pietro Cravero, certified DPO

In short: I am a certified Data Protection Officer based in Italy, inside the European Union. I help companies outside Italy with three things: acting as their EU representative under Art. 27 GDPR, bringing their documentation in line with the GDPR and, for Swiss companies, the nFADP, and assessing what the AI Act means for products sold in Europe.

What I can do for you

Outside the EU

EU Representative (Art. 27 GDPR)

For companies without an establishment in the EU that offer goods or services to people in the Union or monitor their behaviour.

Learn more → EEA

GDPR in Norway

Norway applies the GDPR through the EEA Agreement, with national rules on employees, cameras and identity numbers.

Learn more → Switzerland

nFADP and GDPR for Swiss companies

When the Swiss Federal Act applies, when the GDPR applies too, and how to keep one set of documents for both.

Learn more →

How I work

One responsible professional. Documents, opinions and the representative mandate are drafted and signed by me.
English and Italian. Meetings and day-to-day contact can be held in English, together with a collaborating consultant who handles client relations.
Remote first. Video calls and shared documents; on-site visits when they are really needed.
Clear scope. For questions of purely national law outside the EU, such as Swiss or Norwegian litigation, I work alongside local lawyers.

Why an EU-based DPO

A company outside the Union that falls under the GDPR needs a point of contact established in a Member State. Working with a professional who already lives inside the European framework, knows the supervisory authorities and the guidance of the European Data Protection Board, and also follows the AI Act, saves you from coordinating several advisers.

Frequently asked questions

Does the GDPR apply to a company outside the EU?

It can. Under Art. 3(2) GDPR it applies when a company targets its offer of goods or services at people in the European Union, or monitors their behaviour there, even without any establishment in the EU.

Can you be our EU representative?

Yes. I am established in Italy, an EU Member State, and can be designated in writing as your representative under Art. 27 GDPR, after an initial assessment of your processing.

Do you work in English?

Yes. Meetings and correspondence can be in English; documents can be drafted in English or Italian.

Dr Pietro Cravero, certified Data Protection Officer (IDcert; Second-level Master in Personal Data Processing, Roma Tre University). Studio Cravero Consulting, Sassari, Italy.

Not sure the GDPR applies to you?

The first assessment is free: we look at your markets, your website and your processing, and you get a written answer.

Request a free assessment