Swiss Data Protection Representative (Article 14 FADP)
A company based abroad may have to appoint a representative in Switzerland so it can be reached by Swiss authorities and by individuals. Araucaria acts as your Swiss data protection representative and point of contact for the Federal Data Protection and Information Commissioner (FDPIC).
Do You Need a Swiss Representative?
You must appoint a Swiss representative when all of the following apply:
- you are a private controller with your registered office or domicile abroad.
- the processing is connected with offering goods or services to, or monitoring the behavior of, individuals in Switzerland.
- the processing is on a large scale.
- the processing takes place on a regular basis.
- the processing poses a high risk to the personality rights of the individuals concerned.
What Does the Representative Do?
The Swiss data protection representative:
- serves as the Swiss point of contact for the FDPIC and individuals.
- maintains your record of processing activities and provides the FDPIC with the information it contains on request.
- acts as your published contact in Switzerland; the representative’s name and address must be published.
- provides individuals, on request, with information on how to exercise their rights against you.
Why Appoint a Law Firm?
A Swiss law firm does more than provide a local contact point. We advise on the FADP requirements, handle correspondence with the FDPIC, and help align the Swiss representative role with your wider privacy program.
How It Works
- We assess whether the four Article 14 conditions are met.
- If representation is required, Araucaria is appointed as your Swiss representative.
- We maintain the relevant record of processing activities and act as the contact point for the FDPIC and individuals.
- We support you on related Swiss data protection questions where needed.
How Is the FADP Different from the GDPR?
The FADP is a separate Swiss law, distinct from the GDPR, and its territorial scope is different. The FADP applies to matters that have an effect in Switzerland, even when the relevant conduct takes place abroad. The GDPR uses different territorial criteria, including establishment in the EU and, in certain cases, offering goods or services to or monitoring individuals in the EU. Under the FADP, the representative requirement applies to private controllers with their registered office or domicile abroad when the four conditions under Article 14 are met. If you fall under both regimes, you may need a Swiss representative and, separately, an EU representative under Article 27 GDPR.
What Are the Risks of Getting It Wrong?
Violating the FADP can lead to criminal fines of up to CHF 250,000, imposed primarily on the natural person responsible for the offense rather than on the company. The FDPIC can also order a controller to appoint a representative and publish the representative’s contact details. Non-compliance can therefore create personal criminal exposure for responsible individuals, making it important to clarify your position early.
Key Facts
Frequently Asked Questions
Where must the representative be published?
You must publish the representative’s name and address so they are readily accessible, typically in your privacy notice.
What is the record of processing activities?
It is a record of your personal data processing activities containing the information required by Article 12 FADP. Your representative maintains it and provides the FDPIC with the information it contains on request.
Is this the same as an EU GDPR representative?
No. The Swiss representative under Article 14 FADP and the EU representative under Article 27 GDPR are separate requirements. A company may need both.
Does having a branch in Switzerland exempt us?
Not necessarily. Article 14 FADP applies to private controllers with their registered office or domicile abroad. The effect of a Swiss branch depends on the controller’s legal structure.
Does the obligation apply to processors as well?
No. Article 14 FADP applies to private controllers, not processors acting solely in that capacity.
What does large-scale processing mean?
The FDPIC considers processing large-scale when personal data are not processed merely in isolated instances. The assessment depends on the nature and extent of the processing.
What counts as high-risk processing?
For Article 14 FADP, this means a high risk to the personality rights of individuals in Switzerland. The FDPIC assesses the risk without taking mitigating measures into account.
Appoint Araucaria as your Swiss data protection representative.