Data protection law reaches across borders. A company without a Swiss establishment can be subject to the Swiss FADP, and a Swiss company without an EU establishment to the GDPR. So that data subjects and authorities still have a local contact, both regimes require a representative under certain conditions.
Representative in Switzerland under Art. 14 FADP
Private controllers with their seat or residence abroad must appoint a representative in Switzerland if they process personal data of people in Switzerland and the processing meets four cumulative conditions: it is connected with offering goods or services in Switzerland or monitoring the behaviour of these people, it is extensive, it is regular, and it involves a high risk to the personality of the data subjects. Because all conditions must be met together, the duty is narrower than in the EU.
The representative’s tasks
The representative is the contact point for data subjects and the Federal Data Protection and Information Commissioner (FDPIC). Under Art. 15 FADP it keeps a record of the controller’s processing activities and provides information to the FDPIC on request. The representative’s name and address must be published, typically in the privacy notice.
EU representative for Swiss companies
For Swiss companies the reverse question is usually more relevant. A company without an EU establishment that targets people in the EU with goods or services, or monitors their behaviour, falls under the GDPR via Art. 3(2) and as a rule must appoint a representative in a member state where data subjects are located under Art. 27 GDPR. Exceptions apply to occasional processing without large-scale processing of special categories and with low risk. A Swiss SaaS provider with customers in Germany should clarify this early.
Distinction
The representative is not the data protection officer: the officer advises and monitors internally, the representative is an external contact point. It also does not replace a legal basis for data transfers. Many companies engage specialised providers; the appointment belongs in the documentation together with the record of processing.