The rule
Article 14(1) of the revised Swiss Federal Act on Data Protection (FADP) says private controllers with a registered office or domicile abroad "shall appoint a representative in Switzerland" if they process the personal data of people in Switzerland and the processing meets four requirements:
- It is connected with offering goods or services to people in Switzerland, or with monitoring their behavior.
- It is on a large scale.
- It is carried out regularly.
- It poses a high risk to the personality of the people whose data it is.
The representative is the contact point for those people and for the Federal Data Protection and Information Commissioner (FDPIC), and you have to publish its name and address (Article 14(2) and (3)). Under Article 15 the representative also keeps a record of your processing activities, gives it to the FDPIC on request, and tells people how to exercise their rights.
The revised FADP has been in force since 1 September 2023, so the duty is live now.
Who needs one
A private controller based outside Switzerland whose processing of data about people in Switzerland meets all four requirements at once. If it fails even one, there is no duty.
"Large scale", "regular" and "high risk" are not defined by a number in the Act. So the answer is a judgment about your actual processing, never a headcount or turnover figure.
Who does not need one
- Processors, because Article 14 names private controllers only.
- Federal and public bodies, which Article 14 does not reach either.
- Any controller that fails one of the four requirements. A US software product with a modest Swiss user base and no high-risk processing has no Swiss duty at all.
An EU or UK representative does not cover Switzerland. The FADP is its own law, and its representative has to be in Switzerland. Because the Swiss test is so narrow, many companies that need an EU or UK representative will not need a Swiss one.
You can still appoint one as a precaution if you are not caught.
What happens if you do not appoint one
The FADP has no specific penalty for failing to appoint. Enforcement runs in two steps: the FDPIC can issue a ruling ordering you to appoint one, and only wilful failure to follow that ruling becomes a criminal matter under Article 63. Swiss data protection fines fall on the responsible individual by default, not on the company.
What it costs
The Swiss representative appointment is €950 a year at the smallest band, for a company with 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold. At the three larger bands it is €1,190, €1,830 and €3,590 a year. That is the price when paid yearly, with no setup fee, and quarterly and monthly payment cost about 5% and 15% more. Whichever of headcount, revenue or the number of people whose data you hold puts you highest sets the band.
How the Swiss appointment works, and every band, is on our Swiss representative service page, where you can appoint online alongside any other mandate.
Check what you need
Our free representative checker asks a few short questions, and the Swiss ones only appear if you sell to or track people in Switzerland. It tells you whether you need a Swiss representative, an EU or UK one, or none, and what the appointment would cost.