Swiss FADP Article 14: Representative

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

If you are a private controller with your registered office or domicile abroad and you process the personal data of people in Switzerland, Article 14 makes you appoint a representative in Switzerland, but only where all four of its tests are met at once. That cumulative structure is what most readers get wrong: it is a narrower trigger than the GDPR's, not a wider one.

Who it binds

• Private controllers with a registered office or domicile abroad that process the personal data of people in Switzerland (Article 14(1)). Private is doing work here: the article does not reach Swiss federal bodies.
• Only where ALL FOUR conditions in Article 14(1) hold together: the processing is connected with offering goods or services or monitoring behavior in Switzerland, it is on a large scale, it is carried out regularly, and it poses a high risk to the personality of the data subjects.
• It does not bind processors. The duty in Article 14(1) is written for controllers.
• Because the four tests are cumulative, a company caught by GDPR Article 27 for its EU processing is not automatically caught here for its Swiss processing.

What it makes somebody do

• You, the controller. Appoint a representative in Switzerland where all four Article 14(1) conditions are met.
• You, the controller. Publish the name and address of the representative (Article 14(3)). Publication is the notice mechanism; there is no register to file with.
• The representative. Serve as the contact point for data subjects and for the FDPIC, the Federal Data Protection and Information Commissioner (Article 14(2)).
• The representative. Maintain a record of the controller's processing activities containing the information set out in Article 12(2) (Article 15(1)). This is the representative's own record, not a copy of yours.
• The representative. Provide the FDPIC with the information in that record on request (Article 15(2)).
• The representative. Tell data subjects, on request, how they can exercise their rights (Article 15(3)).

What it does not say

• It is not the Swiss version of GDPR Article 27, whatever the shape suggests. Article 27 has a two-limb trigger and an exemption; Article 14 has four cumulative conditions, and high risk to the personality of the data subjects is a test the GDPR does not have at all.
• It does not put your record of processing in your own hands. Article 15(1) makes the record the representative's obligation, which is the reverse of the GDPR position and the single largest practical difference between the two appointments.
• It does not require you to notify an authority. Article 14(3) requires publication, and nothing in Article 14 or Article 15 requires filing the appointment with the FDPIC.
• Large scale and regularly are not defined in Article 14, and the Act sets no numbers. That makes the assessment yours to make and to be able to defend, not a threshold to look up.
• The English text of this Act has no legal force. Switzerland enacts in German, French and Italian, and where a word matters those texts govern and this page does not.

How it sits beside the other mandates

• Article 12 is what Article 15(1) points at. The representative's record has to contain what Article 12(2) lists, so the scope of the appointment is set by an article the appointment provision never names in full.
• A company serving the EU, the UK and Switzerland from outside all three can need three separate representatives, and in the Swiss one the record sits on the representative's side.
• Article 61 carries the criminal penalties. The Act provides no specific penalty for failing to appoint a representative, so exposure here runs through the general enforcement route rather than through Article 14 itself.