Contact us
Contact us

Swiss data protection representative

Engage provides Swiss data protection representative services for controllers based outside Switzerland that have to appoint a representative in Switzerland under Article 14 of the revised FADP. Engage Compliance provides that appointment, priced and buyable online like every other mandate we hold. Your Swiss representative is a partner law firm established in Switzerland, and Engage runs the appointment. Sign-up takes minutes: you pay and complete a short onboarding form.

Get an instant quote See pricing
By Julian Gage Last reviewed: 27 August 2026

Some controllers based outside Switzerland have to appoint a representative in Switzerland under Article 14 of the revised FADP. Engage Compliance provides that appointment, priced and buyable online like every other mandate we hold.

The short answer: if you are a private controller based abroad and your processing of data about people in Switzerland is large scale, regular, high risk to their personality, and tied to offering goods or services or monitoring behavior there, all four at once, you need a representative established in Switzerland under FADP Article 14. Most companies do not clear all four conditions, so the first job is usually to check whether you are caught at all.

Article 14 requires the representative to be in Switzerland, so your Swiss representative is a partner law firm established in Switzerland rather than our Amsterdam entity, and Engage runs the appointment for you. You buy it in the same checkout, alongside any other mandate.

Key takeaways

  • FADP Article 14 has been in force since 1 September 2023 and applies to private controllers based abroad, never to processors or public bodies.
  • The test has four cumulative conditions, so all four have to be met before the duty bites. It is the narrowest of the European representative regimes.
  • The Swiss representative must be established in Switzerland, so it is a partner law firm established in Switzerland rather than the Amsterdam entity that holds the EU mandates.
  • Under Article 15 the representative holds a record of the controller’s own processing activities and tells data subjects how to exercise their rights. That is a document-custody duty, not just a mailbox.
  • There is no specific penalty for failing to appoint. Enforcement is a two-step route through a Commissioner ruling, and only wilful non-compliance with that ruling is criminal.
  • An EU or UK representative does not cover Switzerland, and voluntary appointment is possible for controllers who want to get ahead of the obligation.

Who needs a Swiss representative

Article 14 catches private controllers with a registered office or domicile abroad who process the personal data of people in Switzerland, but only where all four of these conditions are met together:

  1. The processing is connected with offering goods or services to people in Switzerland, or with monitoring their behavior.
  2. It is extensive, meaning large scale.
  3. It is carried out regularly.
  4. It poses a high risk to the personality of the data subjects.

These are cumulative. If your processing fails even one of the four, you have no Article 14 obligation. The tests for large scale, regular, and high risk are qualitative and are not defined by a number in the Act, so this is a judgment about your actual processing rather than a headcount or turnover threshold. A US SaaS product with a modest Swiss user base and no high-risk processing has no Swiss obligation at all, which is why the honest first step is usually to check whether you are caught before talking about the appointment itself.

Who is exempt

Exemption here works by construction, not by a carve-out you have to argue for.

  • Processors are not caught. Article 14 names private controllers only.
  • Federal and public bodies are not caught.
  • Any controller that fails even one of the four cumulative conditions is not caught.

Because the regime is so narrow, a lot of companies that carry an EU or UK representative will not need a Swiss one. The value of a proper scoping exercise is often that it qualifies you out.

When it applies from

The revised Federal Act on Data Protection has been in force since 1 September 2023, and there are no staged dates still to come. The obligation is live now.

Where the representative must be established

The representative has to be established in Switzerland. Article 14 makes the representative the contact point for data subjects and for the Federal Data Protection and Information Commissioner, and the controller has to publish the representative’s name and address.

An Amsterdam entity cannot serve as a Swiss representative, so your Swiss representative is a partner law firm established in Switzerland. Your appointment document states who your Swiss representative is, so you can always see who is doing what.

What the penalty is

There is no specific criminal penalty in the FADP for failing to appoint a representative. The Act’s criminal provisions do not list the Article 14 duty, so this is not a “fail to appoint and you are automatically fined” regime.

Enforcement runs in two steps instead. The Commissioner can issue a ruling ordering a controller to appoint a representative. Only wilful non-compliance with that ruling becomes a criminal matter, under Article 63, and the fine there runs up to CHF 250,000. Swiss data protection fines also default to the responsible individual rather than the company. So the accurate way to describe the risk is that there is no specific penalty for the failure to appoint on its own, with a real criminal exposure sitting behind a Commissioner ruling that is ignored.

What Engage delivers

  • Scoping. We run the four-condition test against your actual processing and tell you plainly whether you are caught. If you are not, we say so and stop there.
  • The Swiss appointment. A partner law firm established in Switzerland is your representative, because Article 14 requires it to sit in the country. Engage runs the appointment, your contact address, and your correspondence.
  • The mandate. We put the appointment in a written contract. The FADP does not require writing, but a contract is how the appointment is evidenced and how the duties and authority are set out.
  • The Article 15 record. This is the heavier duty and it is the reason Swiss is not a trivial add-on to an EU appointment. Article 15 makes the representative responsible for maintaining the record of your processing activities and handing it to the Commissioner on request. We hold that record and keep it current with information from you.
  • Data subject handling. The representative tells people in Switzerland how to exercise their rights and routes their contacts to your named internal owner.
  • A single point of contact. You deal with Engage Compliance throughout, for this and for every other mandate you hold with us.
  • Translation included, both ways, automated, with an independent second check.

Voluntary appointment is also possible. If you are not strictly caught yet but want to get ahead of it, the Commissioner has confirmed a controller can appoint a representative as a precautionary step, and the same appointment covers it.

Where you also need a named DPO, we act as your DPO directly from Amsterdam and coordinate it alongside your Swiss representative.

Swiss companies selling into the EU should see the EU authorized representative page to separate the two roles, and the fractional DPO page if a DPO is the real need.

What it costs

The appointment is €950 a year at the smallest band, for a company with 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold, charged once, up front, with no setup fee. Whichever of headcount, revenue or the number of people whose data you hold puts you highest sets the band.

Company sizeSwiss Representative
1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold€950
11 to 50 people, or €2m to €10m revenue, or 5,000 or more people in the EU and UK whose data you hold€1,190
51 to 250 people, or €10m to €50m revenue€1,830
251 or more people, or over €50m revenueFrom €3,590

The smallest band is for very small organizations only: 1 to 10 people, under €2m in global annual revenue, and under 5,000 people in the EU and UK whose personal data you hold. All three must be true. If any one of them is not, the next band up applies.

If your company grows into a bigger band during the year, nothing changes mid-term: you pay the new band’s price from your next renewal.

Commercial pricing bands based on familiar market-size and market-pricing thresholds. They are not a statutory size test.

Every appointment you hold is a separate mandate, and only the highest-priced one in the basket is charged in full. Every other appointment is charged at a lower price of its own. So adding this to an appointment you already hold costs €813 at band 0, €993 at band 1, €1,373 at band 2, from €2,693 at band 3, when it is not the highest-priced mandate, rather than a second full price.

One extra is optional, and it is charged once per order rather than once per appointment. Higher-risk processing, which covers special category data and criminal offense data, is €250 at band 0, €500 at band 1, €750 at band 2, from €1,000 at band 3.

Every band is published and buyable, so you can see your price and appoint online without talking to anyone first. The full table for every mandate is on representative services.

The appointment issues in seconds. After payment you answer a short form about your company and who we should send correspondence to, about three minutes of typing, and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment. Nobody at Engage has to approve anything, unless our sanctions screen flags a possible match.

Sources and references

Representative mandates

These mandates stack rather than replace each other. One company selling into Europe can be caught by several at once, each is a separate appointment with its own published contact point, and an EU representative does not cover the UK. Engage Compliance holds them together so you have one point of contact across the set.

  • Professional indemnity and cyber insurance
  • Named DPO notified to the supervisory authority
  • Trust Center
Book a free intro call Start representative sign-up Representative services

FAQ

Frequently asked questions

What is a Swiss FADP representative?

It is a person or entity established in Switzerland, appointed by a controller based abroad, who acts as the contact point for people in Switzerland and for the Federal Data Protection and Information Commissioner. The role comes from Article 14 of the revised Federal Act on Data Protection, in force since 1 September 2023. Under Article 15 the representative also holds a record of the controller's processing activities and tells data subjects how to exercise their rights.

Who needs a Swiss representative under Article 14?

Only private controllers with a registered office or domicile abroad who process the data of people in Switzerland where all four of these conditions are met at once: the processing is connected with offering goods or services to, or monitoring the behavior of, people in Switzerland; it is large scale; it is carried out regularly; and it poses a high risk to the personality of the data subjects. Miss any one of the four and there is no obligation. It is the narrowest of the European representative regimes.

Do processors or public bodies need a Swiss representative?

No. Article 14 catches private controllers only, so processors are not caught. Federal and public bodies are not caught either. The duty is defined by who you are and what you do, not by a carve-out you claim.

Does an EU or UK representative cover Switzerland?

No. Switzerland is outside the EU and the UK, and the FADP is its own law with its own test. An EU GDPR or UK GDPR representative does nothing for the Swiss obligation, and the Swiss representative has to be established in Switzerland.

What is the penalty for not appointing a Swiss representative?

The FADP provides no specific criminal penalty for failing to appoint. Enforcement runs in two steps. The Commissioner can issue a ruling ordering a controller to appoint a representative, and only wilful non-compliance with that ruling becomes a criminal matter under Article 63, with a fine of up to CHF 250,000. Swiss fines default to the responsible individual, not the company.

Does the appointment have to be in writing?

The FADP text does not require it to be in writing, which is a real difference from GDPR Article 27. In practice a contract is still how the appointment is evidenced and how the representative's duties and authority are set out, so we always document it properly.

Does a US company need a Swiss representative under FADP Article 14?

Only if all four conditions are met at once: the processing is tied to offering goods or services to, or monitoring, people in Switzerland, and it is large scale, regular, and high risk to their personality. A US SaaS product with a modest Swiss user base and no high-risk processing has no Swiss obligation at all, so the first step is usually checking whether you are caught.

How do we get a Swiss representative without an office in Switzerland?

You appoint one through us. The appointment is priced and buyable online like every other mandate we hold, in the same checkout. Article 14 requires the representative to be established in Switzerland, so your Swiss representative is a partner law firm established there, and Engage runs the appointment, your contact address and your correspondence.

What duties come with a Swiss FADP representative?

Two main ones. The representative is the contact point for people in Switzerland and for the Federal Data Protection and Information Commissioner, and under Article 15 it maintains the record of your processing activities and hands it to the Commissioner on request. We hold that record and keep it current with information from you.

Can we appoint a Swiss representative voluntarily?

Yes. If you are not strictly caught yet but want to get ahead of it, the Commissioner has confirmed a controller can appoint a representative as a precautionary step, and the same appointment covers it.

Do we have to publish our Swiss representative's details?

Yes. The controller has to publish the representative's name and address. Your appointment document also states who your Swiss representative is, so you can always see who is doing what.

Is the Swiss threshold based on headcount or turnover?

No. The tests for large scale, regular and high risk are qualitative and are not defined by a number in the Act, so the question is a judgment about your actual processing rather than a headcount or turnover threshold.

Can Engage be our DPO as well as arranging the Swiss representative?

Yes. Where you also need a named DPO, we act as your DPO directly from Amsterdam and coordinate it alongside your Swiss representative. See fractional DPO if a DPO is the real need.

Related

Service EU Representative Service Service UK Representative Service Service Global representative services Comparison EU representative providers compared Guide Do I need an EU Representative? Service Contact us Pricing DPO plans and pricing