Some controllers based outside Switzerland have to appoint a representative in Switzerland under Article 14 of the revised FADP. Engage Compliance provides that appointment, priced and buyable online like every other mandate we hold.
The short answer: if you are a private controller based abroad and your processing of data about people in Switzerland is large scale, regular, high risk to their personality, and tied to offering goods or services or monitoring behavior there, all four at once, you need a representative established in Switzerland under FADP Article 14. Most companies do not clear all four conditions, so the first job is usually to check whether you are caught at all.
Article 14 requires the representative to be in Switzerland, so this appointment is held from a Swiss establishment rather than from Amsterdam. What that changes for you is nothing: you buy it in the same checkout, alongside any other mandate, and the appointment issues automatically the moment the short form after payment is done.
Key takeaways
- FADP Article 14 has been in force since 1 September 2023 and applies to private controllers based abroad, never to processors or public bodies.
- The test has four cumulative conditions, so all four have to be met before the duty bites. It is the narrowest of the European representative regimes.
- The Swiss representative must be established in Switzerland, so this appointment is held from a Swiss establishment rather than from the Amsterdam entity that holds the EU mandates.
- Under Article 15 the representative holds a record of the controller’s own processing activities and tells data subjects how to exercise their rights. That is a document-custody duty, not just a mailbox.
- There is no specific penalty for failing to appoint. Enforcement is a two-step route through a Commissioner ruling, and only wilful non-compliance with that ruling is criminal.
- An EU or UK representative does not cover Switzerland, and voluntary appointment is possible for controllers who want to get ahead of the obligation.
Who needs a Swiss representative
Article 14 catches private controllers with a registered office or domicile abroad who process the personal data of people in Switzerland, but only where all four of these conditions are met together:
- The processing is connected with offering goods or services to people in Switzerland, or with monitoring their behavior.
- It is extensive, meaning large scale.
- It is carried out regularly.
- It poses a high risk to the personality of the data subjects.
These are cumulative. If your processing fails even one of the four, you have no Article 14 obligation. The tests for large scale, regular and high risk are qualitative and are not defined by a number in the Act, so this is a judgment about your actual processing rather than a headcount or turnover threshold. A US SaaS product with a modest Swiss user base and no high-risk processing has no Swiss obligation at all, which is why the honest first step is usually to check whether you are caught before talking about the appointment itself.
Who is exempt
Exemption here works by construction, not by a carve-out you have to argue for.
- Processors are not caught. Article 14 names private controllers only.
- Federal and public bodies are not caught.
- Any controller that fails even one of the four cumulative conditions is not caught.
Because the regime is so narrow, a lot of companies that carry an EU or UK representative will not need a Swiss one. The value of a proper scoping exercise is often that it qualifies you out.
When it applies from
The revised Federal Act on Data Protection has been in force since 1 September 2023, and there are no staged dates still to come. The obligation is live now.
Where the representative must be established
The representative has to be established in Switzerland. Article 14 makes the representative the contact point for data subjects and for the Federal Data Protection and Information Commissioner, and the controller has to publish the representative’s name and address.
An Amsterdam entity cannot serve as a Swiss representative, so the Swiss appointment is held from a Swiss establishment. The appointment document names the establishment that holds it, so you can always see which entity is doing what.
What the penalty is
There is no specific criminal penalty in the FADP for failing to appoint a representative. The Act’s criminal provisions do not list the Article 14 duty, so this is not a “fail to appoint and you are automatically fined” regime.
Enforcement runs in two steps instead. The Commissioner can issue a ruling ordering a controller to appoint a representative. Only wilful non-compliance with that ruling becomes a criminal matter, under Article 63, and the fine there runs up to CHF 250,000. Swiss data protection fines also default to the responsible individual rather than the company. So the accurate way to describe the risk is that there is no specific penalty for the failure to appoint on its own, with a real criminal exposure sitting behind a Commissioner ruling that is ignored.
What Engage delivers
- Scoping. We run the four-condition test against your actual processing and tell you plainly whether you are caught. If you are not, we say so and stop there.
- The Swiss appointment. The representative established in Switzerland, held from a Swiss establishment, because Article 14 requires it to sit in the country.
- The mandate. We put the appointment in a written contract. The FADP does not require writing, but a contract is how the appointment is evidenced and how the duties and authority are set out.
- The Article 15 record. This is the heavier duty and it is the reason Swiss is not a trivial add-on to an EU appointment. Article 15 puts the record of your processing activities in the representative’s own hands, not yours, and requires it to be handed to the Commissioner on request. We hold that record and keep it fed with current information from you.
- Data subject handling. The representative tells people in Switzerland how to exercise their rights and routes their contacts to your named internal owner.
- A single point of contact. You deal with Engage Compliance throughout, for this and for every other mandate you hold with us.
Voluntary appointment is also possible. If you are not strictly caught yet but want to get ahead of it, the Commissioner has confirmed a controller can appoint a representative as a precautionary step, and the same appointment covers it.
Where you also need a named DPO, we act as your DPO directly from Amsterdam and coordinate it alongside your Swiss representative.
What it costs
The appointment is €550 a year at the smallest band, for a company with 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold, charged once, up front, with no setup fee. Whichever of headcount, revenue or the number of people whose data you hold puts you highest sets the band.
| Company size | Swiss Representative |
|---|---|
| 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold | €550 |
| 11 to 50 people, or €2m to €10m revenue, or 5,000 or more people in the EU and UK whose data you hold | €790 |
| 51 to 250 people, or €10m to €50m revenue | €1,830 |
| 251 or more people, or over €50m revenue | From €3,590 |
The smallest band is for very small organizations only: 1 to 10 people, under €2m in global annual revenue, and under 5,000 people in the EU and UK whose personal data you hold. All three must be true. If any one of them is not, the next band up applies.
Commercial pricing bands based on familiar market-size and market-pricing thresholds. They are not a statutory size test.
Every appointment you hold is a separate mandate, and only the highest-priced one in the basket is charged in full. Every other appointment is charged at a share of its own price, and for this one that share is half its own price. So adding this to an appointment you already hold costs €275 at band 0, €395 at band 1, €915 at band 2, €1,795 at band 3, rather than a second full price.
Two extras are optional, and each is charged once per order rather than once per appointment. Higher-risk processing, which covers special category data and criminal offense data, is €250 at band 0, €500 at band 1, €750 at band 2, €1,000 at band 3. Same-business-day response is a service level on authority and data subject correspondence rather than substantive advice, and is €1,200 a year.
Every band is published and buyable, so you can see your price and appoint online without talking to anyone first. The full table for every mandate is on representative services.
The appointment issues in seconds. After payment you answer a short form about your company and who we should send correspondence to, about three minutes of typing, and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment. Nobody at Engage has to approve anything.
Sources and references
- Federal Act on Data Protection (SR 235.1), Articles 14 and 15, fedlex.admin.ch
- Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch
Representative verification register
Representative mandates
These mandates stack rather than replace each other. One company selling into Europe can be caught by several at once, each is a separate appointment with its own published contact point, and an EU representative does not cover the UK. Engage Compliance holds them together so you have one point of contact across the set.
- EU GDPR Article 27 representative
- UK GDPR Article 27 representative
- Swiss FADP Article 14 representative
- DSA Article 13 legal representative
- EU AI Act GPAI authorised representative
- EU AI Act high-risk authorised representative
- NIS2 representative
- Data Act legal representative
- Data Governance Act representative
- e-Evidence legal representative
- Terrorist Content Online representative
- GPSR responsible person
- CE-marking authorised representative
- Non-EU regimes (Swiss, China, Korea, Turkey)