The Swiss Data-Protection Representative Under Art. 14 DSG: Which US Companies Must Appoint One

A US health-app company may appoint a representative in Ireland under the GDPR while serving Swiss users through the same product. That appointment does not settle the Swiss position. Art. 27 GDPR requires a representative in the Union where Art. 3(2) GDPR applies, subject to its exceptions.1Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1 (GDPR), Art. 3(2), Art. 13(1)(a), Art. 14(1)(a), Art. 27, Art. 30, Art. 58(1)(a), Art. 83(4)(a) and recitals 23, 24 and 80. Switzerland is neither an EU Member State nor a party to the EEA Agreement. Art. 14 DSG, part of its federal data-protection statute, imposes a separate duty on certain foreign controllers. It has applied since 1 September 2023 and requires a representative in Switzerland.2Bundesgesetz über den Datenschutz (Datenschutzgesetz, DSG) vom 25. September 2020 (SR 235.1), version of 7 July 2025, Art. 3(1), Art. 5, Art. 10, Art. 12, Art. 14 to 16, Art. 19, Art. 22, Art. 23, Art. 25, Art. 49 to 52, Art. 57, Art. 60 to 66 and Art. 69.

The US agent designated by a foreign drug or device establishment registering with the FDA offers a familiar comparison. That agent facilitates communications between the agency and the foreign establishment.321 C.F.R. § 807.40(b)(1) and (2) (foreign device establishments); 21 C.F.R. § 207.69(b) (foreign drug establishments). But the Swiss data-protection representative is neither a product regulator's agent nor an extension of the EU appointment. The questions are which processing triggers the Swiss duty and what the resulting mandate actually covers.

1. Which Foreign Controllers Must Appoint a Swiss Representative: Four Conditions

Art. 14(1) DSG addresses private controllers with their seat or domicile abroad that process personal data of persons in Switzerland. Under Art. 5(j) DSG, the controller decides, alone or jointly, the purpose and means of processing. A processor acts on the controller's behalf under Art. 5(k) DSG and is not an addressee of Art. 14 DSG for that activity. The statute does not distinguish a seat in Delaware from one in Dublin. Nor does a Swiss subsidiary or branch by itself relocate the foreign company's seat. A subsidiary may be a separate controller, but that depends on its role in the processing, not simply its presence in Switzerland.2

The representative duty is narrower than the DSG's territorial reach. Art. 3(1) DSG applies to matters that have an effect in Switzerland even if initiated abroad. Being subject to the DSG therefore does not by itself require a representative. Art. 14(1) DSG requires processing connected with offering goods or services to, or observing the behavior of, persons in Switzerland; that processing must also be large-scale, regular and carry a high risk for their personality. The EDÖB, the federal data-protection authority, confirms that these conditions are cumulative.4Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB), Pflicht zur Benennung einer Vertretung nach Artikel 14 DSG (guidance), sections on statutory conditions, high risk, designation and enforcement.

The offering-and-monitoring language resembles Art. 3(2) GDPR, but the EU materials do not settle its Swiss application. Recital 23 GDPR identifies language, currency and references to customers as possible targeting indicators; mere website accessibility is insufficient. Recital 24 GDPR addresses online tracking and subsequent profiling. The EDPB includes wearables and regular reporting on an individual's health among the monitoring activities it discusses.5European Data Protection Board (EDPB), Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.1, adopted 12 November 2019, pp. 19 to 20 and 23 to 28. The EDÖB's representative guidance restates the Swiss condition without adopting those examples. A German-language interface, for instance, does not distinguish a Swiss market from neighboring Germany. The intended audience and the actual activity matter more than the existence of a European privacy notice.

The official English text describes the scale condition as processing "on a large scale". The EDÖB reads the German umfangreich as more than isolated processing, and regular, regelmässig, as processing that is not merely occasional or confined to a limited period.4 Its guidance gives no numerical threshold. Those explanations differ from a simple count of users and do not justify importing the GDPR's scale assessment unchanged. A recurring Swiss subscription and a single isolated interaction present different facts, but neither the subscription label nor its duration resolves all the conditions.

The High-Risk Condition: Assessment Before Mitigation Measures

The EDÖB identifies the quantity and type of data, especially sensitive data, the purpose and manner of processing, new technologies, disclosure abroad and broad access rights as possible sources of high risk. It assesses the totality of existing and planned processing through which the company affects people resident in Switzerland. This differs from the assessment under Art. 22 DSG of a particular planned processing operation. For appointment purposes, the authority assesses the potential Brutto-Risiko: the risk before measures taken or planned to reduce it are counted.4

Encryption, restricted access and a HIPAA security program therefore do not reduce the risk for that particular assessment. They may remain relevant to other duties, including data security; the point is the EDÖB's choice of a gross assessment for Art. 14 DSG. Its reference to disclosure abroad also requires attention to the actual data flows. It does not explain how that factor applies where the foreign controller collects data directly and keeps all processing abroad.

An EU appointment does not satisfy the Swiss location requirement. For health-data businesses, the separate Swiss question includes the EDÖB's assessment of high risk before mitigation measures are counted.

Health data are sensitive personal data under Art. 5(c) DSG and a named factor in the EDÖB's risk analysis. Art. 22(2)(a) DSG also identifies large-scale processing of sensitive data as a high-risk case for a data-protection impact assessment, but the EDÖB expressly distinguishes that test from the appointment test.2 Sensitivity therefore matters without making every health-data activity an automatic Art. 14 DSG case. The other conditions still have to be met. There is no representative-specific grandfathering for older processing: Art. 69 DSG concerns Art. 7, Art. 22 and Art. 23 DSG, not Art. 14 DSG. Its separate relief requires both an unchanged purpose and no new data. The EDÖB also permits voluntary or precautionary appointments where the mandatory conditions are not met.

2. Why an EU Representative Does Not Cover Switzerland: Where the Swiss and EU Duties Part Ways

Art. 27(3) GDPR locates the representative in a Member State where the relevant data subjects are. Art. 14(1) DSG requires a representative in Switzerland. A provider with an appropriate presence in both territories can hold both mandates, but an EU-only designation does not designate a Swiss representative.1 The practical possibility of using one provider does not merge the legal tests or the functions.

For a private company within Art. 3(2) GDPR, Art. 27(2)(a) GDPR removes the duty only where processing is occasional, does not include large-scale processing of special categories or criminal-conviction and offense data, and is unlikely to result in a risk to individuals' rights and freedoms. The EDPB reads occasional processing as outside the regular course of business and not carried out regularly. The exemption requires the absence of a likely risk, not merely the absence of a likely high risk.5 A US platform's regular EU-facing activity may therefore require an EU representative even where its Swiss-facing activity falls below the Swiss high-risk threshold. Both appointments are required only when the territorial and substantive conditions of each regime are independently met.

The EU duty can reach processors as well as controllers; the Swiss duty addresses private controllers. The form also differs. Art. 27(1) GDPR requires a written designation, reinforced by recital 80 GDPR, whereas Art. 14 DSG prescribes no particular form. A US vendor may thus face different appointment obligations for its own consumer service and the hosting it performs for a business customer. The legal role follows who determines the purposes and means, not the vendor's preferred description in the contract.

The publication duty has its own Swiss source. Art. 13(1)(a) and Art. 14(1)(a) GDPR require representative details in the information given to data subjects. Art. 19(2)(a) DSG instead identifies the controller; the Swiss representative's name and address must be published under Art. 14(3) DSG. The EDÖB gives the privacy notice as one possible location.4 A notice naming only an EU representative does not meet that Swiss requirement. Art. 60(1)(b) DSG, which penalizes intentional failures to provide specified information under Art. 19 DSG, does not turn the separate Art. 14(3) DSG publication omission into that offense.

Enforcement: An Infringement in the Union, an Order in Switzerland

Under the GDPR, the representative facilitates enforcement against the foreign controller or processor. The EDPB considers that corrective measures and fines imposed on that foreign party may be addressed through its representative, but rejects substitutive liability. It limits the representative's direct liability to its own obligations under Art. 30 and Art. 58(1)(a) GDPR.5 A failure to designate is itself an infringement. Art. 83(4)(a) GDPR provides for a fine up to EUR 10 million or, for an undertaking, 2 percent of total worldwide annual turnover in the preceding financial year, whichever is higher.

Cross-border collection is a different question from the existence of that infringement. A report commissioned through the EDPB's support pool of experts examines a Dutch fine against a US company for failing to appoint a representative. Its author, Helena Kastlová, considers that the fine would be treated as penal in character when recognition is sought in the United States.6Helena Kastlová, Report on extraterritorial enforcement of GDPR (EDPB Support Pool of Experts, 17 April 2024), pp. 2, 4 and 42. That is the author's assessment of enforcement, not a Board ruling or permission to disregard the appointment duty.

The Swiss provisions distinguish failure to appoint from intentional disobedience of a warned order. Art. 60 to Art. 66 DSG do not make failure to appoint under Art. 14 DSG a separate offense. That does not exempt a representative from other provisions governing its own conduct, including applicable duties to cooperate with an investigation. Art. 51(4) DSG nevertheless empowers the EDÖB to order a foreign private controller to designate a representative. The authority states that its order can also require written communication of the name and address and their publication in an easily found, permanently accessible form.4

Under Art. 63 DSG, intentionally disobeying an order issued with an express warning of that provision's penalty can attract a fine up to CHF 250,000. Criminal responsibility concerns natural persons, with prosecution and adjudication by the cantons under Art. 65 DSG. Art. 64 DSG permits the business to be fined instead only where a fine no higher than CHF 50,000 is in prospect and identifying the responsible people would require disproportionate investigative measures. In cases of general interest, Art. 57(2) DSG also requires the EDÖB to inform the public of its findings and orders.2 The absence of a direct appointment offense therefore leaves both an enforceable duty and consequences for deliberately ignoring a warned order.

3. The Swiss Representative’s Duties: Contact Point, Register and Address for Service

Art. 14(2) DSG makes the representative a contact point for data subjects and the EDÖB. Art. 15 DSG requires it to keep a register containing the particulars in Art. 12(2) DSG, provide the EDÖB with that information on request, and tell individuals how to exercise their rights. This does not transfer the controller's Art. 25 DSG access duty to the representative. The controller remains responsible for providing the information about its processing, as a rule within 30 days.2

Keeping the register requires information the representative may not generate or hold. The EDPB expressly assigns the primary content and updating of the EU record to the foreign controller or processor, while preserving the representative's own obligation to maintain and supply it.5 Art. 15 DSG assigns the Swiss register duty to the representative but does not specify an equivalent process for the controller to supply and update its contents. A mandate may allocate that work, yet the representative's statutory duty persists if the company's product team fails to report a changed data flow.

The register also raises a distinct small-company question. Art. 12(5) DSG authorizes exceptions for companies with fewer than 250 employees and low-risk processing. Art. 24 DSV exempts companies and other private-law organizations with fewer than 250 employees on 1 January, as well as natural persons, unless they process sensitive data on a large scale or conduct high-risk profiling.7Verordnung über den Datenschutz (Datenschutzverordnung, DSV) vom 31. August 2022 (SR 235.11), version of 1 December 2025, Art. 24. Those exceptions do not track every possible source of high risk under Art. 14 DSG. A small controller's argument for exemption from its own register duty would not by itself resolve its representative's separately stated Art. 15 DSG duty. The interaction requires more than applying the employee threshold.

The Representative as an Address for Service

The EDÖB treats the representative as the controller's address for service, or Zustellungsdomizil, in its own proceedings, unless the controller is represented by a Swiss lawyer whose business address serves that purpose.4 The FDA-agent analogy is useful but limited. Under 21 C.F.R. § 807.40(b)(2) and 21 C.F.R. § 207.69(b)(4), providing documents to the US agent is expressly equivalent to providing them to the foreign establishment when the FDA cannot reach it directly or expeditiously.3 Art. 14 DSG contains no comparable service rule.

Art. 52(1) DSG subjects the EDÖB's investigations and relevant orders to federal administrative procedure. Art. 11b(1) VwVG requires a party abroad that makes requests in proceedings to designate a Swiss address for service, unless international law or the competent foreign authority permits direct service in that state.8Bundesgesetz über das Verwaltungsverfahren (Verwaltungsverfahrensgesetz, VwVG) vom 20. Dezember 1968 (SR 172.021), version of 1 July 2022, Art. 11b(1). That rule depends on the party's procedural position. The EDÖB's guidance goes beyond simply restating it when it assigns the representative the service-address function.

The judgment cited in that guidance also illustrates why the type of proceeding matters. In BGE 143 III 28, the Federal Supreme Court distinguished a patent representative's administrative role from representation and service in civil proceedings. Entry in the patent register did not itself make that representative the foreign owner's civil-procedure representative or service address.9BGE 143 III 28 (Urteil BGer 4A_222/2016 vom 15. Dezember 2016), E. 2.2.1 to 2.2.5. The judgment does not decide whether a data-protection representative can receive service in civil or cantonal criminal proceedings. Nor does the EDÖB's statement about its own proceedings establish that broader function. A mandate accepting communications from the authority and a mandate authorizing receipt of court process are not interchangeable merely because the address is the same.

The Swiss data protection advisor is a separate role. Art. 10 DSG allows private controllers to appoint an advisor as a contact for individuals and authorities, with training, advisory and implementation functions. To use the Art. 23(4) DSG alternative to consulting the EDÖB, the controller must satisfy Art. 10(3) DSG, including the advisor's professional independence, freedom from instructions and absence of incompatible activities. The EDPB considers an EU representative incompatible with an external data protection officer because the former acts on instructions.5 Swiss law already contains its own incompatibility condition; combining the representative and advisor roles is therefore a question about the actual duties and independence, not a gap that follows from the absence of an identical Swiss statement.

The appointment contract adds a continuity issue. Where Swiss law governs and the arrangement qualifies as a mandate under Art. 394 OR, Art. 404(1) OR permits either party to revoke or terminate at any time. Art. 404(2) OR provides compensation for resulting damage if that happens at an inopportune time. BGE 115 II 464 confirms that the termination right is mandatory where mandate law governs termination; contractual classification remains essential.10Bundesgesetz betreffend die Ergänzung des Schweizerischen Zivilgesetzbuches (Fünfter Teil: Obligationenrecht, OR) vom 30. März 1911 (SR 220), version of 1 January 2026, Art. 394(1) and Art. 404(1) and (2); BGE 115 II 464 (Urteil der I. Zivilabteilung vom 19. Dezember 1989), E. 2. A notice period cannot then by itself guarantee continuity. The controller's duty does not disappear when the representative resigns, and published contact details may cease to describe a functioning contact point before they are replaced.

4. Applying the Four Conditions to Health Apps, Wearables, Trial Sponsors and Software Vendors

A direct-to-consumer digital therapeutic or wearable can combine several facts material to the Swiss test: ongoing Swiss user relationships, sensitive health data and observation of individuals' behavior. The EDPB's discussion of wearables and health-status monitoring provides a useful EU comparison, not a binding interpretation of the Swiss condition.5 The data's nature, the activity and its gross risk still matter under Art. 14 DSG. Neither the product label nor an EU appointment answers that question. The related Swiss health-data obligations for SaaS and digital therapeutics extend beyond representation to impact assessments, breach notification and other duties.

A business platform may process hospital records on the customer's behalf while deciding the purposes and means of other operations itself. Art. 14 DSG does not impose a representative duty on a processor for its processor activity. But account administration, proprietary analytics or reuse of customer data can raise distinct controller questions. Support or analytics labels alone do not determine the role. The EDÖB's aggregate-risk language does not expressly decide how mixed controller and processor activities enter that assessment. It supplies no basis for treating every hospital record held by a vendor as its controller processing, or for concluding that a small amount of the vendor's own processing guarantees exemption.

Trial Sponsors, Research Organizations and Device Manufacturers

Clinical-trial data may reach a US sponsor in coded form while the Swiss site holds the key. Whether the sponsor processes personal data cannot be answered by that arrangement alone. In BGE 136 II 508, the Federal Supreme Court assessed identifiability by reference to realistic effort and the interests of the holder or a third party. E. 3.4 adopts the information holder's perspective but also addresses onward disclosure: identification by the recipient can be sufficient and can bring the disclosing party within the law. E. 3.5 confirms that requiring third-party involvement does not defeat identifiability where the overall effort remains realistically likely.11BGE 136 II 508 (Urteil BGer 1C_285/2009 vom 8. September 2010, EDÖB v Logistep AG), E. 3.2 and 3.4 to 3.5, applying the former Bundesgesetz über den Datenschutz of 19 June 1992. The decision applied the former Act; its natural-person analysis is relevant to the corresponding concept in Art. 5(a) DSG. Access to the key, monitoring rights, realistic identification routes and onward recipients therefore matter. The absence of the key in the sponsor's own office is not a safe harbor.

Even where personal data are involved, the appointment depends on the other Swiss conditions. A trial's recruitment, ongoing observation and follow-up may bear differently on offering services, observing behavior and regularity. The EDÖB excludes merely occasional or limited-period processing, but its representative guidance gives no trial-specific conclusion. A single project's end date does not by itself describe how the sponsor's Swiss-facing processing operates, particularly where studies or follow-up activities overlap.

A foreign sponsor may already have a Swiss representative under the clinical-trial rules. Art. 2(d) KlinV defines a sponsor as a person or institution with a Swiss seat or representation responsible for arranging the trial, particularly its initiation, management and financing in Switzerland. This ordinance does not govern device trials, which have their own rules.12Verordnung über klinische Versuche mit Ausnahme klinischer Versuche mit Medizinprodukten (Verordnung über klinische Versuche, KlinV) vom 20. September 2013 (SR 810.305), version of 15 August 2025, Art. 1(2) and Art. 2(d). That trial mandate does not by itself establish that the appointee performs the contact and register functions under Art. 14 and Art. 15 DSG.

The EU comparison shows how dual appointment can work without erasing the distinction. Art. 74(1) CTR provides for a legal representative for sponsors not established in the Union, subject to the Member-State derogations in Art. 74(2) and (3) CTR. In Example 25, the EDPB accepts that a trial sponsor's legal representative can also act as its GDPR representative if it is not the sponsor's processor, is established in a relevant Member State and performs both roles in accordance with their respective rules.13Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC [2014] OJ L158/1 (CTR), Art. 74(1) to (3); EDPB (n 5), Example 25. The example does not settle a Swiss dual mandate. Likewise, a contract research organization may be a processor for some sponsor activities and a controller where it determines purposes and means itself; its commercial title cannot resolve Art. 14 DSG.

A device manufacturer encounters a different Swiss mandate. Art. 51(1) MepV requires a manufacturer without a Swiss seat to authorize a person with a seat in Switzerland in writing before placing its products on the Swiss market. Art. 51(2) and (3) MepV concern formal and safety-related product responsibilities and incorporate the corresponding EU medical-device rules.14Medizinprodukteverordnung (MepV) vom 1. Juli 2020 (SR 812.213), version of 1 July 2026, Art. 51(1) to (3). The product mandate does not itself appoint a data-protection representative for connected-device data. One entity may hold both mandates, but their functions remain distinct. Neither appointment settles whether data may be transferred to the United States under Art. 16 DSG and the transatlantic data-transfer rules.

5. Strategic Considerations for US Controllers With Swiss Users

For a US group, the relevant facts may be spread across the contracting entity, the product team and the Swiss research site. A local subsidiary does not necessarily become the controller of the foreign parent's processing; a hosting contract does not determine the status of later analytics. Which entity decides the purposes and means, and which identification routes are realistically available for coded data, remain questions about the particular arrangements. A change in the product or its data flows may also alter a gross-risk assessment that previously supported no appointment.

Where an appointment is required, a Swiss address alone does not explain how the representative receives current information or handles communications from the EDÖB. A provider serving both markets may hold separate mandates, while Swiss mandate law may limit the security offered by a notice period. Who supplies changes to the processing register, and what happens to incoming communications if the representative resigns? Where one person also serves as data protection advisor, can the proposed duties preserve the independence required for the function on which the controller relies?