Who must appoint a Swiss data-protection representative?

A controller with its seat abroad must designate a representative in Switzerland where it processes personal data of people in Switzerland, the processing relates to offering goods or services or to monitoring behavior, and the processing is large-scale, regular and presents a high risk; these are the conditions set out in Art. 14 DSG. In the EDÖB's reading, processing is large-scale when personal data are processed more than in isolated instances.

Is the Swiss representative the same as an EU Art. 27 GDPR representative?

No. They are corresponding roles in different jurisdictions: the Art. 14 DSG representative sits in Switzerland for Swiss-facing processing; the Art. 27 GDPR representative sits in the EU for EU-facing processing. A controller targeting both may need both. GAWEL Legal acts as the Swiss representative and coordinates (but does not act as) the EU one.

What does the representative do?

Under Art. 15 DSG the representative maintains the record of the controller's processing activities and acts as the contact point through which data subjects and the EDÖB can reach the controller. It is a contact-and-records role, not a transfer of the controller's own legal responsibility.

What duties does the controller keep after appointing the representative?

The appointment does not shift the controller's own compliance responsibility, and it adds one duty of its own: the controller must publish the name and address of its Swiss representative (Art. 14 DSG), typically in the privacy notice. The representative's role is to hold the record of processing and to be reachable for data subjects and the EDÖB; lawfulness of the underlying processing stays with the controller.

Swiss data-protection representative

GAWEL Legal acts as the representative in Switzerland that Art. 14 DSG requires of certain controllers domiciled abroad, for an annual fee. The mandate under Art. 14 and Art. 15 DSG covers maintaining the record of processing and serving as the contact point for data subjects and the EDÖB; a combined mandate adds coordination of the client's EU Art. 27 GDPR representative.

Discuss a representative appointment View scope

A contact point in Switzerland

Controller abroad: Retains legal responsibility
Swiss representative: Contact point and processing record
Data subjects and EDÖB: Access through the representative

The Art. 14 DSG role is distinct from the data-protection advisor function.

Who this is for

EU, US and other foreign controllers offering goods or services to, or monitoring, people in Switzerland
Companies that have appointed an EU Art. 27 GDPR representative and now need the Swiss counterpart
Controllers without a Swiss establishment that need a local contact point for the EDÖB

Scope

Applicability check:
confirming whether the client's Swiss-facing processing meets the cumulative conditions of Art. 14 DSG: a connection to offering goods or services or to monitoring behavior in Switzerland, and processing that is large-scale (in the EDÖB's reading, more than isolated), regular and high-risk
Appointment and publication:
the written designation of GAWEL Legal as representative and the controller's accompanying duty to publish the representative's name and address (Art. 14 DSG)
Record of processing:
maintaining the register of the controller's processing activities the representative must keep, with the particulars required by Art. 12 DSG (Art. 15 DSG)
Contact point:
serving as the point through which data subjects and the EDÖB reach the controller: disclosing register particulars to the EDÖB on request and informing data subjects how to exercise their rights (Art. 15 DSG)
EU coordination:
advisory on, and coordination of, an EU Art. 27 GDPR representative where the same activity also targets the EU; GAWEL Legal advises on the EU role but does not act as the EU representative.

How the work proceeds

Applicability check The applicability review confirms whether the Art. 14 DSG conditions are met for the client's Swiss-facing processing.
Appointment A written mandate designates GAWEL Legal as the client's representative in Switzerland.
Record of processing The record required of the representative under Art. 15 DSG is maintained.
Contact point The representative serves as the point of contact for data subjects and the EDÖB.
EU coordination Where the activity also targets the EU, the mandate includes coordination with the client's separate EU Art. 27 GDPR representative.

Fees

Annual fee, tiered by the controller's size

The combined mandate with coordination of the EU representative is a separate annual tier.

Questions

Who must appoint a Swiss data-protection representative?: A controller with its seat abroad must designate a representative in Switzerland where it processes personal data of people in Switzerland, the processing relates to offering goods or services or to monitoring behavior, and the processing is large-scale, regular and presents a high risk; these are the conditions set out in Art. 14 DSG. In the EDÖB's reading, processing is large-scale when personal data are processed more than in isolated instances.
Is the Swiss representative the same as an EU Art. 27 GDPR representative?: No. They are corresponding roles in different jurisdictions: the Art. 14 DSG representative sits in Switzerland for Swiss-facing processing; the Art. 27 GDPR representative sits in the EU for EU-facing processing. A controller targeting both may need both. GAWEL Legal acts as the Swiss representative and coordinates (but does not act as) the EU one.
What does the representative do?: Under Art. 15 DSG the representative maintains the record of the controller's processing activities and acts as the contact point through which data subjects and the EDÖB can reach the controller. It is a contact-and-records role, not a transfer of the controller's own legal responsibility.
What duties does the controller keep after appointing the representative?: The appointment does not shift the controller's own compliance responsibility, and it adds one duty of its own: the controller must publish the name and address of its Swiss representative (Art. 14 DSG), typically in the privacy notice. The representative's role is to hold the record of processing and to be reachable for data subjects and the EDÖB; lawfulness of the underlying processing stays with the controller.

Discuss your matter

Briefly describe the matter and the legal advice you need.

Discuss a representative appointment