Swiss FADP Representative: Article 14 Explained

What Article 14 FADP does

Article 14 of the Swiss Federal Act on Data Protection regulates a representative obligation for certain private controllers registered or domiciled abroad that process personal data in Switzerland. The representative provides a Swiss contact point for data subjects and the Federal Data Protection and Information Commissioner, commonly referred to as the FDPIC.

The obligation is not triggered simply because a foreign company can be reached from Switzerland. The FDPIC describes four conditions that must be met together. A practical assessment should examine the organisation's Swiss-facing activities, processing scale and regularity, risk, entity status, data categories, and current privacy information.

The four Article 14 conditions

The processing must be connected with offering goods or services or monitoring the behaviour of people in Switzerland. It must also take place on a large scale and on a regular basis. Finally, the processing must pose a high risk to the personality rights of the data subjects. These conditions require more than a keyword check; the analysis should be tied to the real processing operations.

The high-risk assessment under Article 14 is its own question. The FDPIC explains that it concerns the potential gross risk arising from the relevant processing operations and is not simply the same as a DPIA assessment of one planned operation after safeguards are considered. Record the reasoning and the facts used so the conclusion can be revisited when the processing changes.

• Swiss offer of goods or services or monitoring of behaviour.
• Large-scale processing rather than isolated instances.
• Regular processing rather than an occasional or limited activity.
• High risk to the personality rights of people in Switzerland.

What the Swiss representative does

The representative acts as a local contact point for data subjects and the FDPIC. The organisation should be able to route questions, requests, and authority documents to someone who can obtain accurate information from the controller and coordinate the next response. The representative's address may also serve as a domicile for service in the circumstances described by the FDPIC.

The appointment should therefore include more than a name on a website. Define the authorised contact channels, internal escalation owner, information needed to respond, record-keeping route, languages, response coordination, and what the representative is not authorised to decide. The foreign controller remains responsible for its processing and substantive decisions.

Publication and maintenance

The FADP requires the controller to publish the name and address of the representative, for example in its privacy policy. That information should be accurate, permanently accessible, and connected to a monitored route. If the legal entity, service, website, or internal owner changes, review the representative details rather than leaving an outdated contact in place.

A short scenario test can check whether the appointment works. Send a hypothetical data-subject request or FDPIC communication through the published route, then verify receipt, logging, escalation, access to facts, response ownership, and closure. This tests operations; it does not replace a legal conclusion or guarantee an authority outcome.

Swiss representative versus Swiss data protection adviser

A representative is a local contact role connected to Article 14. A data protection adviser is a separate advisory function that may help an organisation interpret Swiss requirements, improve documentation, assess risk, or maintain a programme. The roles should not be described as interchangeable, and a representative appointment does not by itself provide ongoing privacy advice.

A foreign controller may need one role, both roles, or neither after reviewing the facts. When selecting support, start with the decision the organisation needs to make: confirm Article 14 applicability, establish a local contact, improve Swiss documentation, manage an incident, or build continuing advisory capacity.

Frequently asked questions