Swiss Representative or Data Protection Adviser: A Practical Decision Guide

Separate the appointment question from the work you need

First identify the legal entity and whether it is a private controller established abroad. The Article 14 representative requirement concerns that situation; it is not a universal appointment requirement for every business that has Swiss customers. Document the processing connected with people in Switzerland before choosing a product.

Then list the work needed inside the business: notices, data inventories, impact assessments, supplier reviews, staff guidance, and follow-up on privacy risks. Advisory support can be useful whether or not the Article 14 representative conditions are met. Buying advice does not itself establish the local representative contact required by an applicable mandate.

Work through all four Article 14 conditions

The FDPIC describes four cumulative requirements: a connection with offering goods or services or monitoring behaviour in Switzerland; processing on a large scale; regular processing; and high risk to the personality rights of the people affected. Record the evidence for each condition rather than using one fact, such as having Swiss customers, as the complete assessment.

Do not substitute a single DPIA for the Article 14 assessment

The FDPIC distinguishes the Article 14 assessment of the relevant ongoing and planned processing from the risk assessment for a particular project. It considers gross risk for the representative question, before taking account of measures intended to reduce that risk. A conclusion from a narrowly scoped project review should therefore not be copied into a broader representation assessment without examining what it covers.

Practically, prepare a view of the whole Swiss-facing activity: data categories, purposes, people affected, recurring operations, access arrangements, and intended disclosures. Record missing facts explicitly. If one team owns the application but another owns marketing, the assessment needs a way to connect those processing activities rather than treating them as unrelated paperwork.

Three illustrative business situations

Consider a foreign platform providing a recurring service to people in Switzerland and using detailed behavioural profiles. Its assessment should examine the scale, regularity, and gross risk of the Swiss-facing processing together. If all four conditions are met, it needs a representative; it may also need advice on its wider privacy programme.

Now consider a foreign supplier processing a small, isolated set of professional contacts for a one-off transaction. The company should document how each Article 14 condition applies instead of treating the existence of those contacts as an automatic appointment trigger. An adviser may help with that assessment or with other applicable obligations.

Finally, consider a private company established in Switzerland that is replacing a major supplier. It may need help reviewing disclosures, contracts, notices, and risk. That work is an advisory question. The foreign-controller representation condition should not be applied solely because the company has a Swiss postal address. These examples illustrate the assessment process, not concluded advice on any particular organisation.

What an adviser can help you organise

Swiss private entities may appoint a data protection adviser under Article 10 FADP; the general position differs from the mandatory appointments applicable to federal bodies. A commercial advisory engagement should state whether it includes a formal Article 10 appointment and whether the relevant conditions have been addressed. Do not assume that every consultancy package creates that formal status.

Useful advisory work can include reviewing privacy information, identifying gaps in an inventory, supporting impact assessments, and helping decision owners understand options. Agree the output and the person who will implement it. Independence, expertise, and incompatible duties need attention where the formal adviser provisions are being relied upon.

Prepare different documents for the two roles

For representation, organise the foreign controller's identity, Article 14 reasoning, mandate, published name and address, and correspondence procedure. Confirm how the representative can obtain the information needed to carry out its role, and how a request is escalated to someone who can decide and respond.

For advisory support, prepare the business questions and the materials needed to answer them: current policies, relevant supplier arrangements, system descriptions, open projects, and the people responsible for implementation. If both roles are needed, address their boundaries and any potential conflicts expressly rather than assuming one generic description is sufficient.

Review the assessment when the business changes

A recorded decision remains useful only while its assumptions hold. Revisit the representative assessment when the Swiss audience grows, recurring monitoring is introduced, sensitive data is added, access is widened, or a new service changes the risk profile. Keep the earlier reasoning so that the change can be understood.

Maintain the representative's published information and the internal response route throughout an appointment. Review the advisory scope as projects and owners change. Neither role transfers the controller's responsibility for lawful processing, resources, and implementation to the service provider.

Choose support around the decision you need to make

If the Article 14 facts are clear and point to an appointment, discuss a representative mandate and the contact arrangements. If the facts are incomplete, organise an assessment first. If the main issue is implementing or maintaining a privacy programme, define the advisory work and its expected deliverables.

Bring the same written facts to a pricing discussion so that representation, advice, and any formal appointment are compared on a consistent basis. Ask which work is included, what requires a separate project, and how the engagement responds to a change in the business.

Frequently asked questions