REP27 · EU representative · Switzerland
Article 27 GDPR · Switzerland
If your company is established in Switzerland and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
The revised Federal Act on Data Protection is close to the GDPR but separate, and Switzerland is not in the EU. Swiss companies serving EU customers fall under Article 3(2) and need a designated representative in a member state.
Article 27(5)The designation does not shield you. Actions can still be brought against your company directly. Anyone selling a representative as protection is selling something the regulation does not contain.
Pharma and medtech, private banking technology, watch and luxury e-commerce, and SaaS built for the European market.
A campaign targeted at European users, a European language on the landing page, a local phone number: the test is whether you envisaged those customers, not whether you meant to.
Behavioural analytics on people in the Union is monitoring under Article 3(2)(b). This route catches companies with no European revenue at all.
Tickets, RMA forms and warranty registrations from European customers are personal data you process. B2B does not change that.
The revised Federal Act on Data Protection, in force since September 2023, is close to the GDPR in structure and requires foreign companies to appoint a representative in Switzerland. The FDPIC supervises it. Switzerland is not in the Union and holds an adequacy decision.
the Federal Data Protection and Information Commissioner. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Swiss companies reach the Union constantly and often without noticing: pharma and medtech with EU trial sites, private banking technology, watch and luxury e-commerce shipping into Germany, France and Italy, and SaaS built for the European market.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The designation letter, the records under Article 30(4), the log of every request received and when it was forwarded. Assembled as you go, not reconstructed under pressure.
Valid until a date, verifiable by code, and it stops showing as active the day it lapses. That is what makes the status worth something.
Article 27 alone, or with the GPSR responsible person and the CE authorised representative on the Multi plan. One renewal date for all of it.
No, and this is the most common confusion we see. The Swiss act requires a representative in Switzerland for foreign companies. The GDPR requires one in the Union for you. Two laws, two countries, two designations.
Adequacy lets data flow. It does not put Switzerland inside the Union for the purposes of Article 3 and Article 27. A Swiss company selling to people in the EU is a third-country company.
The designation is made in a member state where your data subjects are, and our desk covers all 27 anyway. Proximity does not change the obligation, only the language of the requests you will receive.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Swiss files split evenly between companies that thought adequacy covered them and companies that thought the Swiss representative covered them. Neither does.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check