REP27 · Switzerland
Article 27 GDPR · Switzerland
Switzerland is surrounded by Member States, holds an adequacy decision, and has its own modern data protection act. All three facts make Swiss companies assume the European question is settled. It is not: geography, adequacy and domestic compliance each solve something other than Article 27, which asks only whether someone inside the Union can be contacted.
The Commission recognised Switzerland as providing adequate protection, and the recognition was maintained after the nFADP came into force. That decision governs transfers.
Article 27 governs contactability. It requires a designation in writing naming an entity established in the Union, so a data subject in Lisbon and the authority in Lisbon both have somewhere to write. No adequacy decision creates that address, which is why Japan, Canada, the United Kingdom and Switzerland — all adequate — are all in scope.
The typical Swiss profile is a watch or luxury goods brand shipping across the border, a fintech with European users, a pharmaceutical or medtech supplier with EU clinical partners, or a private bank whose site is read across Europe.
| Country | Status | Article 27 representative |
|---|---|---|
| Germany, France, Italy, Austria | EU Member State | Not needed |
| Norway, Iceland, Liechtenstein | EEA — GDPR applies directly | Not needed |
| Switzerland | Outside EU and EEA, adequate | Required |
| United Kingdom | Outside EU, adequate | Required |
Liechtenstein is the instructive case: a smaller neighbour, also outside the EU, but inside the EEA — and therefore exempt where Switzerland is not.
Liechtenstein is the clearest illustration of why geography does not decide this. It is smaller than most Swiss cantons, is not an EU Member State, shares a currency and a customs area with Switzerland, and yet its companies need no Article 27 representative — because it joined the European Economic Area, and the GDPR applies there directly.
Switzerland negotiated bilateral agreements instead of EEA membership, and data protection was never part of that package. The result is that two neighbouring countries, closely integrated with each other, sit on opposite sides of Article 3(2). A company in Vaduz processing data of people in Germany is inside the GDPR's own territory; a company twenty kilometres away in Buchs is a third-country controller.
The practical consequence for Swiss groups with a Liechtenstein entity is worth checking carefully: if the EEA entity genuinely carries out the processing, there may be an establishment in the Union's data protection area and no designation is needed. If it is a holding shell, there is not, and the Swiss parent is squarely in scope.
Adequacy means personal data may flow from the Union to Switzerland without Standard Contractual Clauses. It says nothing about whether a person in Spain or Poland can contact you. Article 27 is about contactability, and it applies to every company established outside the Union regardless of adequacy.
No. Norway, Iceland and Liechtenstein are in the EEA and apply the GDPR directly, so their companies need no representative. Switzerland is outside both the EU and the EEA, which is why Swiss companies are in exactly the same position as Japanese or Canadian ones.
No. The nFADP is Swiss law, supervised by the Federal Data Protection and Information Commissioner. The GDPR is EU law, supervised by twenty-seven other authorities. Compliance programmes built for one do not discharge the other.
Language alone is not decisive when it is also your domestic language. What matters is whether the offering is directed at people in the Union: euro pricing, shipping options to EU addresses, EU-targeted advertising, or analytics profiling European visitors.
Only if they have an establishment in a Member State. A firm based in Zurich or Geneva cannot be designated under Article 27, because the representative must be established where the data subjects are.
The nFADP has its own rules for foreign controllers with a Swiss link. It is a separate obligation with a separate contact point, and it does not interact with your Article 27 designation.
Only if you also target people in the United Kingdom. Since 2021 that is a third regime with its own regulator, requiring its own designation.
We read your public privacy notice and tell you in ten seconds whether a representative is named.
Run the free check See pricing