Article 27 UK GDPR · Switzerland

UK representative for Swiss companies

A Swiss company can be subject to three regimes at the same time: its own revised Federal Act, the EU GDPR, and the UK GDPR. Each has its own test and each asks a separate question about representation. Being outside the Union and outside the United Kingdom is the position that triggers both foreign requirements rather than neither.

Three regimes, two representatives

The revised FADP governs you at home. The EU GDPR asks for a representative in the Union when you target or monitor people there. The UK GDPR asks for one in Britain on the same terms. A Swiss company selling to both markets typically needs both designations — one naming an entity in a member state, one naming an entity in the United Kingdom — and neither substitutes for Swiss law.

Adequacy answers transfers, not representation

The United Kingdom recognises Switzerland as providing adequate protection, so data can move without additional safeguards. This is genuinely useful and it is routinely mistaken for an exemption. Adequacy is about where data may travel; Article 27 is about who receives a request in Britain, and the ICO asks that question separately.

Private banking, watches, pharma: the sectors that write

Swiss companies that reach us tend to hold either high-value client data or health data. Private client services hold financial detail about British customers; luxury goods brands hold purchase histories tied to named individuals; life sciences hold data that is sensitive by definition. In each case the cost of an unanswered ICO letter is disproportionate to the cost of a designation.

What each designation names

The European one names Europe Services SE in Prague and answers to the supervisory authorities of the member states. The British one names REP27 LTD, company number 17385889, at Mildenhall in Suffolk, and answers to the ICO. Bought together they are issued together, approved together and verified separately, with codes prefixed R27 and UK27.

Which of the three regimes asks what

Swiss companies benefit from seeing the three requirements laid side by side, because each is usually handled by a different person internally. Domestic duties sit with your legal team, the European designation with whoever handled the GDPR project in 2018, and the British one with nobody, which is how it goes missing.

Three regimes at a glance

Sensible Daten, teurere Fehler

Where the data is sensitive the arithmetic changes. A watch brand holds purchase histories; a private bank holds financial detail; a clinic or a life sciences company holds health data. The obligation is identical in each case, but the consequence of an unanswered request is not, and the ICO takes the category of data into account when it decides how seriously to treat a missing point of contact.

Questions from Swiss companies

Companies elsewhere, same obligation

What changes from one country to the next is not the rule but the route into it.