Swiss Representative in accordance with the Data Protection Act

Authorities or public bodies as well as data processors do not have to designate a Swiss representative.

For private data controllers, there are only the following exemptions from the obligation to name a representative:

If the processing of data

• is only done occasionally,
• is not extensive or
• does not entail a high risk for the personality of the persons concerned.

Data controllers must take into account the nature, circumstances, purpose and risks to the rights and freedoms of data subjects. Especially for online businesses, such an exception is unlikely to apply.

Attention: The exceptions to the obligation to appoint a Swiss representative listed here only apply if all the processing operations of a data controller are covered. If even only one processing activity is extensive or not only occasionally, a Swiss representative must be appointed.

Controllers may designate natural persons as well as companies or other organisations that have their registered office in Switzerland as representatives in Switzerland.

The DPA does not require any verifiable professional qualification. However, from the experience of the now established EU representative under the GDPR, the following minimum requirements for Swiss representatives can be formulated:

• Very good knowledge of Swiss data protection law (Data Protection Act, Data Protection Ordinance (DPA), Ordinance on Data Protection Certifications (VDSZ)) and related regulations;
• Very good knowledge of the GDPR in order to be able to assess and, if necessary, explain data processing to the commissioning company;
• Very good knowledge of information and IT security as well as corresponding legal regulations,
• Practical experience in the implementation of legal requirements regarding personal data processing,
• Experience in dealing with supervisory authorities and affected data subjects.

In addition, it is advisable for a Swiss representative to be able to communicate with affected data subjects in the official languages of Switzerland (German, French, Italian and Romansh).

Art. 394 et seq. of the Swiss Code of Obligations (OR) (SR 220) sets out the requirements for the contractual relationship between the Swiss representative and the responsible party. Accordingly, the representative is obliged to act diligently and must have the personal and organisational capacity to perform the representative’s duties.

Art. 15 DPA regulates the tasks and duties of the representative in Switzerland. Accordingly, the primary task of the Swiss representative is to be the point of contact for data subjects and the Eidgenössische Datenschutz- und Öffentlichkeitsbeauftragten (EDÖB). In this context, the Swiss representative can make legally effective declarations and receive such declarations by proxy.

Swiss supervisory authorities can oblige the representative to provide all relevant information necessary to clarify data protection facts. If the Swiss representative does not cooperate sufficiently with the EDÖB, the latter can impose sanctions.

The Swiss representative must also maintain a register of all processing activities that occur in or in relation to persons in Switzerland (Art. 12 DPA). It is not prescribed whether the creation, maintenance and completion of the register must be ensured by the Swiss representative. However, this can be contractually transferred to the representative.

Even if a Swiss representative is designated, the responsible party remains liable according to the principles of the DPA and must accept responsibility for the conduct of its representative. The representation in Switzerland is not liable itself, at least externally.

If, on the other hand, the Swiss representative breaches his or her agreement with the data controller, they may be held liable vis-à-vis the data controller depending on the contract.