Who Should You Hire as a Swiss Data Protection Representative?
By GDPR Local team · October 22, 2026
Hire a provider that identifies your appointed Swiss representative, covers the statutory duties in its contract and commits to a workable enquiry-handling process. GDPR Local, EDPO and Iliomad Health Data are options to compare—not a ranked shortlist. First, assess whether your processing meets the appointment conditions under the Swiss Federal Act on Data Protection (FADP).
Key Takeaways
- Swiss customers alone do not trigger the representative requirement; all the conditions in FADP Article 14 must apply.
- A Swiss representative acts as a local contact point and performs specified record and information duties; it does not take over your compliance responsibilities.
- Compare the appointed entity, included duties, exclusions and contractual response commitments before comparing fees.
- GDPR Local, EDPO and Iliomad Health Data offer relevant services, but their service pages do not establish comparative delivery quality.
- Iliomad’s life-sciences positioning is a reason to ask about relevant experience, not proof of specialist expertise.
Meta description: Hiring a Swiss data protection representative? Compare GDPR Local, EDPO and Iliomad on statutory duties, contract scope and service commitments.
Author and credentials: Not disclosed.
Relationship to GDPR Local: Not disclosed; this article includes links to its services and contact page.
Swiss privacy-law review: Pending. No named reviewer or completed legal-review date is recorded.
Do you need a Swiss data protection representative?
An overseas private controller must appoint a Swiss representative when all the conditions in FADP Article 14 apply. The provision concerns controllers with their domicile or registered office abroad that process personal data of people in Switzerland. The processing must:
- Relate to offering goods or services to people in Switzerland, or monitoring their behaviour there.
- Be extensive.
- Be regular.
- Involve a high risk to the personality of the individuals concerned.
These conditions are cumulative, not alternative triggers. See FADP Article 14 and DLA Piper’s Switzerland overview.
Swiss customers alone do not establish an appointment obligation. As a practical recommendation, document the relevant processing purposes, data, affected individuals, scale, frequency and risks. Obtain a focused Swiss legal assessment if the application of “extensive” processing or “high risk” remains unresolved.
Assess your controller and processor activities separately. Article 14 addresses controllers, not organisations acting solely as processors. Your business can perform both roles for different activities, and falling outside the representative requirement does not remove other applicable FADP obligations. See the FADP’s scope, definitions and Article 14.
Hire a representative—not a DPO by mistake
A Swiss representative provides a local contact point and performs defined statutory duties. Article 14 makes the representative the contact point for affected individuals and the Federal Data Protection and Information Commissioner (FDPIC), and requires the controller to publish the representative’s name and address. See FADP Article 14.
The representative’s record and information duties are narrower than complete privacy management. Article 15 requires the representative to maintain a record containing the information specified in Article 12, provide information from that record to the FDPIC on request, and provide affected individuals with information on exercising their rights on request. See FADP Articles 12 and 15.
A DPO or privacy consultant performs a different function. Advice, policy development, training and remediation support do not automatically include a representative appointment. Equally, appointing a representative does not transfer responsibility for your processing decisions or automatically purchase comprehensive legal advice.
An EU or UK representative appointment does not automatically cover Switzerland. Confirm a representative in Switzerland and an express Swiss mandate rather than relying on a European correspondence address. See FADP Article 14.
What should the contract include?
Use the contract to distinguish statutory duties from optional services and operational commitments. The statutory baseline comes from FADP Articles 12 and 14–15; response targets, language coverage and advisory services require separate agreement.
| Area | What to establish before signing |
|---|---|
| Contracting and appointed entities | Identify the entity selling the service, the appointed Swiss representative and the address you will publish. Establish their relationship if they differ. |
| Statutory duties | Require explicit coverage of the local contact role, processing record and Article 15 information duties. |
| Record maintenance | Agree how you supply the required information, communicate changes and obtain access to the maintained record. |
| Enquiry handling | Distinguish receiving and forwarding correspondence from triage, response drafting and legal advice. |
| Service commitments | Specify operating hours, acknowledgement and forwarding targets, urgent escalation and absence cover. |
| Exclusions | Identify excluded work, volume limits, translation, complex requests, investigation assistance and additional charges. |
| Security | Agree confidentiality, access controls, secure transfers, retention, deletion and subcontractor arrangements. |
| Onboarding and exit | Establish the effective appointment date, required documents, termination terms, record transfer and correspondence handover. |
Keep an internal owner responsible for responding to enquiries. Your representative needs someone who can provide facts, authorise action and coordinate legal or operational support. As a practical recommendation, test that contact route before relying on it.
Which providers should you shortlist?
Compare these providers as service options, not as evidence of superior performance. The comparison below uses each provider’s own service page for its advertised offering. It does not establish contractual inclusions, response guarantees or delivery quality.
Provider comparison
| Provider | Service-page basis | When to include it | What must determine the hiring decision |
|---|---|---|---|
| GDPR Local | Advertises Swiss Article 14 representation and separately offers privacy consultancy. | Include it when you want to assess Swiss representation alongside access to separately scoped privacy support. | The appointed Swiss entity, representation duties, exclusions and binding service commitments—not the breadth of its consultancy offering. |
| EDPO | Advertises a Swiss representative service. | Include it when comparing proposals for the Swiss representative role. | The appointed entity, record-maintenance arrangements, enquiry-handling scope and contractual response commitments. |
| Iliomad Health Data | Presents a Swiss FADP representative service for life sciences. | Include it when life-sciences context matters to your procurement questions. | The same contractual requirements, plus evidence of practitioner qualifications and experience relevant to your processing. |
Apply the same selection criteria to every provider. First check the Swiss appointment and statutory coverage; then assess operational commitments, security, exclusions, continuity and total cost for your expected workload. Service-page descriptions are not substitutes for those contractual details.
GDPR Local: an option for representation and separate consultancy
GDPR Local is an option when you want to assess representation and broader privacy services from the same provider. Its advertised service range supports that procurement route, but does not establish better suitability or delivery than alternatives. See its Swiss representative service and consultancy services.
Keep the representation mandate distinct from consultancy. Do not treat access to advisory services as a commitment to handle rights-request responses, breaches, complaints or investigations within the Swiss representation contract.
EDPO: an alternative representation proposal
EDPO offers another Swiss-representation option to assess against the same requirements. Use its Swiss Representative service page as the starting point, then evaluate its proposed appointment, duties, exclusions and service commitments. Its inclusion here is not a claim about comparative quality.
Iliomad Health Data: sector positioning to investigate
Iliomad Health Data’s life-sciences positioning makes it relevant to sector-specific procurement questions. Its Swiss service page identifies that focus; the positioning alone does not demonstrate specialist expertise.
Ask for evidence relevant to your actual work. For research or health-data processing, assess the proposed team’s qualifications, relevant assignments and responsibility for any specialist advice. Apply the same contractual standards used for the other providers.
How should you compare quotes?
Request the same scope from each provider so that price differences reflect comparable work. Send a concise processing summary and ask each provider to complete the contract checklist above, identifying included work, exclusions and chargeable additions.
Choose the service model that matches your internal capability.
- If you have an experienced privacy team: prioritise clear statutory coverage, reliable communications and secure record handling. A representation-only contract can meet that procurement need.
- If you need ongoing compliance help: request a separately defined advisory scope with named responsibilities and deliverables.
- If sector context is important: require evidence of relevant experience rather than selecting on sector branding alone.
- If enquiries could require urgent action: make acknowledgement, forwarding and escalation commitments a condition of appointment.
Evaluate total cost against expected use, not just the headline fee. Include onboarding, enquiry limits, translation, advisory work, urgent matters, renewal and exit charges in your comparison.
What should happen after appointment?
Make the appointment operational as well as contractual. Complete these steps before relying on the service:
- Document the appointed representative, Swiss mandate and effective date.
- Publish the representative’s name and address.
- Supply the information required for the processing record and agree an update process.
- Assign internal owners for individual enquiries and authority requests.
- Test communication and escalation routes.
- Coordinate effective dates and correspondence handover when changing providers.
The publication and representative duties follow FADP Articles 14–15. Testing, internal ownership and handover planning are practical recommendations.
Conclusion
Hire on demonstrated legal fit and contractual commitments, not provider positioning alone. Assess whether you need an appointment, then compare GDPR Local, EDPO and Iliomad Health Data using the same requirements. Your next step is to request comparable scopes; you can contact GDPR Local as one option for Swiss representation and separately scoped privacy support.