Does the GDPR apply to Swiss companies?

• Establishment (Article 3(1)). If you have a subsidiary, branch or other stable arrangement in the EU, the GDPR applies to processing in the context of its activities, wherever the processing happens.
• Targeting (Article 3(2)). Without an EU establishment, the GDPR still applies when you offer goods or services to people in the EU, paid or free, or monitor their behaviour in the EU, for example through online tracking or profiling.

The EDPB Guidelines 3/2018 on territorial scope explain the targeting test: an EU language or currency, delivery to EU countries, or marketing aimed at EU users point to targeting. A website that people in the EU can merely reach does not, on its own.

A Swiss company caught by Article 3(2) must appoint a representative in a member state where the people concerned are (Article 27). The duty does not apply to occasional processing that does not include large-scale processing of special categories of data or criminal data and is unlikely to result in a risk to people.

The European Commission has recognised Switzerland as offering adequate protection since 2000 (Decision 2000/518/EC), and confirmed it in its 2024 review. Personal data can go from the EU to Switzerland without further safeguards. Switzerland in turn lists the EU and EEA states as adequate under the FADP.

In Data Privacy in Acuna GRC you select the privacy laws that apply, the GDPR, the FADP or both, and each processing activity records a legal basis for each law it falls under. Transfers carry a safeguard per recipient, from adequacy to SCCs, and breaches run on the 72-hour GDPR clock. See Data privacy management and the Swiss FADP guide.