Do I have to appoint a data protection officer (DPO)?
By Advisorn · updated on 17 October 2026 · Art. 10 and 23 FADP, Art. 37-39 GDPR
In short
Under the FADP no: for private businesses the data protection officer is optional (Art. 10 FADP). Under the GDPR it is mandatory when the core activities consist of regular and systematic monitoring of people on a large scale or of processing special categories of data on a large scale (Art. 37 GDPR).
Why appoint one even if it is not mandatory
If a business has appointed a data protection officer who meets the conditions of Art. 10 para. 3 FADP and has consulted them, it does not have to consult the FDPIC when a data protection impact assessment shows a high risk that remains (Art. 23 para. 4 FADP).
The data protection officer must have the necessary expertise, perform the function independently and without instructions, and carry out no incompatible tasks. They may be an employee or an external person; their contact details must be published and communicated to the FDPIC.
Not to be confused
The representative in the EU (Art. 27 GDPR) and the representative in Switzerland (Art. 14 FADP) are different roles: they are needed by those without an establishment in the territory of that law.
Related questions
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.