Representation Services
Representation services for internationally active companies
Your legal representative in Switzerland, the European Union and the United Kingdom
Companies that offer products or services in Switzerland, the European Union or the United Kingdom without having their own establishment in those markets must appoint a local representative under a growing number of regulations. This obligation has long ceased to be limited to data protection law. It increasingly also covers the regulation of data, artificial intelligence, cybersecurity and digital platforms.
MLL Legal provides these representation services through its own structures in all relevant jurisdictions: in Switzerland from our offices in Zurich, Geneva, Zug and Lausanne, in the United Kingdom through our London office, and in the European Union through MLL-EU-GDPR GmbH in Munich, a wholly owned subsidiary of MLL Legal Ltd. As representative, we are the designated contact point vis-à-vis authorities, supervisory authorities and data subjects. We serve as the reliable interface between your company and the relevant market.
What sets us apart:
- Own structures in all relevant jurisdictions. In Switzerland and the United Kingdom, we represent you from our own offices; in the European Union, through MLL-EU-GDPR GmbH in Munich, a group company that we established specifically for representation mandates back in 2018. No outsourcing to third parties.
- A team that understands the obligations behind representation. The mandate is supported by one of Switzerland’s leading practice groups for ICT, data and data protection law.
- Advice in German, English and French.
What does a representative do, and what are its limits?
The legal representative is your official point of contact in the relevant market. It receives requests from authorities and data subjects, forwards them to you and coordinates communication. Depending on the applicable regulation, it also maintains certain records or keeps evidence available.
A representative is not a Data Protection Officer (DPO) and does not constitute an establishment of your company in the relevant jurisdiction. Substantive responsibility for compliance with the applicable rules remains with you. Upon request, we combine representation with broader legal advice, while deliberately keeping the two services separate.
DATA PROTECTION REPRESENTATION
Swiss FADP: Swiss data protection representative (Art. 14 FADP)
Companies established abroad that extensively and regularly process personal data of individuals in Switzerland and thereby create a high risk to their personality must appoint a representative in Switzerland. MLL Legal performs this function from Zurich: we are the point of contact for the Federal Data Protection and Information Commissioner (FDPIC) and for data subjects, maintain the statutory record of processing activities and ensure that requests reach you without delay and can be answered within the applicable deadlines.
Legal basis: representation in Switzerland
Under Art. 14 FADP, private controllers established abroad must appoint a representative in Switzerland if they process personal data of individuals in Switzerland, the processing is related to the offering of goods or services or to the monitoring of behaviour, and the processing is extensive, regular and entails a high risk to the personality of the data subjects. The representative is the point of contact for data subjects and the FDPIC and maintains a record of processing activities (Art. 14 et seq. FADP). The representative does not have independent liability for data protection infringements committed by the company; however, it is subject to cooperation and information duties.
EU GDPR: representative in the Union (Art. 27 GDPR)
If you process personal data of individuals in the European Union without an establishment in the Union, for example because you offer goods or services to them or monitor their behaviour, you generally need a representative in the Union. MLL Legal provides this representation through MLL-EU-GDPR GmbH in Munich. We are the point of contact for supervisory authorities and data subjects, maintain the record of processing activities and ensure that requests reach you in a structured and timely manner.
Tasks of the representative under the GDPR
Under Art. 27 GDPR, controllers and processors without an establishment in the Union must appoint a representative in the Union where they fall within Art. 3(2) GDPR, namely where they offer goods or services to individuals in the Union or monitor their behaviour. The representative is the point of contact for supervisory authorities and data subjects and maintains the record of processing activities. It does not have independent liability for substantive data protection infringements; however, it is subject to duties of care and cooperation.
UK GDPR: UK Representative (Art. 27 UK GDPR)
Since Brexit, companies without an establishment in the United Kingdom that process personal data of individuals in the UK require a UK Representative. MLL Legal performs this role through its London office: we are the contact point for the UK Information Commissioner’s Office (ICO) and for data subjects, and we forward requests to you immediately.
Legal requirements for the UK Representative
Companies without an establishment in the United Kingdom that fall within the scope of the UK GDPR must appoint a UK Representative under Art. 27 UK GDPR. The UK Representative is the point of contact for the ICO and for data subjects, forwards requests to the represented company and maintains the record of processing activities. In principle, there is no independent liability for data protection infringements; however, a contractual duty of care applies vis-à-vis the represented company.
EU DIGITAL REGULATIONS
Digital Services Act: legal representative for online platforms (Art. 13 DSA)
Providers of intermediary services, including hosting services, online platforms and online marketplaces, that do not have an establishment in the European Union must appoint a legal representative in a Member State. MLL Legal performs this function through MLL-EU-GDPR GmbH in Munich and acts as the point of contact for national Digital Services Coordinators, the European Commission and the European Board for Digital Services. We receive orders from authorities, coordinate their implementation with you and monitor deadlines.
Duties of the legal representative under the DSA
Under Art. 13 DSA, providers of intermediary services without an establishment in the European Union must appoint a legal representative in a Member State where they offer services. The representative is the point of contact for the authorities, the Commission and the European Board for Digital Services and ensures the implementation of orders from authorities. It should be noted that, under Art. 13(3) DSA, the legal representative may be held liable for non-compliance with obligations under the DSA; the scope and interpretation of this provision are debated in legal literature. We therefore accept DSA representation mandates only after prior assessment of the specific service profile.
AI Act: authorised representative (Art. 22 / 54 AI Act)
Providers of AI systems without an establishment in the European Union must appoint an authorised representative in the European Union for certain systems, in particular high-risk AI systems and general-purpose AI models. MLL Legal accepts such mandates through MLL-EU-GDPR GmbH in Munich: we keep the technical documentation and the EU declaration of conformity available, respond to reasoned requests from authorities and cooperate with market surveillance authorities.
Legal framework for authorised representatives under the AI Act
The AI Act requires providers of high-risk AI systems (Art. 22) and general-purpose AI models (Art. 54) without an establishment in the European Union to appoint an authorised representative in the European Union. The authorised representative keeps the technical documentation and EU declarations of conformity available, responds to requests from authorities and cooperates in supervisory measures. It is required to terminate the mandate if the provider breaches its obligations. Infringements may be sanctioned under Art. 99 AI Act with fines of up to EUR 15 million or 3 % of worldwide annual turnover. We accept mandates for high-risk AI systems after an individual risk and feasibility assessment.
Data Act: representative in the Union (Art. 37 Data Act)
Any undertaking outside the European Union that makes connected products available on the Union market or offers related services or data processing services in the Union must, since 12 September 2025, appoint a representative in the Union. MLL Legal performs this function through MLL-EU-GDPR GmbH in Munich, acts as contact point for the competent authorities and provides the compliance evidence required under the Data Act.
Regulatory representation requirements under the Data Act
Under Art. 37(11) Data Act, undertakings without an establishment in the European Union that fall within the scope of the Regulation, including manufacturers of connected products and providers of related services and data processing services, must appoint a representative in a Member State where the products or services are offered. The representative is the point of contact for the authorities and demonstrates, upon request, the compliance measures taken. Legal responsibility for compliance with the Data Act remains with the undertaking.
Data Governance Act: representative in the Union (Art. 11 / 19 DGA)
Data intermediation service providers and recognised data altruism organisations without an establishment in the European Union must appoint a representative in the Union. MLL Legal performs this function through MLL-EU-GDPR GmbH in Munich and serves as the central contact point vis-à-vis the competent authorities.
Representation obligations in the Union under the Data Governance Act
Under Art. 11(3) DGA, data intermediation service providers and, under Art. 19 DGA, recognised data altruism organisations without an establishment in the Union must appoint a representative in a Member State in which they offer their services or are active. The representative is the point of contact for the competent authorities and may also be addressed in connection with enforcement measures. Sanctions under the DGA are directed at the providers themselves (Art. 34 DGA), not at the representative; however, a general contractual liability risk remains.
NIS2: representative in the Union (Art. 26 NIS2 Directive)
Certain providers of digital services without an establishment in the European Union, such as providers of cloud and managed services, DNS services, online marketplaces, online search engines or social networking services platforms, must appoint a representative in the Union under NIS2. MLL Legal performs this function through MLL-EU-GDPR GmbH in Munich and acts as contact point for the competent authorities and Computer Security Incident Response Teams (CSIRTs).
Legal basis for representation in the Union under NIS2
Under Art. 26 of the NIS2 Directive, certain service providers established outside the European Union must appoint a representative in a Member State in which they offer services. The representative is the point of contact for the competent authorities and CSIRTs. As NIS2 is a directive implemented through national law, the details, including any own duties and sanctions applicable to the representative, depend on the applicable national implementing law.
Individual combination of representation services
Depending on the business model, several representation obligations may apply at the same time. These can often be usefully bundled, for example as combined data protection and platform representation. In a personal discussion, we clarify which representation functions are relevant for your company and prepare an individually tailored offer on that basis.
How representation works
- Initial discussion and scoping
We clarify the scope of application, assess potential conflicts of interest and determine the relevant representation obligations. - Engagement agreement
The scope of services, responsibilities and terms are agreed individually. - Appointment and publication
We are appointed as representative; the contact details are provided and published where required. - Ongoing operation
We receive requests from authorities and data subjects, forward them to you in a structured manner, maintain required records and escalate time-critical matters.
Frequently asked questions
Do I need a representative at all?
This depends on your business model, the relevant markets and the applicable regulation. We clarify this conclusively in the initial discussion.
No. The representative is the external contact point vis-à-vis authorities and data subjects. The DPO is an internal function with advisory and monitoring tasks. Both may be required in parallel.Is the representative the same as a Data Protection Officer (DPO)?
No. The appointment of a representative does not, in itself, create an establishment of your company in the relevant jurisdiction.Does representation create an establishment or tax liability?
Yes. We bundle different representation functions in one mandate where this is legally and organisationally appropriate.Can one mandate cover several regulations?
German, English and French.In which languages do you work?
Interested in further information?
For further information or a non-binding consultation, please use our contact form. We will discuss your needs and develop a suitable solution for your representation and compliance requirements.
Responsible contacts
ICT & Digital
Our nationally leading ICT team in Switzerland provides comprehensive advice on software law, licensing, data protection and data security – as well as on e-commerce, digital marketing and blockchain. With pragmatic, solution-oriented approaches and many years of experience in cross-border digital business models, we help you realistically assess legal risks and consistently seize opportunities.
