- Swiss companies are subject to the GDPR if they offer goods or services to EU customers (Art. 3 para. 2 lit. a GDPR).
- The application of the GDPR to Liechtenstein is currently unclear; Liechtenstein is not an EU member state, but is a member of the EEA.
- If the GDPR is incorporated into the EEA Agreement, it would apply directly in Liechtenstein; otherwise, the Liechtenstein DPA would remain in force.
Many Swiss companies are currently busy preparing for the implementation of the compliance requirements that will result from the GDPR and the revised DPA. As a first step, the question arises whether and to what extent companies in Switzerland will have to comply with the GDPR.
It is clear that Swiss companies will be subject to the GDPR if they offer goods or services to customers in the EU (Art. 3(2)(a) GDPR). However, it is unclear whether the GDPR will also apply when addressing customers in Liechtenstein. The answer is still unclear at this point in time:
- Liechtenstein is not a member state of the EU. Thus, the GDPR is not directly applicable.
- However, Liechtenstein is a member of the EEA (together with Iceland and Norway). Currently, the adoption process of the GDPR by the EEA is underway (current information on the respective implementation of EU legal acts by the EEA can be found at here can be retrieved).
- Opinions are currently being sought from EEA countries on the applicability of the GDPR. The outcome is still unclear. Should the adoption of the GDPR into the EEA Agreement be decided, the next procedural step would be the draft adoption decision by the ‘Joint Committee’. After the adoption decision enters into force, it would be incorporated into the EEA Agreement and the GDPR would apply directly in Liechtenstein (no national implementation). As a result, its Art. 3(2)(a) would then also be applicable, so that addressing Liechtenstein customers would result in the application of the GDPR to the corresponding provider. The status of the adoption process can here (as of March 16, 2017).
- Should the GDPR not be adopted by the EEA, the current Liechtenstein GDPR would remain in force.
A commentary by the EEA Secretariat, which explains in more detail the incorporation of EU acts into the EEA Agreement, is as follows here retrievable.