If you sell as a Swiss or US SaaS provider to users in the EU or UK, your customers' procurement and privacy teams will ask for a named representative during due diligence. SIDD takes on this role: legally led, multilingual and bundled with your DPA and DPO.
For SaaS providers from Switzerland, the US and other third countries with users in the EU and UK
A SaaS provider without an establishment in the EU that processes data of people in the EU must designate a representative in writing under GDPR Art. 27. The same duty applies for the United Kingdom under the UK GDPR through a separate UK representative.
The representative becomes the named point of contact for the supervisory authorities and for data subjects. Authorities and users approach this address when they request information, erasure or an investigation, and the representative is listed in your record of processing activities and your privacy notice. This gives authorities and data subjects a reachable contact inside the EU and the UK, even when your company sits outside.
Enterprise customers check this detail during vendor due diligence. If a named representative is missing, the point shows up in the security questionnaire and in the review of your privacy documents as an open finding and delays the contract. With a registered representative you answer the question immediately and remove a blocker from the procurement process.
We are formally appointed as your representative and run the ongoing correspondence, so your team can focus on the product.
EU representation starts from CHF 600 per year, UK representation from GBP 1'200 per year. We accept the mandate in writing, provide you with the wording for your privacy notice and record of processing, and act towards authorities and data subjects as your named contact.
When a request from a supervisory authority or a data subject arrives, we receive it, assess it legally and align the response with you. We correspond in German, French and English, so a request from an authority in an EU member state is answered cleanly in the right language. We document the correspondence, so you can present audit-ready evidence at any time.
Representation works best bundled with the other building blocks of your data-protection setup. We combine it with your data-processing agreement and, where needed, with the external data protection officer role under GDPR Art. 37, so that representative, DPA and DPO come from one partner and fit together.
A representation is more than an address. In a serious case, what matters is who assesses the request correctly and answers it cleanly.
Your representation is led by doctorate-level lawyers with CIPP/E. An authority request is therefore not just forwarded but legally assessed and answered in alignment with you.
We correspond with supervisory authorities and data subjects in German, French and English. A request from an EU member state is answered in the right language, without the detour of a translation.
We deliver the representation bundled with your data-processing agreement and the external data protection officer. The building blocks fit together and name the same contact, with no gaps between providers.
We document the correspondence with authorities and data subjects and maintain the required entries in our Swiss Priverion Platform. In a customer review or an authority request, the evidence is ready.
When an enterprise customer asks in the security questionnaire about your EU or UK representative, you point to a named, registered contact. An open finding becomes a closed item in the procurement process.
We advise in German, French and English and run no in-house SOC business. So our role as representative stays neutral and focused on your compliance.
EU Representative (GDPR Art. 27)
from CHF 600 / year
Named representative in the EU for SaaS providers without an EU establishment.
UK Representative (UK GDPR)
from GBP 1'200 / year
Separate named representative in the United Kingdom for SaaS providers with UK users.
Representation bundled with DPA & DPO
Fixed fee
EU and UK representation combined with a data-processing agreement and an external data protection officer.
Our tool: LexCommand
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
For your Art. 27 representation, concretely: when a request from an EU supervisory authority or a data subject arrives, LexCommand scopes it to the correct legal system of the EU GDPR or the UK GDPR, without mixing jurisdictions, and grounds every statement in our aligned response in the relevant primary source.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
If you process data of people in the EU without an establishment there and no narrow exemption applies, GDPR Art. 27 requires a named representative. We check whether the duty applies in your case against your actual data flows. For the United Kingdom, the same logic applies under the UK GDPR through a separate UK representative.
No, these are two distinct roles. The representative under Art. 27 is your named contact in the EU or UK towards authorities and data subjects. The data protection officer under Art. 37 monitors data-protection compliance internally. We can take on both roles and align them with each other.
We receive the request, assess it legally and align the response with you before it goes out. We correspond in German, French and English and document the entire exchange, so you can present audit-ready evidence at any time.
Yes, that is the recommended path. We deliver representative, data-processing agreement and, where needed, the external data protection officer as a bundle. That way all data-protection documents name the same contact and fit together, which noticeably simplifies your customers' vendor due diligence.
Yes. SaaS providers from the US or other third countries in particular need EU and UK representation as soon as they serve users in the EU or UK. We take on the role for providers without their own European presence and run the correspondence multilingually.
Representation works best together with these topics:
The data-processing agreement enterprise customers demand, legally sound and ready to negotiate.
Answers to questions on data location, US access and international transfers.
All building blocks to win the vendor security review, at a glance.
We check whether the duty applies in your case, appoint ourselves formally and take on the correspondence with authorities and data subjects, multilingual and legally led.