Someone is asking about our data

A customer's questionnaire, an investor's due diligence or a regulator's letter asks the same thing: how the company handles personal data, in every country where it works.

In short

At stake: A customer contract, an investment or a regulator's enquiry that is waiting for your answer.
The exposure: The deal stalls in the other side's review. A GDPR fine can reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Under Swiss law an intentional breach of certain duties can bring a fine of up to CHF 250,000, aimed at the responsible individual and not the company.
What Lexaero delivers: One set of records, notices, agreements and transfer terms built to meet every law that applies, and answers ready for the next questionnaire.
First step: A gap review against the laws that apply to you.

Country by country

General orientation as at October 2026. It is not legal advice, and what applies to you turns on facts this page cannot see.

Data protection

In the EU: The GDPR applies to an establishment in the EU, and to a company outside it that offers goods or services to people there. Without an EU establishment, such a company usually has to appoint a representative in the EU.
In Switzerland: The Swiss FADP applies to processing that has effects in Switzerland. Its fines, of up to CHF 250,000 for intentional breaches of certain duties, are aimed at the responsible individuals, and a foreign company may have to appoint a Swiss representative.
In the United Kingdom: The UK GDPR follows the EU regulation closely but is a separate law with its own regulator. Notices need UK wording, and transfers out of the United Kingdom to countries it does not treat as adequate need the UK's own transfer terms.
In the Middle East: Saudi Arabia and the United Arab Emirates each have a personal-data law, and the DIFC and ADGM financial centres apply their own.

Between two places

With head office outside Europe: Sending the data back to head office is an international transfer. It needs standard contractual clauses or another recognised safeguard, unless an adequacy decision covers the recipient.

For the detail between two particular countries, set your route on the home page. Lexaero does not advise on tax, customs, banking or work permits, and does not broker investments. Where they matter, it says so and works with the adviser you choose.

Read further

Data protection across regimes Briefing: GDPR and the Swiss FADP A new regulation or an audit The Diagnostic

Next step

Is this where your company is?

Describe it in a few lines. A reply normally follows within one working day, and a first call of thirty minutes is free.

Ask Lexaero about this See the other situations