GDPR: prepare a European launch

On Monday, a Swiss company plans its first campaign in France and Germany. The adverts are ready, the form is translated and the sales team is trained. Then one question stops the launch: does the GDPR really apply from Switzerland? The website is accessible in Europe, the CRM is cloud-hosted, a prospect list has been enriched and several tools track visitors. A bare “yes” or “no” supports neither a legal decision nor a sale. Since 25 May 2018, a Swiss registered office alone has not kept an activity outside the European regulation. What matters is the processing: whether an offer targets people in the Union, whether their behaviour is monitored, which role the company plays and which suppliers are involved. This reading follows campaign targeting, collection, measurement, CRM, prospecting and supplier evidence without inventing results. It then considers an EU launch review as a focused first purchase before further acquisition investment. General analysis based on official sources available on 6 August 2026. It is not legal advice, an analysis of national prospecting rules, or an authority decision.

The GDPR applies where the processing meets its territorial tests: it takes place in the context of an EU establishment, offers goods or services to people in the Union, or monitors their behaviour there. A Swiss registered office does not automatically put the activity outside the regulation.

Article 3 provides several routes. An organisation may have an EU establishment and process data in the context of its activities. Without one, it may still fall within the GDPR when it offers paid or free services to people in the Union or monitors their behaviour there.

The European Commission gives a useful example: a small training company outside the Union targets Spanish and Portuguese universities and collects data to create accounts. The regulation may apply because the service is directed at those people. In contrast, non-EU customers using a service while travelling in the Union do not by themselves establish targeting.

How to read the diagram. The test applies to a defined activity. One company may reach different conclusions for two offers, journeys or processing activities.

Text alternative. Check the establishment first, then the offer and monitoring. If a criterion is met, qualify the processing, roles and duties. Otherwise document why the activity remains outside scope or uncertain.

Diagram sources. European Union, General Data Protection Regulation; European Data Protection Board, Guidelines 3/2018 on the territorial scope of the GDPR.

Genuine EU targeting is shown by a commercial strategy directed at one or more countries: adapted messages and terms, delivery or payment arrangements, campaigns or teams designed for people there. Website accessibility alone is not enough.

Targeting is assessed from a set of indicators. A French-language page proves little by itself because French is also a Swiss national language. A France-specific offer, local terms or prices, EU testimonials, geotargeted advertising, EU delivery or a salesperson assigned to those accounts makes intention clearer.

Retain the evidence behind the conclusion: market plan, landing pages, ad settings, accepted countries, contractual terms and sales journey. That protects both possible decisions—recognising scope where it exists and avoiding the automatic extension of the GDPR to an entire company because of an accidental visitor.

How to read the table. No indicator is automatically decisive. Their consistency describes the activity the business actually chose to launch.

Campaign measurement becomes behavioural monitoring when processing observes people in the Union to analyse or predict their preferences, behaviour or attitudes. Calling a tool “analytics” does not neutralise profiling, retargeting or persistent observation.

A modern campaign may place identifiers, connect visits, segment interests, build audiences, score a prospect or personalise a sequence. The Swiss FDPIC cites tracking visitor activity and observing browsing as examples that can bring a Swiss business within territorial scope. The question is not simply which tool is installed, but what it reveals about a person.

Separate aggregate measurement from an individual journey. Counting visits without a reasonable way to identify people needs a different analysis from joining browsing, a download and a sales call to one CRM profile. Settings, retention, identifiers and suppliers must be reviewed before selecting a legal basis, notice or consent mechanism.

Map the campaign first because no wording can accurately describe unknown flows. The map connects contact source, purpose, proposed legal basis, information given, CRM, processors, transfers, retention, rights and the commercial decision.

The journey may begin before a form. A list can come from a public source, supplier, event or partner, then be enriched, deduplicated, scored, assigned to sales, synchronised with advertising and retained after the campaign. Each operation belongs to the processing and needs an owner.

A sentence in a privacy notice cannot fix an indefensible list source. An opt-out button cannot fix a tool that keeps transmitting. A supplier contract cannot replace the instructions actually given to that supplier.

How to read the diagram. Prospects pass through several systems before becoming customers. Coherent evidence covers the handoffs, not only the landing page.

Text alternative. Document the source, enrichment, CRM, activation, response and retention, then link each supplier to the operations it performs.

The same map supports an EU buyer. In B2B sales, the customer may ask where data is processed, which subprocessors are involved, how rights requests are handled and what happens at the end of the service. Evidence helps market access only when it reflects the operation.

The role changes the evidence because a controller determines purposes and means, while a processor acts on documented instructions. The same Swiss company may control its own prospecting and process data for an EU customer using its service.

In its campaign, the Swiss business usually decides why prospects are collected, which tools are used and how long records are kept. In its customer service, it may process on the customer's behalf. Contracts, instructions, safeguards, subprocessors and return or deletion procedures then differ.

The European Data Protection Board's SME guide notes that the controller–processor relationship must be governed by contract. The processor acts on instructions, protects confidentiality, controls subprocessors, helps with requests and deletes or returns data as agreed. A commercial label cannot override the actual decisions.

How to read the table. One file cannot cover every company activity. Begin each relationship with the actual processing and decisions.

The 2024 adequacy decision facilitates transfers of personal data from the EU or European Economic Area to Switzerland without additional safeguards needed solely to ensure adequate protection. It does not remove other GDPR duties or the need to qualify processing and onward suppliers.

On 15 January 2024, the European Commission confirmed that Switzerland continues to provide an adequate level of protection. For an EU buyer, that removes an important friction: a transfer to a Swiss business does not, for that reason alone, require additional transfer safeguards.

Adequacy does not make every use lawful. The organisation still needs a purpose and basis, information, rights handling, processor governance, security and an assessment of onward transfers. A partner's tool may send data to another country; that step needs its own analysis.

How to read the table. Adequacy answers a transfer question. It does not replace the campaign file or supplier evidence a buyer expects.

The GDPR does not by itself permit commercial prospecting in Europe. It governs personal-data processing, while electronic communications are also covered by the ePrivacy Directive and national implementation. Channel, country, source and recipient must all be checked.

The European Commission notes that a named work email can be personal data, unlike a generic address such as info@company. When a list comes from a third party, the business must check whether collection and disclosure support the intended use. It must inform the person no later than first contact and respect the right to object to direct marketing.

That objection is absolute for this purpose: once a person objects, the business must stop the marketing use. Article 13 of the ePrivacy Directive also regulates email and leaves choices to national law. A method valid in France cannot simply be copied into Germany or another state.

For getfishnet, a multichannel strategy can include search, content, networks, events, referrers, advertising, email, phone or voice messages. It documents applicable rules, sources, notices, objections and sender identity before a test; conversion alone never determines the channel.

The initial purchase can be a paid EU launch review focused on one campaign and country: territorial test, flow map, roles, suppliers, blockers and prioritised remediation. It supports a launch decision without promising general compliance or a new customer.

The client supplies one campaign, form, list, CRM, measurement tools and market. The specialist defines the perimeter, identifies decisions requiring competent advice and separates pre-launch corrections from later work. A supplier file can also cover role, subprocessors, processing locations, safeguards, rights requests and service exit.

The work must be performed by a genuinely competent data-protection partner under a clear contract. Pricing, collection time, delivery load and margin must be validated before scaling.

The route receives a conditional GO. The problem is specific, the output can be sold before a large programme, and EU access has strategic value. Scaling remains on hold until a partner transaction with a new Swiss client establishes price, cash collection, full cost, margin and the review's causal role in the launch decision.

Businesses genuinely preparing for the EU show expansion signals: country pages, sales hiring, distribution, trade fairs, product localisation, tenders, new suppliers or buyer requirements. Qualification must confirm a campaign, country, decision-maker and deadline.

Research can combine company data, public announcements, job adverts, local pages, partnerships, events and technology signals. Channels may include search, specialised content, professional networks, email, phone, voice messages, referrers, events and strategic accounts. Their use must follow the rules described above.

How to read the funnel. General interest in Europe is not a case. The review becomes worth buying when a dated launch has known flows and an accountable decision-maker.

Exclude accounts where expansion is hypothetical, no one owns the decision, the partner lacks country competence or the prospect expects free validation. This protects expert capacity and avoids using maximum fines as a fear argument.

The decision measures are genuinely qualified launches, invoiced and collected reviews, full acquisition cost, expert time, margin and EU sales demonstrably unblocked. Audience and meeting counts are insufficient.

Full cost includes data, media, tools, production, sales time and expert time. Compare it with review margin and, where signed, the value of follow-on work. Maximum fines, the size of the Union and the number of Swiss companies are not commercial denominators.

Change targeting when contacted businesses have no dated project. Change the offer when need exists but the review is too broad or too legal. Slow channels when the partner cannot deliver on time. This reading claims no campaign result.

A review can become ongoing work when a new country, channel, product, supplier or buyer creates another documented decision. Continuity does not arise automatically from the GDPR: every intervention needs a trigger, output, responsibility and price.

The partner may update the flow map, assess a new subprocessor, prepare a buyer questionnaire or review another campaign. An ongoing advisory role is credible only where availability, lead times and boundaries are contractually sustainable. Revenue, duration and margin require evidence from real work.

The new Swiss DPA reading covers Swiss data governance. The cyber reporting reading follows a 24-hour incident decision. The IT and cybersecurity archive should display validated readings only.

The framework can be checked in the EU's GDPR text, European Data Protection Board guidelines, European Commission factsheets and the FDPIC's official information prepared for Swiss businesses.

Core references are GDPR Articles 3, 13, 14, 21, 27, 28 and 44; EDPB Guidelines 3/2018 on territorial scope and its SME guide; European Commission material on territorial application and marketing; FDPIC information on the GDPR's effect in Switzerland and the EU adequacy decision; and the ePrivacy Directive. They are named here without public external links.

An EU launch review can be a credible initial purchase, but a profitable market remains to be proven. The test needs a competent partner, expanding Swiss businesses, an offer that can be invoiced and collected promptly, and enough capacity to keep the promise.

The GDPR is not a wall at the border. It requires the activity to be legible: who is targeted, which data flows, who decides, which suppliers act and which rule governs the channel. That clarity may accelerate a European sale where a buyer expects evidence, but it creates no customer by itself.

getfishnet can build a tailored acquisition strategy around this entry point: targets, signals, channels, qualification and initial offer. The test compares the route with your current acquisition challenges, expertise and economics, then checks whether a real development fit exists.