evidence: The above rules on data transfers also apply in an outsourcing context, where a controller in Switzerland engages a processor in another state, or where a processor in Switzerland engages a sub-processor in another state. In addition, controller-to-processor relationships and processor-to-sub-processor relationships have to be governed by a data processing agreement. [...] Under the FADP (Article 14), businesses or organizations (private controllers) established outside of Switzerland have to appoint a representative in Switzerland under certain conditions. They will be required to do so if they regularly perform high-risk and large-scale processing of personal data in connection with the offering of goods or services in Switzerland, or in connection with the monitoring of individuals' behavior taking place in Switzerland. [...] The standard for data processing agreements required by Article 28(3) of the GDPR suffices in most circumstances for the purposes of the FADP. Note that, where the data processing agreement also addresses data transfers, controllers and processors should ensure transfers from Switzerland to abroad are also covered. In practice, this can often be achieved if the parties simply agree that Switzerland is considered a member of the European Economic Area ('EEA') for the purposes of the data processing agreement.