The subnational level of federal states constitutes a critical arena for understanding the implementation of international rules, with subnational entities often exercising significant discretion. This paper studies the subnational implementation of a European Union (EU) data protection instrument in Switzerland, a salient case of EU external governance (EU rules extending beyond EU borders). Switzerland is interesting for observing subnational implementation, representing a highly decentralised system, where subnational entities have broad implementation competences. This case study reveals unexpectedly low implementation levels. Drawing on in‐depth document analysis and 28 stakeholder interviews, this paper evaluates the influence of multilevel institutional settings, civil servants' agency and policy‐specific factors on implementation outcomes. The findings reveal that institutional constraints and policy issue specificities outweigh the role of actor agency, challenging dominant perspectives in implementation research. This study contributes to understanding the dynamics of EU rule implementation beyond its borders and within multilevel governance systems.