Switzerland FADP — Federal Act on Data Protection (2023)

Why does it matter?

The FADP is the law every business operating in Switzerland meets when it handles personal data, and it differs from the GDPR in ways that matter in practice. There is no fixed breach deadline, only notification as quickly as possible when a high risk is likely (Article 24), and the FDPIC cannot fine: it investigates and orders measures (Articles 49 to 51), while cantonal authorities prosecute intentional breaches, in many cases on complaint, under Articles 60 to 65, with fines of up to CHF 250,000 aimed at the responsible individual rather than the company.

Key benefits include:

• A defined duty to inform

Article 19 requires the controller's identity and contact details, the purpose and any recipients at collection, and the country and guarantees when data goes abroad; indirectly collected data must be disclosed within one month.

• A record of processing activities

Article 12 obliges controllers and processors to keep a record; DPO Article 24 exempts organizations under 250 employees unless they process large volumes of sensitive data or carry out high-risk profiling.

• Assessment before high-risk processing

Article 22 requires a data protection impact assessment, and Article 23 requires asking the FDPIC when high risk remains after the planned measures.

• A breach report with defined content

DPO Article 15 lists what a report to the FDPIC contains and requires the controller to document every breach and keep the documentation for at least two years.

• Personal criminal exposure

Articles 60 to 63 set fines up to CHF 250,000 for wilful breaches of information, access, transfer, processor and security duties.

How does it work?

Article 6 sets the principles: lawfulness, good faith, proportionality, purpose limitation, accuracy, and deletion or anonymization once data is no longer needed. Consent must be voluntary and specific, and explicit for sensitive personal data and for high-risk profiling by a private person (Article 6, paragraph 7). Article 7 requires data protection by design and by default, and Article 8 with DPO Articles 1 to 6 requires measures that protect confidentiality, availability, integrity and traceability, with logging and processing regulations where large volumes of sensitive data or high-risk profiling are involved. A processor may act only on the controller's terms, and sub-processing needs prior approval (Article 9).

Disclosure abroad is permitted where the Federal Council has found adequate protection (Article 16 paragraph 1; DPO Annex 1) or where safeguards apply: a treaty, contractual clauses notified to the FDPIC, standard clauses the FDPIC has approved, issued or recognized, or binding corporate rules (Article 16 paragraph 2). Article 17 lists exceptions such as explicit consent or performance of a contract. For the United States, Annex 1 deems protection adequate only for organizations certified under the Swiss-US Data Privacy Framework, in effect since September 15, 2024.

People hold rights of access with a 30-day response (Article 25), data portability (Article 28), human review of automated individual decisions (Article 21) and correction (Article 32). The FDPIC opens investigations on its own motion or on a report (Article 49) and can order processing modified, suspended or ended, transfers prohibited, assessments carried out, or a representative appointed (Article 51).

Key Elements

• Record of processing (Article 12)

Controller identity, purpose, categories of data subjects and data, recipients, retention period if possible, security measures and, for transfers abroad, the State and the Article 16 guarantees.

• Data protection officer (Article 10)

Optional for private controllers; appointing an independent, expert officer whose contact details are published and notified to the FDPIC lets a controller skip FDPIC consultation under Article 23.

• Representative (Articles 14 and 15)

A foreign private controller names a Swiss representative where processing relates to offering goods or services or monitoring behavior in Switzerland, is large-scale, regular and high risk.

• Impact assessment (Articles 22 and 23)

Description of the processing, evaluation of risks and protective measures; high risk is presumed for large-scale sensitive data and systematic large-scale monitoring of public areas.

• Breach notification (Article 24)

Report to the FDPIC with nature, consequences and measures; inform data subjects if needed for their protection or if the FDPIC asks; processors notify the controller as quickly as possible.

• Sensitive personal data (Article 5)

Religious, philosophical, political or trade union views, health, private sphere, race or ethnicity, genetic and biometric identifying data, criminal and administrative sanctions, and social assistance data.

What does it cover?

The Act applies to the processing of personal data of natural persons by private persons and by federal bodies (Article 2), and to circumstances that have an effect in Switzerland even if they began abroad (Article 3). It does not apply to purely personal use, to the Federal Assembly's deliberations or to beneficiaries of immunity, and cantonal and communal bodies fall under cantonal law. A private controller with a registered office abroad must appoint a Swiss representative only if all four conditions of Article 14 are met: the processing relates to goods, services or monitoring in Switzerland, is large-scale, is regular, and poses a high risk.

What are its objectives?

Article 1 states the purpose: to protect the personality and fundamental rights of natural persons whose personal data is processed.

Give people transparency through the duty to inform and rights of access and portability.

Replace the registration of data files with the FDPIC by an internal record of processing activities.

Make data protection by design and by default, impact assessment and consultation legal duties.

Set a defined standard for security measures and for reporting breaches that carry a high risk.

Keep cross-border transfers tied to an adequacy list or a recognized safeguard.

Framework in Context

The revised FADP follows the Council of Europe's Convention 108+ and is close to the EU GDPR in substance without copying it; the European Commission lists Switzerland among the countries it recognizes as adequate and published its review report of the eleven earlier adequacy decisions on January 15, 2024. The GDPR itself reaches a Swiss company only through its Article 3(2). Sector rules sit alongside the Act, and cantonal data protection laws cover cantonal and communal bodies. Many organizations run one privacy program against the FADP, the GDPR and the UK GDPR, using ISO/IEC 27001 for security and ISO/IEC 27701 for privacy management.

Common Framework Mappings

Organizations map the FADP to the GDPR and to privacy management standards so that one set of records, rights procedures and security controls serves every jurisdiction they operate in.

Mapped frameworks include:

GDPR

UK GDPR

Convention 108+

ISO 27701

ISO 27001:2022

NIST Privacy Framework v1.0