Regulations › Rest of world › Switzerland

nFADP

Swiss Federal Act on Data Protection (revised)

In force privacy

WhenIn effect since 1 September 2023

Who enforces itFederal Data Protection and Information Commissioner

Who it applies toOrganizations processing personal data of people in Switzerland.

Tell the regulatorNotify the FDPIC as soon as possible of a breach likely to pose a high risk DPO requiredOptional for private controllers RegistrationNo registration for private controllers Transfers abroadAllowed to Federal Council-listed adequate countries Request deadline30 days for access requests, extendable with notice to the data subject Maximum fineCriminal fine up to CHF 250,000 per individual

If you already comply with

90%

of Switzerland's 21 requirements are already met by European Union (GDPR). Here is what nFADP adds, biggest gaps first.

Reach abroadReach and lawful basisGap

GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.

nFADP adds3 Applies to any circumstances that have an effect in Switzerland, even if initiated abroad; some foreign controllers must appoint a Swiss representative. Art. 3(1) (effects principle); Art. 14 (representative) · source ↗

RegistrationGovernanceGap

GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.

nFADP adds1 No registration for private controllers; federal bodies must report their processing activities to the FDPIC. Art. 12(4) · source ↗

Already covered by GDPR: Lawful basis, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO required, DPO qualifications, DPIA, Records, Retention, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.

A gap means nFADP is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL