Regulations › Rest of world › Switzerland
nFADP
Swiss Federal Act on Data Protection (revised)
WhenIn effect since 1 September 2023
Who enforces itFederal Data Protection and Information Commissioner
Who it applies toOrganizations processing personal data of people in Switzerland.
Tell the regulatorNotify the FDPIC as soon as possible of a breach likely to pose a high risk
DPO requiredOptional for private controllers
RegistrationNo registration for private controllers
Transfers abroadAllowed to Federal Council-listed adequate countries
Request deadline30 days for access requests, extendable with notice to the data subject
Maximum fineCriminal fine up to CHF 250,000 per individual
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
3
Applies to any circumstances that have an effect in Switzerland, even if initiated abroad; some foreign controllers must appoint a Swiss representative.Art. 3(1) (effects principle); Art. 14 (representative) · secondary source · source ↗
Scored 3 because the effects test is broader than GDPR Art. 3(2). The representative is required only when processing targets or monitors people in Switzerland, and is regular, extensive and high-risk. Article numbers come from knowledge of the Act; the DLA page gives no article numbers.
Lawful basis
1
No closed list of bases; processing must follow the principles, and breaches are justified by consent, an overriding private or public interest, or law.Arts. 6, 30, 31 · secondary source · source ↗
An overriding private interest works like legitimate interests. A legal ground is needed only where processing would otherwise unlawfully breach personality, for example against the person's express objection.
Consent
2
Where needed, consent must be voluntary, specific and informed; it must be express for sensitive data, high-risk profiling, and (federal bodies) profiling.Art. 6(6)-(7) · secondary source · source ↗
Sensitive data
2
Sensitive data (incl. genetic, biometric, social assistance, criminal proceedings) needs express consent if relying on consent; disclosing it to third parties needs justification.Art. 5(c); Art. 6(7); Art. 30(2)(c) · secondary source · source ↗
Not an outright ban: it is a justification model. Large-scale processing of sensitive data also triggers a DPIA, and records duties for SMEs.
Children
0
No fixed age; a minor can consent if they have capacity of judgment, assessed case by case.No FADP provision; capacity of judgment under Art. 16 Civil Code · secondary source · source ↗
People's rights
Rights
3
Access, rectification, deletion, restriction/prohibition of processing, objection, data portability, and a right to be heard on automated individual decisions.Arts. 21, 25, 28, 32 · secondary source · source ↗
Rectification, deletion and objection are enforced through personality-protection claims (Art. 32), not a GDPR-style request procedure.
Request deadline
2
30 days for access requests, extendable with notice to the data subject.Art. 25(7); Art. 18 FDPO · secondary source · source ↗
The source confirms the 30-day rule but not the paragraph number. Art. 25(7) and FDPO Art. 18 come from knowledge of the Act and were not checked against Fedlex.
Marketing
2
Opt-in for automated mass advertising (email, SMS), except to existing customers for similar products with an opt-out offered.Federal Act against Unfair Competition (UCA) Art. 3(1)(o) · secondary source · source ↗
The rule sits in the UCA, not the FADP. The DLA page names the UCA but not the paragraph; Art. 3(1)(o) is from knowledge of the Act.
Governance
DPO required
1
Optional for private controllers; federal bodies must appoint a data protection advisor.Art. 10; FDPO Art. 25 · secondary source · source ↗
A private controller that appoints an independent advisor and notifies the FDPIC need not consult the FDPIC after a high-risk DPIA.
DPO qualifications
1
The advisor must have the necessary expertise, act independently without instructions, and hold no conflicting duties.Art. 10(3) · secondary source · source ↗
Registration
1
No registration for private controllers; federal bodies must report their processing activities to the FDPIC.Art. 12(4) · secondary source · source ↗
Private controllers with an independent advisor must notify the advisor's contact details. Certain foreign controllers must appoint a Swiss representative (Art. 14).
DPIA
2
Required where processing may pose a high risk; the FDPIC must be consulted if high residual risk remains. Keep the DPIA two years after processing ends.Arts. 22-23; FDPO Art. 14 · secondary source · source ↗
Records
2
Controllers and processors must keep records; firms under 250 employees are exempt unless they process sensitive data at scale or do high-risk profiling.Art. 12; FDPO Art. 24 · secondary source · source ↗
Retention
1
Destroy or anonymize personal data once it is no longer needed for its purpose; no statutory periods.Art. 6(4) · secondary source · source ↗
The FDPO sets minimum keep periods for logs and DPIA and breach records (one to two years), not maximum retention periods.
Breaches
Tell the regulator
1
Notify the FDPIC as soon as possible of a breach likely to pose a high risk; no fixed hour deadline.Art. 24(1)-(2); FDPO Art. 15 · source ↗
The FDPIC guidance gives no 72-hour rule. Failure to report is not itself a criminal offense.
Tell people
2
Inform data subjects when needed for their protection or when the FDPIC requests it, regardless of the high-risk threshold.Art. 24(4)-(5) · source ↗
Scored 2: the trigger is the need to protect people, not high risk, so it can be broader than the GDPR's.
Transfers
Transfers abroad
2
Allowed to Federal Council-listed adequate countries; otherwise FDPIC-recognized SCCs, FDPIC-approved BCRs, or notified clauses; limited derogations such as explicit consent.Arts. 16-17; FDPO Annex 1 · secondary source · source ↗
Non-standard clauses must be notified to the FDPIC in advance. Swiss-US Data Privacy Framework certification has counted as adequate since 15 Sept 2024.
Localization
0
No general data localization requirement.No FADP provision · secondary source · source ↗
Sector rules such as the FINMA outsourcing circular may limit offshoring for banks.
Enforcement
Maximum fine
2
Criminal fine up to CHF 250,000 per individual; a company can be fined up to CHF 50,000 when identifying the individual is disproportionate.Arts. 60-64 · secondary source · source ↗
About USD 300,000. The FDPIC cannot fine; cantonal prosecutors enforce.
Criminal liability
1
Willful breaches of listed duties are criminal offenses, punished by fines of up to CHF 250,000 on responsible individuals. No imprisonment.Arts. 60-62, 64 · secondary source · source ↗
Scored 1 (limited offenses): the sanctions fall on individuals, including managers, rather than the company, but carry no prison term.
Private action
2
Data subjects can sue for injunctions, rectification or deletion, damages, moral damages and surrender of profits.Art. 32; Arts. 28-28l Civil Code · secondary source · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws