🇨🇭Federal Act on Data Protection

← Back to laws in Switzerland

A privacy law built around personality rights, not just regulatory checklists

Switzerland's Federal Act on Data Protection, or FADP, protects the personality and fundamental rights of natural persons whose personal data is processed. It applies to processing by private persons and federal bodies and has a clear effects-based territorial rule: it applies to circumstances that have an effect in Switzerland even if they were initiated abroad.

The FADP is similar in spirit to European data protection law, but it should not be treated as a simple copy of the GDPR. Its core concepts are Swiss: personality rights, proportionality, good faith, recognisable purpose, data accuracy, privacy by design, privacy by default and risk-based supervision by the Federal Data Protection and Information Commissioner.

Scope — who is covered and what is excluded

Article 2 applies the FADP to processing of personal data of natural persons by private persons and federal bodies. It does not apply to personal data processed by a natural person exclusively for personal use, to personal data processed by the Federal Assembly and parliamentary committees as part of their deliberations, or to processing by certain institutional beneficiaries under the Host State Act that enjoy immunity from jurisdiction in Switzerland.

Article 3 gives the Act territorial reach. The FADP applies to circumstances that have an effect in Switzerland, even if initiated abroad. Foreign private controllers may also need to appoint a Swiss representative under Article 14 if they process personal data of persons in Switzerland in connection with offering goods or services or monitoring behaviour, and the processing is large-scale, regular and high-risk.

The Act protects natural persons. Personal data means any information relating to an identified or identifiable natural person. Sensitive personal data includes data relating to religious, philosophical, political or trade union-related views or activities; health, private sphere or racial or ethnic affiliation; genetic data; biometric data uniquely identifying a natural person; administrative or criminal proceedings or sanctions; and social assistance measures.

Core principles — lawful, good-faith and proportionate processing

Article 6 sets out the main processing principles. Personal data must be processed lawfully, in good faith and proportionately. It may only be collected for a specific purpose that the data subject can recognise, and further processing must be compatible with that purpose. Personal data must be destroyed or anonymised as soon as it is no longer required for the processing purpose.

Accuracy is also a legal obligation. Any person who processes personal data must satisfy themselves that the data is accurate and must take appropriate measures to correct, delete or destroy data that is incorrect or incomplete in light of the processing purpose. The appropriateness of those measures depends on the form and extent of the processing and the risk to the data subject's personality or fundamental rights.

Consent, where required, must be voluntary, specific and informed. It must be explicit where the processing involves sensitive personal data, high-risk profiling by a private person, or profiling by a federal body. This explicit-consent requirement is one of the key risk triggers under the FADP.

Privacy by design, privacy by default and security

Article 7 requires the controller to arrange processing in technical and organisational terms so that data protection regulations, especially the principles in Article 6, are respected. This obligation applies from the planning stage. Measures must be appropriate to the state of the art, the nature and extent of processing and the risk to personality or fundamental rights.

The default setting obligation is important. The controller must use suitable default settings so that personal data processing is limited to the minimum required for the intended purpose unless the data subject specifies otherwise. This makes privacy by default an operational product and system-design requirement, not only a policy statement.

Article 8 requires controllers and processors to guarantee a level of data security appropriate to the risk by taking suitable technical and organisational measures. These measures must make it possible to avoid breaches of data security. The Federal Council may issue minimum data security requirements.

Processors, representatives and records

Article 9 allows processing to be assigned to a processor by contract or legislation if the data is processed only in the manner in which the controller itself is permitted to process it and no legal or contractual duty of confidentiality prohibits the assignment. The controller must satisfy itself that the processor can guarantee data security. The processor may assign processing to a third party only with the controller's prior approval.

Articles 12 requires controllers and processors to maintain records of processing activities, subject to exceptions for smaller legal entities where processing poses negligible risk. The controller's record must include the identity of the controller, processing purposes, categories of data subjects and personal data, recipients, retention period or criteria where possible, a general description of security measures where possible, and details of foreign disclosures and safeguards.

Foreign private controllers may have to appoint a Swiss representative under Article 14. The representative serves as the contact point for data subjects and the FDPIC, publishes the representative's name and address, maintains the processing record and provides the FDPIC and data subjects with information on request.

Cross-border disclosure — adequacy first, safeguards next

Article 16 provides the main cross-border rule. Personal data may be disclosed abroad if the Federal Council has decided that the recipient state or international body guarantees an adequate level of protection. If there is no adequacy decision, disclosure abroad is permitted only if an appropriate level of protection is guaranteed through recognised mechanisms.

Those mechanisms include an international treaty, data protection clauses in an agreement notified to the FDPIC beforehand, specific guarantees drawn up by the competent federal body and notified to the FDPIC, standard data protection clauses approved, issued or recognised by the FDPIC, or binding corporate rules approved by the FDPIC or by a competent data protection authority in an adequate state.

Article 17 contains exceptions. Personal data may be disclosed abroad where, for example, the data subject explicitly consents, the disclosure is directly connected with a contract with the data subject or a contract in the data subject's interest, disclosure is necessary for overriding public interest or legal claims, disclosure is necessary to protect life or physical integrity where consent cannot be obtained in time, the data subject has made the data generally accessible and not prohibited processing, or the data comes from a public statutory register subject to access requirements.

Transparency duties and automated individual decisions

Article 19 requires controllers to inform data subjects appropriately when collecting personal data, including where data is not collected directly from the data subject. At minimum, the notice must provide the controller's identity and contact details, the purpose of processing, and recipients or categories of recipients where applicable. Where data is not collected from the data subject, the controller must also provide the categories of processed personal data.

If personal data is disclosed abroad, the controller must inform the data subject of the recipient state or international body and, where applicable, the safeguards under Article 16 or the exception under Article 17. If data is not collected from the data subject, the information must generally be provided within one month of receiving the data or at the time of disclosure if disclosure occurs earlier.

Article 21 regulates automated individual decisions. The controller must inform the data subject about any decision based exclusively on automated processing that has legal consequences or a considerable adverse effect. On request, the data subject must be allowed to express a point of view and may request review by a natural person, subject to statutory exceptions.

DPIAs, consultation and breach notification

Article 22 requires a data protection impact assessment where processing is likely to result in a high risk to personality or fundamental rights. High risk may arise in particular with new technologies, large-scale processing of sensitive personal data, or systematic large-scale monitoring of public areas. The DPIA must describe the planned processing, evaluate risks and describe measures to protect personality and fundamental rights.

Article 23 requires consultation with the FDPIC if the DPIA indicates that the planned processing will still pose a high risk despite the measures planned by the controller. The FDPIC must generally indicate objections within two months, extendable by one month for complex processing. Private controllers may avoid consulting the FDPIC if they have consulted a qualifying data protection officer.

Article 24 requires controllers to notify the FDPIC of any breach of data security likely to lead to a high risk to the data subject's personality or fundamental rights as quickly as possible. The notification must at least specify the nature of the breach, its consequences and the measures taken or planned. Processors must notify the controller of breaches as quickly as possible. The controller must inform data subjects if required for their protection or if the FDPIC requests it.

Rights of the data subject

Article 25 gives any person the right to request information from the controller on whether personal data relating to them is being processed. The data subject is entitled to the information necessary to exercise rights and guarantee transparent processing, including the controller's identity and contact details, the processed personal data, purpose, retention period or criteria, available source information, automated individual decision information and recipients or categories of recipients.

Article 26 permits refusal, restriction or delay of information where a formal law provides for it, overriding third-party interests require it, or the request is obviously unjustified. Private controllers may also restrict information where their own overriding interests require it and they do not intend to disclose the data to third parties. Federal bodies may restrict information for overriding public interests or where disclosure could compromise investigations or proceedings.

Article 28 creates a right to data portability. A data subject may request personal data they have disclosed to the controller in a conventional electronic format where the controller processes the data by automated means and the processing is based on consent or is directly connected with the conclusion or performance of a contract. The data subject may also request transfer to another controller if technically feasible without disproportionate effort.

Private-sector personality rights and remedies

For private persons, Article 30 prohibits unlawful breaches of data subjects' personality rights. A breach may arise in particular where personal data is processed contrary to Articles 6 and 8, processed contrary to the express wishes of the data subject, or where sensitive personal data is disclosed to third parties.

Article 31 provides grounds of justification. A breach of personality rights is unlawful unless justified by the data subject's consent, an overriding private or public interest, or law. The Act lists examples of overriding interests, including contract-related processing, certain competition-related processing, creditworthiness checks subject to strict conditions, editorial publication, research or statistics where safeguards apply, and processing public-figure data relating to public activities.

Article 32 links remedies to the Swiss Civil Code. A data subject may request correction of incorrect personal data, and may seek orders prohibiting a processing activity, prohibiting disclosure to third parties, or requiring deletion or destruction of personal data. Where accuracy cannot be established, the data may be marked as disputed.

FDPIC investigations and penalties

The FDPIC may open an investigation ex officio or in response to a report where there are sufficient indications that a data processing activity could violate data protection regulations. The controller or private person must provide the information and documents required for the investigation. If duties to cooperate are not met, the FDPIC may order access to information, documents, processing records and personal data, access to premises and installations, witness questioning and expert appraisals.

If data protection regulations have been violated, the FDPIC may order processing to be modified, suspended or terminated, personal data to be deleted or destroyed, and overseas disclosure to be delayed or prohibited where transfer requirements are not met. The FDPIC may also require information, DPIAs, consultation, breach information, data subject information and appointment of a Swiss representative.

The FADP contains criminal penalties. Private persons may be fined up to CHF 250,000 for specified wilful violations, including breaches of information duties, right-to-information duties, cooperation duties, certain overseas disclosures, unlawful processor assignment, failure to meet minimum data security requirements, breach of professional confidentiality and failure to comply with FDPIC rulings.