Contents Knowledge map

Before you read

This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.

Switzerland

Open in Knowledge map

Sources last checked:

Switzerland’s Federal Act on Data Protection, the FADP, has applied in its current form since 1 September 2023.1 It is enforced by the Federal Data Protection and Information Commissioner, the FDPIC.2

At a glance

Question Answer
Main law Federal Act on Data Protection (SR 235.1)
Report a breach to the regulator As quickly as possible, when it is likely to create a high risk3
Highest fine 250,000 francs, on the individual responsible4

Who it covers

It applies to situations that have an effect in Switzerland, even if they start abroad.5 Private organisations abroad that process data about people in Switzerland may have to appoint a representative there.6

The basic rules

Data must be handled lawfully, in good faith and proportionately, and collected for a purpose the person can recognise. It must be destroyed or anonymised once it is no longer needed, and kept accurate.7

Your rights

Right What it lets you do
Information8 Be told when your data is collected
Access9 Ask whether your data is processed, and see it
Portability10 Receive data you provided in a common electronic format, in some cases
Correction11 Have wrong data corrected
Automated decisions12 Be told about a decision made solely by a machine, give your view and ask for a person to review it, with some exceptions

Beyond these, you can go to the civil courts to protect your personality, including to stop a particular processing.11

When data is breached

An organisation must tell the FDPIC as quickly as possible about a breach likely to create a high risk, and tell the people affected if that is needed to protect them or the FDPIC asks.3

Sending data abroad

Data may go abroad if the Federal Council has found that place adequate, or if appropriate safeguards are in place.13

Fines

Swiss fines work differently from the GDPR’s. They are criminal, reach 250,000 francs and fall on the person responsible, for deliberate breaches of specific duties.41415 Where the fine would be 50,000 francs or less and finding that person would be disproportionate, the business may be fined instead.16

References

  1. FADP, Article 74: Referendum and commencement ↩

  2. FADP, Article 49: Investigation by the FDPIC ↩

  3. FADP, Article 24: Notifications of data security breaches ↩ ↩2

  4. FADP, Article 60: Violation of the duty to provide information ↩ ↩2

  5. FADP, Article 3: Territorial scope ↩

  6. FADP, Article 14: Representative ↩

  7. FADP, Article 6: Principles ↩

  8. FADP, Article 19: Duty to provide information ↩

  9. FADP, Article 25: Right to information ↩

  10. FADP, Article 28: Right to data portability ↩

  11. FADP, Article 32: Legal rights ↩ ↩2

  12. FADP, Article 21: Automated individual decisions ↩

  13. FADP, Article 16: Principles for cross-border disclosure ↩

  14. FADP, Article 61: Violation of duties of care ↩

  15. FADP, Article 63: Disregard of decisions ↩

  16. FADP, Article 64: Corporate criminal liability ↩