The Federal Act on Data Protection of 25 September 2020 (Data Protection Act, FADP, SR 235.1) is the Swiss data protection act. It governs how private persons and federal bodies may process the personal data of natural persons, and it has been in force since 1 September 2023. Its German title is "Bundesgesetz über den Datenschutz" (DSG), its French title "Loi fédérale sur la protection des données" (LPD).

For SMEs this means:

• Almost every business is covered. The FADP has no turnover or size threshold. Anyone who processes data about customers, employees, job applicants or contact persons at suppliers falls within its scope.
• Not every obligation applies to every business. The processing principles, data security, the duty to provide information and the right of access apply to everyone. The record of processing activities, the data protection impact assessment and the notification to the FDPIC depend on size, type of data and risk.
• Consent is not the default. Private persons may process personal data as long as they observe the principles. They only need a ground for justification if the processing breaches personality rights (Art. 30 and 31 FADP).
• Fines are imposed on individuals, but only in specific cases. Fines of up to CHF 250,000 require wilful conduct and one of the offences in Art. 60 to 63 FADP. Not every infringement is a criminal offence.
• The FADP has no 72-hour deadline. Data security breaches that are likely to lead to a high risk must be notified to the FDPIC "as quickly as possible" (Art. 24 FADP).

This guide puts the obligations into context, names the concrete action and suitable evidence for each of them, and works through them using a hypothetical SME. It reflects the law as at 30 September 2026. It is general guidance and does not replace legal advice in the individual case.

The FADP aims to protect the personality and fundamental rights of natural persons whose personal data is processed (Art. 1 FADP). It no longer protects the data of legal entities. That was different under the previous act.

History. The Federal Assembly adopted the fully revised FADP on 25 September 2020. The Federal Council brought it into force on 1 September 2023, together with the Data Protection Ordinance (DPO, SR 235.11) and the Ordinance on Data Protection Certification (SR 235.13). It replaces the Data Protection Act of 19 June 1992, which had applied since 1 July 1993. Transitional provisions exist only for specific points (Art. 69 et seq. FADP).

Names and abbreviations. "FADP" is the abbreviation of the English translation published by the Confederation. The official abbreviations are "DSG" in German and "LPD" in French. Labels such as "new" or "revised" date from the transition period and are obsolete: since 1 September 2023 there has been only one act. English is not an official language of the Confederation, so the translation has no legal force. In this guide, "DPO" always means the Data Protection Ordinance (German: DSV), not a person.

Key terms (Art. 5 FADP).

• Personal data: any information relating to an identified or identifiable natural person.
• Sensitive personal data: among other things, data relating to religious, philosophical, political or trade union-related views, to health, the private sphere, race or ethnicity, genetic data, biometric data that uniquely identifies a person, data relating to administrative and criminal proceedings or sanctions, and data relating to social assistance measures.
• Processing: any handling of personal data, from collection and storage to deletion.
• Disclosure: transmitting personal data or making it accessible.
• Controller: whoever determines, alone or jointly with others, the purpose and the means of processing.
• Processor: whoever processes personal data on behalf of the controller.
• High-risk profiling: profiling that, by matching data, allows an assessment of essential aspects of a person's personality.

Structure. For private businesses, these parts matter most: principles and general obligations (Art. 6 to 13 FADP), disclosure abroad (Art. 16 to 18 FADP), duties to inform, assess and notify (Art. 19 to 24 FADP), rights of data subjects (Art. 25 to 29 FADP), breaches of personality rights and justification (Art. 30 to 32 FADP), supervision by the FDPIC (Art. 49 to 53 FADP) and criminal provisions (Art. 60 to 66 FADP).

Special legislation. Sector-specific law can supplement the FADP or take precedence over it, for example in financial market, social insurance, health or telecommunications law. In employment relationships, Art. 328b of the Code of Obligations limits processing to data that concern the employee's suitability for the job or are necessary for the performance of the employment contract.

The FADP applies to private persons (companies, associations, foundations, individuals) and to federal bodies that process the personal data of natural persons (Art. 2 FADP). Territorially, it covers circumstances that have an effect in Switzerland, even if they were initiated abroad (Art. 3 para. 1 FADP).

In practice this concerns:

• Swiss SMEs and sole proprietorships that process employee, customer, supplier or website data.
• Groups of companies with intra-group data flows. The FADP has no general group privilege; only individual provisions provide relief for group companies (for example Art. 20 para. 4 and Art. 26 para. 3 FADP).
• Foreign companies whose processing has an effect in Switzerland, such as online retailers or SaaS providers with customers in Switzerland.
• Federal bodies. Cantonal and communal authorities are subject to cantonal data protection law.

Exceptions. The FADP does not apply, among other things, to personal data that a natural person processes exclusively for personal use (Art. 2 para. 2 let. a FADP). There is no de minimis threshold for small businesses. Relief exists only for specific points, above all the record of processing activities.

Representative in Switzerland. Private controllers with their registered office abroad must appoint a representative in Switzerland if they process data of persons in Switzerland and four requirements are met together: the processing is connected with an offer of goods or services or the monitoring of behaviour in Switzerland, it is on a large scale, it is carried out regularly, and it poses a high risk to the personality of the data subjects (Art. 14 FADP).

FADP and GDPR side by side. A Swiss company that offers goods or services to persons in the EU or monitors their behaviour is additionally subject to the GDPR for that processing (Art. 3 para. 2 GDPR). The differences are summarised in the section "FADP and GDPR" below.

The following table assigns to each obligation its legal basis, the condition for its application, a concrete action, evidence and an internal role. The links lead to the English translation of the consolidated text on Fedlex.

Three notes on reading the table:

• Applicability. The column "When it applies" is decisive. Several obligations only apply under certain conditions.
• Evidence. The FADP has no general accountability obligation of the kind found in Art. 5 para. 2 GDPR. Documentation is prescribed only for specific points. The table therefore marks what is "Mandatory" and what is "Recommended". Recommended evidence is still useful: in an investigation, the FDPIC can demand information and documents (Art. 49 para. 3 FADP).
• Role. Legally, the company remains responsible as the "controller". The last column is a suggestion for internal responsibility. The FADP does not prescribe any particular organisation for private businesses.

The following sections explain the individual obligations, their exceptions and their limits.

Principles (Art. 6 FADP). Personal data must be processed lawfully, in good faith and proportionately. It may only be collected for a specific purpose that the data subject can recognise and may only be processed in a manner compatible with that purpose. Anyone who processes data must satisfy themselves that the data is accurate.

Deletion instead of fixed periods. The FADP does not set fixed retention periods. Personal data is destroyed or anonymised as soon as it is no longer required for the purpose of processing (Art. 6 para. 4 FADP). How long that is depends on the purpose and, where applicable, on another statute. One example of a statutory retention duty: accounting records and accounting vouchers must be retained for ten years (Art. 958f of the Code of Obligations).

Justification only where personality rights are breached. Unlike the GDPR, the FADP does not require private persons to have a legal basis for every processing activity. A breach of personality rights arises in particular if personal data is processed contrary to the principles of Art. 6 and 8 FADP or contrary to the express wishes of the data subject, or if sensitive personal data is disclosed to third parties (Art. 30 para. 2 FADP). Such a breach is unlawful unless it is justified by consent, by an overriding private or public interest, or by law (Art. 31 para. 1 FADP).

Consent. Where consent is required, it must be given voluntarily, on the basis of appropriate information and for one or more specific instances of processing. It must be explicit for the processing of sensitive personal data and for high-risk profiling by a private person (Art. 6 para. 6 and 7 FADP).

Privacy by design and by default (Art. 7 FADP). The controller designs the processing, from the planning stage, technically and organisationally in such a way that the data protection rules are complied with. Default settings must limit the processing to the minimum required for the purpose, unless the data subject decides otherwise. Art. 7 FADP does not apply to processing that began before 1 September 2023, as long as the purpose remains unchanged and no new data is collected (Art. 69 FADP).

Controllers and processors guarantee a level of data security appropriate to the risk by taking suitable technical and organisational measures (Art. 8 FADP). The law does not require any particular technology or a certification.

Approach under the DPO. First determine the need for protection of the data, then the risk, then define the measures. The state of the art and the implementation costs must also be taken into account (Art. 1 DPO). The measures must achieve four goals: confidentiality, availability, integrity and traceability (Art. 2 DPO). Art. 3 DPO sets out control objectives for this, such as data access control, premises access control and user control, restoration, system security, and the detection and rectification of breaches.

Ongoing review. The need for protection, the risk and the measures must be reviewed over the entire processing period and adjusted where necessary (Art. 1 para. 5 DPO). A one-off stocktake is not enough.

Additional duties only where the risk is elevated. Private controllers must log at least the storage, alteration, disclosure, deletion and destruction of the data and any access to it if they process a large volume of sensitive personal data by automated means or carry out high-risk profiling and preventive measures are unable to guarantee data protection. The log files must be retained for at least one year, separately from the system in which the data is processed (Art. 4 DPO). Under the same basic conditions, processing regulations for automated processing must be issued (Art. 5 DPO). Anyone who neither processes a large volume of sensitive personal data nor carries out high-risk profiling is not subject to these additional duties.

Criminal liability. Anyone who wilfully fails to comply with the minimum requirements for data security can be fined on complaint (Art. 61 let. c FADP).

Recommendation. The FDPIC's documentation includes a guide to technical and organisational measures. If you already run an information security management system, for example under ISO/IEC 27001, you can reuse its risk assessment and measures as evidence for Art. 8 FADP. A certification does not replace the data protection assessment.

The processing of personal data may be assigned to a processor by contract or by legislation. The conditions are that the data is processed only in the manner in which the controller itself would be permitted to process it, and that no statutory or contractual duty of confidentiality prohibits the assignment (Art. 9 para. 1 FADP).

Duties of the controller. The controller must in particular satisfy itself that the processor is able to guarantee data security (Art. 9 para. 2 FADP). How deep this check goes depends on the risk. More is to be expected for a payroll provider than for a newsletter service without sensitive content.

Sub-processors. The processor may only assign the processing to a third party with the prior approval of the controller (Art. 9 para. 3 FADP). The approval may be specific or general. In the case of a general approval, the processor must inform the controller of any planned change, and the controller may object (Art. 7 DPO).

Form and content. The FADP prescribes neither a form nor minimum content for the contract. In this it differs from Art. 28 para. 3 GDPR. A contract in text form is recommended, covering the subject matter, the binding nature of instructions, security measures, sub-processors, notification of breaches, support with access requests and return or deletion at the end of the contract. If you are also subject to the GDPR, align the contract with Art. 28 GDPR and add the Swiss references.

Criminal liability. Anyone who wilfully assigns processing to a processor without the requirements of Art. 9 para. 1 and 2 FADP being met can be fined on complaint (Art. 61 let. b FADP).

Delimitation. Not every service provider is a processor. Whoever determines the purpose and means itself, such as a bank, an insurer or a law firm acting on its own mandate, is as a rule a controller in its own right. What matters is the actual role, not the label in the contract.

Controllers and processors each maintain a record of their processing activities (Art. 12 para. 1 FADP). It is the overview on which almost all other obligations build.

Minimum content for controllers (Art. 12 para. 2 FADP).

• the identity of the controller
• the purpose of processing
• the categories of data subjects and the categories of processed personal data
• the categories of recipients
• if possible, the retention period or the criteria for determining it
• if possible, a general description of the data security measures
• for disclosure abroad, the State concerned and the guarantees under Art. 16 para. 2 FADP

Processors keep a leaner record with information on their own identity and that of the controller, on the categories of processing carried out on behalf of the controller, and on data security and disclosure abroad (Art. 12 para. 3 FADP).

Exemption for SMEs (Art. 24 DPO). Undertakings and other private organisations employing fewer than 250 employees on 1 January of a year, and natural persons, are exempt from the obligation. The exemption does not apply if one of the following requirements is met:

• A large volume of sensitive personal data is being processed.
• High-risk profiling is being carried out.

Limits of the exemption. Neither the Act nor the Ordinance defines when a "large volume" exists. It has to be assessed in the individual case. A medical practice, a care home or a staffing agency should examine the exemption more critically than a trades business. In addition, the exemption only concerns the record. All other obligations, in particular the duty to provide information and the right of access, continue to apply.

Form and notification. The law does not prescribe a form. A spreadsheet is enough. Private persons do not have to notify the FDPIC of their record; that duty exists only for federal bodies (Art. 12 para. 4 FADP).

Recommendation. Exempt SMEs also benefit from a lean record. The same information is needed for the privacy notice, for access requests and for assessing an incident. You will find a completed example in the worked example below.

The controller informs the data subject appropriately about the collection of personal data. This also applies if the data is not collected from the data subject (Art. 19 para. 1 FADP). The usual instrument is the privacy notice, supplemented by information in the application, employment and contract process.

Statutory minimum information (Art. 19 para. 2 to 4 FADP).

• the identity and contact details of the controller
• the purpose of processing
• where applicable, the recipients or categories of recipients
• for indirect collection, additionally the categories of processed personal data
• for disclosure abroad, the State or international body and, where applicable, the guarantees under Art. 16 para. 2 FADP or the exception applied under Art. 17 FADP

Beyond this, the controller must provide the information required for the person to exercise their rights and to guarantee transparent processing. What that means depends on the specific processing.

Timing. For direct collection, the information is due at the time of collection. If the data is not collected from the data subject, it is due no later than one month after the data has been received or, if earlier, at the time the data is disclosed to third parties (Art. 19 para. 5 FADP).

Form. The information must be precise, transparent, comprehensible and easily accessible (Art. 13 DPO). The law does not prescribe a particular form. A stand-alone privacy notice is recommended, linked where data is collected, that is, directly next to the form and not only in the page footer.

Exceptions (Art. 20 FADP). The duty does not apply, among other things, if the person already has the information, the processing is provided for by law or the controller is subject to a statutory duty of confidentiality. For indirect collection it also does not apply if providing the information is impossible or requires disproportionate effort. Private controllers may further restrict the information if their own overriding interests so require and they do not disclose the data to third parties.

Automated individual decisions (Art. 21 FADP). If a decision is based exclusively on automated processing and has a legal consequence for the person or a considerable adverse effect on them, the person must be informed. They may state their point of view and request that the decision be reviewed by a natural person. Exceptions apply if the decision is directly connected with a contract with the person and their request is granted, and in the case of explicit consent.

Voluntary additions. Art. 19 FADP does not expressly require information on legal bases, retention periods and data subject rights. It is nevertheless common to include it, because it creates transparency and because the GDPR requires it where it applies.

Cookies and similar technologies. Telecommunications law applies here in addition: processing data on external equipment is only permitted if users are informed about the processing and its purpose and are informed that they may refuse it (Art. 45c let. b of the Telecommunications Act). The FDPIC has published a guide on this.

Criminal liability. Anyone who wilfully fails to provide information under Art. 19 para. 1 or Art. 21 para. 1 FADP, or to supply the details under Art. 19 para. 2 FADP, can be fined on complaint (Art. 60 para. 1 let. b FADP).

Disclosure covers transmitting personal data and making it accessible (Art. 5 let. e FADP). A disclosure abroad can therefore already exist if a recipient abroad is able to access the data. This concerns cloud services with data centres abroad as well as support access by a foreign group company. The law provides for a three-step test.

Step 1: State with adequate protection (Art. 16 para. 1 FADP). The Federal Council determines which States guarantee an adequate level of protection. The list is in Annex 1 of the DPO. It includes, among others, the EU and EEA States and the United Kingdom. For Canada and the United States, adequacy applies only to a limited extent. The current version is always decisive.

United States. Since 15 September 2024 the United States has been on the list, but only for personal data processed by organisations certified under the Swiss-US Data Privacy Framework. For non-certified US recipients, a guarantee under step 2 or an exception under step 3 is required.

Step 2: appropriate guarantees (Art. 16 para. 2 FADP). Without an adequacy decision, disclosure is permitted if an appropriate level of data protection is guaranteed by:

• a treaty under international law
• data protection clauses in an individual contract, notified to the FDPIC beforehand
• specific guarantees drawn up by a federal body
• standard data protection clauses that the FDPIC has approved, issued or recognised beforehand
• binding corporate rules approved in advance by the FDPIC or by the data protection authority of a State with adequate protection

The standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914) are frequently used. The FDPIC recognises them subject to the proviso that they are adapted or supplemented where necessary in the specific case. Their use does not have to be notified to the FDPIC.

Clauses alone are not always enough. Anyone using standard data protection clauses must take appropriate measures to ensure that the recipient complies with them (Art. 10 para. 1 DPO). According to the FDPIC's guidance, it must be checked whether the law of the recipient State allows the recipient to meet its obligations. If that law permits disproportionate access by authorities, supplementary technical measures may be necessary. This check is often called a "transfer impact assessment". The term does not come from the FADP.

Step 3: exceptions (Art. 17 FADP). Without adequacy and without a guarantee, disclosure is permitted, among other cases, if the data subject has explicitly consented, if the disclosure is directly connected with the conclusion or performance of a contract with the data subject or in their interest, or if it is necessary for the enforcement of legal claims before a foreign authority. Recommendation: base permanent, systematic disclosures, such as operating a cloud system, on step 1 or 2 and not on an exception.

Not a disclosure abroad: publishing personal data on the internet to inform the public, even if it can be retrieved from abroad (Art. 18 FADP).

Follow-on duties. The State and the guarantees belong in the record (Art. 12 para. 2 let. g FADP) and in the information given to data subjects (Art. 19 para. 4 FADP).

Criminal liability. Anyone who wilfully discloses personal data abroad in violation of Art. 16 para. 1 and 2 FADP and without an exception under Art. 17 FADP can be fined on complaint (Art. 61 let. a FADP).

The data protection impact assessment (DPIA) is a prior risk analysis. The controller must carry it out if planned processing is likely to result in a high risk to the personality or fundamental rights of the data subjects (Art. 22 para. 1 FADP). Everyday processing such as customer administration or payroll on a normal scale does not, as a rule, trigger a DPIA. The assessment in the individual case is decisive.

When is there a high risk? It depends, in particular when new technologies are used, on the nature, extent, circumstances and purpose of the processing. By law, a high risk exists for large-scale processing of sensitive personal data and for systematic large-scale monitoring of public areas (Art. 22 para. 2 FADP). The FDPIC's fact sheet names further indicators, such as profiling that allows an assessment of essential aspects of personality, automated individual decisions and relationships of subordination between the controller and the data subjects.

Preliminary check. According to the FDPIC's fact sheet, where high risks are possible a summary preliminary check must be carried out early and its result documented. If the result is not clear, the FDPIC recommends carrying out the DPIA. The Act itself does not expressly mention the preliminary check.

Content (Art. 22 para. 3 FADP). A description of the planned processing, an evaluation of the risks and the measures to protect personality and fundamental rights.

Exceptions. Private controllers do not have to carry out a DPIA if they are required by law to process the data (Art. 22 para. 4 FADP). They may dispense with it if they use a system, product or service that is certified for the intended use, or comply with a code of conduct that meets the requirements of Art. 22 para. 5 FADP. Art. 22 and 23 FADP do not apply to unchanged processing that began before 1 September 2023 (Art. 69 FADP).

Consultation (Art. 23 FADP). If the DPIA shows that a high risk remains despite the planned measures, the opinion of the FDPIC must be obtained beforehand. The FDPIC communicates its objections within two months; for complex processing, the period can be extended by one month. The FDPIC charges private persons a fee for the consultation (Art. 59 para. 1 let. c FADP). Private controllers may dispense with the consultation if they have consulted a data protection advisor who meets the requirements of Art. 10 para. 3 FADP.

Retention. The DPIA must be retained for at least two years after the processing has ended (Art. 14 DPO).

Relationship to the GDPR. A data protection impact assessment under Art. 35 GDPR can as a rule be used as a basis. The Swiss particularities must be added, such as the broader catalogue of sensitive personal data and the rules on disclosure abroad.

A breach of data security is a breach of security that leads to the accidental or unlawful loss, deletion, destruction or modification of personal data, or to its unauthorised disclosure or access (Art. 5 let. h FADP). Not every breach has to be notified.

Duty to notify only where a high risk is likely. The controller notifies the FDPIC of a breach that is likely to lead to a high risk to the personality or fundamental rights of the data subjects (Art. 24 para. 1 FADP). Breaches below this threshold do not have to be notified. The FDPIC accepts voluntary notifications.

Deadline: "as quickly as possible". The FADP does not set a deadline in hours or days. Swiss law has no general 72-hour deadline. According to the FDPIC's guide, however, the controller may not wait for lengthy investigations that would confirm or rule out the high risk beyond doubt. According to the FDPIC, in the case of ransomware attacks a likely high risk will, depending on the circumstances, have to be assumed in an initial analysis. Missing details can be supplied later (Art. 15 para. 2 DPO).

Content of the notification (Art. 15 para. 1 DPO). The form of the breach; where possible the time and duration, the categories and approximate amount of personal data and number of data subjects concerned; the consequences, including risks; the measures taken or planned; the name and contact details of a contact person. The FDPIC provides the DataBreach portal for this purpose, which requests these details in a structured way and confirms the time of the notification.

Processors. They notify the controller of every breach of data security as quickly as possible, irrespective of the risk (Art. 24 para. 3 FADP). The notification to the FDPIC remains a matter for the controller.

Informing the data subjects. This is necessary if it is required for their protection or if the FDPIC so requests (Art. 24 para. 4 FADP), for example so that they can change passwords or block means of payment. The information can be limited, delayed or dispensed with under the conditions of Art. 24 para. 5 FADP, for instance if it is impossible, requires disproportionate effort or is equally guaranteed by a public announcement.

Documentation. The controller must document the breaches, including the facts, the effects and the measures taken, and retain the documentation for at least two years from the notification (Art. 15 para. 4 DPO). It is recommended to also record incidents that were not notified, together with the reasons for the decision.

Consequences of failing to notify. Failure to notify is not listed in the criminal provisions of the FADP. The FDPIC can, however, order the notification (Art. 51 para. 3 let. f FADP); wilful disregard of such a ruling is punishable (Art. 63 FADP). A notification may only be used in criminal proceedings against the person required to notify with that person's consent (Art. 24 para. 6 FADP).

Other notification duties remain reserved. Anyone who is also subject to the GDPR notifies the competent EU supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless it is unlikely to result in a risk (Art. 33 GDPR). Operators of critical infrastructures have been subject to a separate duty to report cyberattacks since 1 April 2025. Persons and entities supervised by FINMA must immediately report to it any incident that is of substantial importance to the supervision (Art. 29 para. 2 FINMASA). These duties have their own thresholds and deadlines.

Right of access (Art. 25 FADP). Any person may request information on whether personal data relating to them is being processed. In every case the following must be provided: the identity and contact details of the controller, the processed personal data as such, the purpose of processing, the retention period or the criteria for it, the available information on the origin of the data, where applicable the existence of an automated individual decision and the logic behind it, and where applicable the recipients and the information on disclosure abroad. The Fedlex translation calls this the "right to information".

Deadline and form. The information must be provided within 30 days of receipt of the request. If that is not possible, the controller must notify the person and state how long it will take. A refusal, restriction or deferral must be communicated within the same 30 days (Art. 25 para. 7 FADP, Art. 18 DPO). The request must be made in writing, which can be done electronically; verbally only if the controller agrees. The controller must take appropriate measures to identify the person (Art. 16 DPO).

Costs. The information is free of charge. Only where the effort is disproportionate may a contribution of no more than CHF 300 be required, and the person must be told the amount in advance (Art. 19 DPO).

Restrictions (Art. 26 FADP). The information may be refused, restricted or delayed if a formal law so provides, if overriding interests of third parties so require, or if the request is obviously unjustified or clearly frivolous. Private controllers may additionally rely on their own overriding interests, provided they do not disclose the data to third parties. The reason must be stated.

Data portability (Art. 28 FADP). A person may request the data they have disclosed to the controller in a conventional electronic format if it is processed by automated means and on the basis of their consent or in direct connection with a contract.

Correction, deletion and objection. Incorrect personal data must be corrected on request (Art. 32 para. 1 FADP). The FADP does not formulate a stand-alone "right to erasure" like Art. 17 GDPR. Deletion follows from the principles (Art. 6 para. 4 FADP) and from the legal claims for the protection of personality (Art. 32 para. 2 FADP). If a person expressly objects to processing, continued processing needs a ground for justification (Art. 30 para. 2 let. b and Art. 31 FADP). Where a statutory retention duty exists, continued retention is justified by law (Art. 31 para. 1 FADP).

Criminal liability. Anyone who wilfully provides false or incomplete information when responding to an access request can be fined on complaint (Art. 60 para. 1 let. a FADP).

Private controllers may appoint a data protection advisor (German: Datenschutzberaterin or Datenschutzberater; the Fedlex translation uses "data protection officer"). The appointment is voluntary. Only federal bodies are obliged to appoint one (Art. 25 DPO).

Tasks (Art. 10 para. 2 FADP). The advisor is the contact point for data subjects and data protection authorities, trains and advises the controller and participates in the application of the data protection rules. Responsibility for lawful processing remains with the company.

Advantage for the DPIA. If, after an impact assessment with a remaining high risk, you consult the data protection advisor, you do not have to consult the FDPIC (Art. 23 para. 4 FADP). Four requirements must be met for this (Art. 10 para. 3 FADP):

• professional independence from the controller, without being bound by instructions
• no activities that are incompatible with the role
• the necessary professional knowledge
• publication of the contact details and notification to the FDPIC, which operates a reporting portal for this purpose

Duties of the company (Art. 23 DPO). It provides the necessary resources, grants access to the information and documents required, and gives the advisor the right to inform the highest management or governing body in important cases.

Internal or external. Both are permitted. The FDPIC considers an incompatibility possible, for example, if the person is a member of the executive board or performs functions in personnel management or the administration of information systems. In small businesses this separation is often hard to achieve internally. That speaks in favour of an external solution, but it is a judgement call and not a legal requirement.

Delimitation from the GDPR. Anyone subject to the GDPR must designate a data protection officer in the cases of Art. 37 GDPR. Both functions can be performed by the same person if that person meets the requirements of both regimes.

SIDD takes on the mandate as external data protection advisor under Art. 10 FADP for Swiss SMEs and for international groups with a connection to Switzerland.

The FADP contains criminal provisions, not administrative fines against companies. Three points need to be made clear at the outset:

• Not every infringement is a criminal offence. Only the conduct described in Art. 60 to 63 FADP is punishable. A breach of the processing principles, a missing record, an omitted impact assessment or an omitted notification to the FDPIC are not among them. Such infringements can, however, trigger administrative measures by the FDPIC and civil claims.
• Only wilful conduct is punishable. All offences require wilful action.
• Management is not automatically liable. The natural person who committed the act is punished. That can be an employee, a project manager or a member of the executive board.

The offences.

In all cases the fine is at most CHF 250,000.

Who is punished? (Art. 64 FADP) For offences committed in businesses, Art. 6 and 7 of the Federal Act on Administrative Criminal Law (ACLA; German text: VStrR) apply. Under these, the natural person who committed the act is liable. In addition, Art. 6 para. 2 and 3 ACLA covers business principals, employers and corporate bodies who, in breach of a legal duty, fail to prevent an offence by subordinates, agents or representatives. Whether a member of the executive board is liable therefore depends on their specific role, their duties and their knowledge. The law does not provide for automatic personal liability of every member of management.

Fine against the company. If a fine of no more than CHF 50,000 is under consideration and identifying the person liable would require disproportionate investigative effort, the authority may instead order the business to pay the fine (Art. 64 para. 2 FADP).

Jurisdiction and limitation. Prosecution and adjudication are a matter for the cantons. The FDPIC does not impose fines itself, but it can file a complaint and exercise the rights of a private claimant in the proceedings (Art. 65 FADP). The right to prosecute is subject to a limitation period of five years (Art. 66 FADP).

What this means in practice. Clear responsibilities and traceable decisions do not protect against every allegation. They do show that obligations were recognised and deliberately implemented, and they prevent the typical situations of wilful conduct, such as knowingly omitting the privacy information.

The Federal Data Protection and Information Commissioner (FDPIC; German: EDÖB) supervises the application of the federal data protection rules by private persons and federal bodies (Art. 4 FADP). Its seat is in Bern (Feldeggweg 1, 3003 Bern).

Investigation (Art. 49 FADP). The FDPIC opens an investigation ex officio or in response to a report if there are sufficient indications that a processing activity could violate data protection rules. It may refrain from doing so if the violation is of minor importance. The company concerned must provide the necessary information and documents.

Powers (Art. 50 FADP). If the company fails to cooperate, the FDPIC can order, among other things, access to documents, records of processing activities, personal data and premises, as well as the questioning of witnesses. Professional secrecy remains reserved.

Administrative measures (Art. 51 FADP). If data protection rules have been violated, the FDPIC can order that the processing be modified, suspended or terminated and that personal data be deleted. It can delay or prohibit disclosure abroad and can order, among other things, that an impact assessment be carried out, a breach be notified or access be granted. If the company has restored compliance during the investigation, the FDPIC may confine itself to issuing a warning.

Procedure. The investigation and the rulings are governed by the Administrative Procedure Act (Art. 52 FADP). Rulings of the FDPIC can be contested before the Federal Administrative Court.

Advice and working tools. The FDPIC informs and advises private persons and publishes guides, fact sheets and reporting portals (Art. 58 FADP). These documents are recommendations of good practice and are not legally binding. They do show how the supervisory authority understands the law. For certain services, including advice and the consultation on an impact assessment, the FDPIC charges private persons fees (Art. 59 FADP).

The FADP follows the European General Data Protection Regulation (GDPR) in many respects, but differs clearly in concept and sanctions. Anyone subject to both regimes must check each obligation under both.

Data flows between Switzerland and the EU. By Decision 2000/518/EC, the European Commission found that Switzerland provides an adequate level of protection. In its report of 15 January 2024 it concluded that Switzerland continues to provide an adequate level of protection. Conversely, Switzerland lists the EU and EEA States in Annex 1 of the DPO.

You will find more on the European requirements in the GDPR guide.

The following example is entirely fictitious. "Muster Haustechnik AG" does not exist ("Muster" is German for "sample"); figures, providers and decisions serve only as illustration. The assessments cannot be transferred to other companies without examining the individual case.

Starting position

Muster Haustechnik AG installs heating and plumbing systems for private and business customers in German-speaking Switzerland. It has 45 employees.

• Contact form: Interested persons enter their name, email, phone number, property address and request on the website.
• Cloud CRM: Enquiries, quotes and customer contacts are managed in CRM software provided as a cloud service. The contracting party is a company in Ireland. The data is held in data centres in the EU. For support in exceptional cases, the provider's US parent company can access the data.
• Payroll: A fiduciary firm in Switzerland runs the payroll on the instructions of Muster Haustechnik AG. It uses payroll software with data storage in Switzerland.

Internally, the head of administration is designated as data protection coordinator. IT is looked after by an external partner together with an internal IT lead.

Classification. The company is the controller. The CRM provider and the fiduciary firm process data on its behalf and are processors in this example. The company has fewer than 250 employees, does not carry out high-risk profiling and processes sensitive personal data only occasionally, for instance medical certificates. It therefore assumes that the exemption in Art. 24 DPO applies, records this decision in writing and voluntarily keeps a lean record. According to the documented preliminary check, a data protection impact assessment is not necessary.

Example entry in the record of processing activities

Supplier review

The data protection coordinator reviews both providers using the same questions and files the result with the contract.

Result in the example: both providers are approved. The review is repeated when there are material changes, for instance a new sub-processor.

Check of the privacy information

The coordinator compares the existing privacy notice with the minimum information.

Escalation decision for an incident

The company has defined a simple sequence: contain, establish the facts, assess the risk, decide, document. The table shows it using two invented incidents.

Whether there is a high risk must always be assessed in the individual case. In case of doubt, where a high risk cannot be ruled out with sufficient probability, the FDPIC's guide says that the notification must not be delayed.

The checklist leads in twelve steps from taking stock to ongoing operation. The column "Classification" shows whether the step implements a legal obligation or is a voluntary improvement. The responsibilities are suggestions and should be adapted to your own organisation.

Order. Steps 1 to 4 create overview and order. Steps 5 to 8 concern the areas in which wilful infringements can be criminal offences: information, processors, disclosure abroad and data security. Steps 9 to 12 secure ongoing operation.

Limits. The checklist does not lead to a "certification" and does not guarantee legal compliance. It helps to work through the obligations systematically. Sector-specific law and the GDPR can require additional steps.

What is the official name of the Swiss data protection act, and since when has it applied? The official German title is "Bundesgesetz über den Datenschutz" (Datenschutzgesetz, DSG, SR 235.1); the English translation is "Federal Act on Data Protection" (FADP). The Federal Assembly adopted it on 25 September 2020, and the Federal Council brought it into force on 1 September 2023. It replaces the Data Protection Act of 1992.

Does the FADP also apply to sole proprietorships and small SMEs? Yes. The FADP has no size threshold. Anyone who processes personal data in the course of business, for instance of customers, supplier contacts or employees, is subject to the Act. The only exception is processing by a natural person exclusively for personal use. Relief exists for specific points, above all the record of processing activities.

How high are the fines, and who is fined? The fine is at most CHF 250,000 and is directed at the natural person who committed the act. Only the conduct described in Art. 60 to 63 FADP is punishable, and only if it is wilful. There is no automatic personal liability of every member of management. The company can be fined instead of the person if a fine of no more than CHF 50,000 is under consideration and identifying the person would be disproportionate.

Does an SME need a data protection advisor? No, for private businesses the appointment under Art. 10 FADP is voluntary. It has a concrete advantage: if, after a data protection impact assessment with a remaining high risk, you consult the data protection advisor, you do not have to consult the FDPIC, provided the requirements of Art. 10 para. 3 FADP are met. Anyone subject to the GDPR may additionally be obliged under Art. 37 GDPR.

Does every data breach have to be notified within 72 hours? No. Under Art. 24 FADP, only data security breaches that are likely to lead to a high risk for the data subjects must be notified, and as quickly as possible. The FADP does not set a deadline in hours. The 72 hours come from Art. 33 GDPR and only apply if the GDPR is also applicable.

Does every SME have to keep a record of processing activities? No. Undertakings with fewer than 250 employees on 1 January of a year are exempt, unless they process a large volume of sensitive personal data or carry out high-risk profiling (Art. 24 DPO). All other obligations still apply. A voluntary, lean record makes it easier to fulfil them.

What is the difference between the FADP and the GDPR? The FADP allows private persons to process data as long as the principles are observed, whereas the GDPR requires a legal basis for every processing operation. The FADP provides for fines of up to CHF 250,000 against natural persons, the GDPR for fines of up to EUR 20 million or, for undertakings, 4 percent of worldwide annual turnover. Under the FADP, data security breaches with a high risk must be notified as quickly as possible; under the GDPR, where feasible within 72 hours.

Who supervises compliance with the FADP? The supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), based in Bern. It can open investigations and order administrative measures, such as the modification or termination of processing. It does not impose fines. Prosecution is a matter for the cantons.

The guide is structured so that you can implement the steps yourself. If you would like a second opinion, relief or a fixed contact person, we can support you.

SIDD is the data protection and InfoSec brand of Priverion GmbH (Baar/ZG), founded in 2017. We take on the mandate as external data protection advisor under Art. 10 FADP for Swiss SMEs and internationally active groups, prepare records, privacy notices, data protection impact assessments and incident playbooks, and support you in FDPIC proceedings. For companies that are also subject to the GDPR, we provide the external EU data protection officer, including the representative under Art. 27 GDPR. For certification under ISO/IEC 27001 we work with CIS Cert (Quality Austria Group) as an accredited certification body.

Talk to our Swiss data protection advisor, write to us via the contact form or read our further specialist articles.

All sources were accessed on 30 September 2026. The current version in the official publication is always decisive. The English texts on Fedlex are translations without legal force; the German, French and Italian versions are authoritative.

Federal law (Fedlex).

• Federal Act on Data Protection (FADP), SR 235.1, status as of 7 July 2025
• Data Protection Ordinance (DPO), SR 235.11, status as of 1 December 2025, with Annex 1 (list of States)
• Ordinance on Data Protection Certification, SR 235.13, status as of 1 September 2023
• Federal Act on Administrative Criminal Law (ACLA, German: VStrR), SR 313.0, Art. 6 and 7, consulted in German
• Code of Obligations (CO), SR 220, Art. 328b and 958f
• Telecommunications Act (TCA), SR 784.10, Art. 45c
• Financial Market Supervision Act (FINMASA), SR 956.1, Art. 29

FDPIC.

• DataBreach reporting portal and guide to the notification of data security breaches under Art. 24 FADP
• Cross-border transfer of personal data, with the recognition of standard data protection clauses and the guide to checking data transfers abroad
• Data protection impact assessment, with fact sheet (status August 2023)
• Data protection officer, with reporting portal
• FAQ on data protection, including on the record of processing activities
• Documentation on data protection, including guides on technical and organisational measures and on cookies and similar technologies, and the fact sheet on the investigation of violations of data protection rules

EU law (EUR-Lex).

• Regulation (EU) 2016/679 (General Data Protection Regulation)
• Commission Decision 2000/518/EC on the adequate protection of personal data provided in Switzerland
• Report from the Commission of 15 January 2024 on the first review of the functioning of the adequacy decisions, COM(2024) 7 final