Swiss FADP

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-04-01 FDPIC may forward breach notifications to the National Cyber Security Centre (Article 24(5bis))
2. 2023-09-01 Revised Federal Act on Data Protection comes into force
3. 2020-09-25 Federal Assembly adopts the revised Federal Act on Data Protection

1. 2025-07-07
   FADP of 25 September 2020 (last amended on 7 July 2025) ErrataCurrent text

   A correction by the Federal Assembly Drafting Committee, published on 7 July 2025, that concerns the Italian text only. source

2. 2025-04-01
   Amended 1 April 2025 Amendment

   New Article 24(5bis), from the Act introducing a reporting obligation for cyberattacks on critical infrastructure: with the controller's consent, the FDPIC may forward a breach notification to the National Cyber Security Centre. source

3. 2023-09-01
   FADP of 25 September 2020 (revised FADP) Major version

   The totally revised Data Protection Act, adopted on 25 September 2020, came into force on 1 September 2023. source

The FADP reaches processing with an effect in Switzerland, including by companies abroad, some of which must appoint a Swiss representative.

Territorial scope

The Act applies to circumstances that have an effect in Switzerland, even if they were initiated abroad (Article 3(1)). source

Swiss representative

Private controllers based abroad must appoint a representative in Switzerland when they process data of persons in Switzerland in connection with offering goods or services or monitoring behaviour there, on a large scale, among other conditions (Article 14). source

Controllers assess high-risk processing themselves and report high-risk data security breaches to the FDPIC as quickly as possible.

Impact assessment

Carry out a data protection impact assessment beforehand where processing is likely to result in a high risk to the data subject's personality or fundamental rights (Article 22). source

Breach notification

Notify the FDPIC as quickly as possible of a data security breach likely to lead to a high risk; processors notify the controller (Article 24). source

Right to information

The information requested by a data subject must in general be provided within 30 days (Article 25(7)). source

The FDPIC investigates and orders administrative measures; intentional offences carry criminal fines of up to CHF 250,000, prosecuted by the cantons.

Investigations

The FDPIC investigates violations and, where it finds one, can impose administrative measures under Article 51. source

Intent only

The offences in Articles 60 to 63 are intentional offences only; there are no criminal penalties for negligent breaches. source

Prosecution

In all cases the cantonal prosecution authorities prosecute these offences. source

1. Law text Federal Act on Data Protection (FADP, SR 235.1) - Fedlex
2. Law text FADP English translation, version of 7 July 2025 (PDF)
3. Guidance New FDPIC's role (FDPIC)
4. Guidance Criminal law (FDPIC)
5. Guidance Factsheet on investigating violations of data protection regulations (FDPIC, October 2024)

1. GDPR

   The EU regulation, with administrative fines on companies of up to 4% of worldwide turnover; the FADP's sanctions are criminal fines aimed mainly at individuals.

2. UK GDPR

   The UK's version of the GDPR, enforced through penalty notices of up to £17.5 million or 4% of worldwide turnover.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to Swiss FADP (RSS)