The revised Swiss Federal Act on Data Protection (FADP) has been in force since 1 September 2023 (Fedlex). A private controller based abroad needs a Swiss representative only if it processes personal data of people in Switzerland in connection with offering goods or services or monitoring their behaviour, and the processing is large-scale, regular and poses a high risk to the data subjects (Art. 14 FADP).
Introduction: A New Era of Data Protection Arrives in Switzerland
Switzerland has ushered in a new era of data protection with the introduction of the new Federal Act on Data Protection (FADP, also abbreviated nFADP). The new legislation replaces the previous law from 1992, reflects the ongoing digital age, and brings Swiss regulations closer to the European Union's General Data Protection Regulation (GDPR). The new law introduces several new requirements that companies must meet to remain compliant.
This article aims to guide companies — especially those encountering the intricacies of data protection for the first time — through the new landscape shaped by the FADP. It outlines the key changes, critical provisions, compatibility with the EU GDPR, and the steps needed to achieve compliance.
Does the Swiss FADP Apply to My Company?
It applies if your data processing has effects in Switzerland, even if the processing starts abroad (Art. 3 FADP). Check whether this is the case for you, for example because you serve customers in Switzerland. Our overview of FADP compliance and the article on Swiss customers and personal liability of German managing directors go into more detail.
Do I Need a Swiss Representative?
Only in specific cases: A private controller with its seat or domicile abroad must appoint a representative in Switzerland if it processes personal data of people in Switzerland, the processing is linked to offering goods or services or to monitoring behaviour in Switzerland, and the processing is large-scale, regular and poses a high risk to the data subjects’ personality (Art. 14 FADP). The representative is the contact point for data subjects and the Federal Data Protection and Information Commissioner (FDPIC), and the controller must publish the representative’s name and address.
What Changed With the Revised FADP?
The revised FADP of 25 September 2020 repealed the Federal Act of 19 June 1992 on Data Protection (Annex 1 FADP) and introduces several new elements. These include:
- Stronger transparency requirements: The controller must inform data subjects appropriately about the collection of personal data (Art. 19 FADP). At a minimum, the controller must state its identity and contact details, the purpose of processing and any recipients or categories of recipients; if the data was not collected from the data subject, it must also state the categories of data processed. Data subjects can also request the correction of incorrect data (Art. 32 FADP).
- Right to information: The law states that any individual can request information from the data controller about whether their personal data is being processed (Art. 25 FADP). The response must include, among other things, the retention period or the criteria for setting it (Art. 25(2) FADP).
- Expanded compliance obligations for companies: The FADP covers situations that have effects in Switzerland, even if they originate abroad (Art. 3 FADP). A private controller based abroad must appoint a Swiss representative only if the conditions of Art. 14 FADP are met (see above).
- Strengthened regulatory powers and sanctions: If the rules are violated, the FDPIC can order, among other things, that processing be changed, suspended or stopped and that data be deleted or destroyed (Art. 51 FADP). On complaint, private persons can be fined up to CHF 250,000, for example for wilfully providing false or incomplete information (Art. 60 FADP) or for wilfully violating duties of care (Art. 61 FADP); the cantons prosecute these offences (Art. 65 FADP). If a fine of up to CHF 50,000 is under consideration and identifying the responsible persons would require disproportionate effort, the business itself can be ordered to pay the fine instead (Art. 64 FADP).
- Reporting data security breaches: The controller must notify the FDPIC as quickly as possible of a data security breach that is likely to result in a high risk to the personality or fundamental rights of the data subject (Art. 24(1) FADP). The data subject must be informed if this is required for their protection or if the FDPIC requests it (Art. 24(4) FADP).
- Privacy by design and privacy by default: Under Art. 7 FADP, the controller must set up processing technically and organizationally so that data protection rules are observed, and must consider this from the planning stage. Default settings must limit processing to the minimum required for the purpose, unless the data subject decides otherwise (Art. 7(1) to (3) FADP). This forward-looking approach helps ensure data protection is considered at every operational level.
- Data protection impact assessment: Private and public bodies that process data must conduct a data protection impact assessment (DPIA) when data processing is likely to pose a high risk to the personality or fundamental rights of data subjects (Art. 22 FADP). Read more about the data protection impact assessment.
- The role of the FDPIC: The FADP grants the FDPIC additional tasks and powers, bringing changes for data processors and data subjects alike. Going forward, the FDPIC will charge private data processors for a number of its services (Art. 59 FADP).
- Data protection advisor: Private controllers may appoint a data protection advisor (Art. 10 FADP). The advisor is the contact point for data subjects and authorities and advises the controller. If the advisor acts independently and without instructions, has no incompatible activities and the required expertise, and the controller publishes the advisor’s contact details and notifies the FDPIC, the controller can skip consulting the FDPIC on a high-risk project after having consulted the advisor (Art. 10 and Art. 23(4) FADP). For an external option, see external data protection officer.
How Does the FADP Differ From the GDPR?
Both laws pursue similar goals but differ in important details that companies operating in both jurisdictions need to understand. The table compares the main points with article references:
| Topic | FADP (article) | GDPR (article) | Note |
|---|---|---|---|
| Representative for controllers abroad | Art. 14: seat abroad; processing linked to offering goods or services or monitoring behaviour in Switzerland; large-scale, regular and high risk | Art. 27: controllers and processors subject to Art. 3(2) must designate a representative in the Union in writing; exceptions for occasional low-risk processing and public authorities | The conditions differ; check both |
| Data security breach | Art. 24: notify the FDPIC as quickly as possible if a high risk is likely | Art. 33: notify the supervisory authority without undue delay and, where feasible, within 72 hours, unless a risk is unlikely | Not every breach must be reported under either law |
| Impact assessment | Art. 22: before processing that is likely to create a high risk | Art. 35: before processing that is likely to result in a high risk; Art. 35(3) names examples | Both are triggered by a likely high risk |
| Duty to inform | Art. 19: minimum content includes identity and contact details, purpose and recipients | Art. 13 and 14: detailed lists, for example including storage period and data subject rights | Compare the lists of mandatory information in both provisions |
| Data protection advisor / officer | Art. 10: private controllers may appoint one (optional) | Art. 37(1): mandatory in three cases, for example core activities involving large-scale systematic monitoring | Optional under the FADP, mandatory in defined cases under the GDPR |
| Transfers abroad | Art. 16: adequate protection decided by the Federal Council, otherwise safeguards under Art. 16(2) | Art. 45: adequacy decided by the European Commission (Chapter V) | Different deciding bodies |
| Sanctions | Art. 60, 61: criminal fines up to CHF 250,000 for private persons on complaint; Art. 64: up to CHF 50,000 for the business | Art. 83(4), (5): administrative fines up to EUR 10 million or 2 % and up to EUR 20 million or 4 % of worldwide annual turnover, whichever is higher | Criminal fines against individuals under the FADP, administrative fines against undertakings under the GDPR |
When Must I Report a Data Security Breach?
When the breach is likely to result in a high risk to the personality or fundamental rights of the data subject: then you must notify the FDPIC as quickly as possible (Art. 24(1) FADP). Not every breach has to be reported. The notification must state at least the nature of the breach, its consequences and the measures taken or planned; a processor must report any breach to the controller as quickly as possible (Art. 24(2), (3) FADP), so regulate this in a data processing agreement. The data subject must be informed if this is required for their protection or if the FDPIC requests it (Art. 24(4) FADP).
What Should I Do Now to Comply?
Start with a gap analysis against the FADP duties that matter for you, for example the duty to inform (Art. 19), the breach process (Art. 24) and, where relevant, a representative (Art. 14). Review your processors and suppliers as well, for example with vendor risk management.
Transitioning from the DSG to the FADP
For companies that were previously compliant with the old DSG, transitioning to the FADP may seem daunting, but it's essential. A gap analysis to identify data protection shortcomings and risks, along with developing a strategic plan to address these gaps, is critical. Implementing robust data processing procedures, strict security measures, and effective training programs ensures a smooth transition.
The Continued Relevance of GDPR
Despite the introduction of the FADP, Swiss companies must not overlook GDPR, especially if they process data from EU citizens. GDPR compliance not only ensures smooth data exchange with EU partners but also supports the company's global competitiveness. See our overview of GDPR compliance. If you use AI agents that process personal data, how to make AI agents GDPR compliant explains the GDPR side.
Conclusion
The FADP represents a significant milestone in Switzerland's data protection landscape. Understanding the implications of this new law is crucial for Swiss companies and those operating in Switzerland to ensure compliance, avoid substantial penalties, and maintain customer trust.
By understanding the key provisions of the FADP, appreciating the differences from GDPR, and planning a smooth transition, companies can ensure secure and responsible handling of personal data. While the task may seem daunting, the benefits of a robust data protection practice are substantial.
Here are some key takeaways from this article:
- The FADP is a major overhaul of Swiss data protection law, bringing it more closely in line with GDPR.
- The FADP introduces a range of new requirements for companies, including stricter transparency requirements, expanded reporting obligations for data security breaches, and increased sanctions for individuals and, in some cases, companies.
- Companies whose data processing has effects in Switzerland must take steps to ensure FADP compliance.
- A number of resources are available to help companies understand and comply with the FADP, including the FDPIC's website and guidance documents.
We hope this article has helped provide an overview of the FADP. If you have further questions, we're happy to help.
Webinar Recap: Switzerland's New Data Protection Act (FADP) — Now Available!
If you missed our webinar on Switzerland's new data protection law, we've got you covered here. If you have any questions, don't hesitate to contact us. You can also download our whitepaper FADP guide for Switzerland.
Your browser does not support HTML video.
