Swiss nFADP (revDSG)

Switzerland Privacy

Status

In force since 1 September 2023 (no transition period).✓Sources: fedlex.admin.ch, dlapiperdataprotection.com

Who it applies to

Processing of personal data of natural persons (not companies) by private persons and federal bodies, including processing abroad that has an effect in Switzerland.✓Sources: fedlex.admin.ch, dlapiperdataprotection.com

Size thresholds

None — applies regardless of size. Firms under 250 employees are exempt from records of processing unless they process sensitive data at large scale or do high-risk profiling.✓Sources: fedlex.admin.ch, dlapiperdataprotection.com

Regulator

Federal Data Protection and Information Commissioner (FDPIC / EDÖB)✓Sources: edoeb.admin.ch, fedlex.admin.ch

Breach or incident reporting

Notify the FDPIC as soon as possible if a breach is likely to cause a high risk; inform individuals where needed for their protection or if the FDPIC requires it. Processors must tell controllers as soon as possible.✓Sources: fedlex.admin.ch, dlapiperdataprotection.com

Deadline to answer personal data requests

Within 30 days (Art 25(7) FADP, Art 18 Ordinance); if not feasible, tell the person how long it will take. Free, except a contribution of up to CHF 300 where effort is disproportionate.✓Sources: fedlex.admin.ch, fedlex.admin.ch

Data protection officer

Optional. A private controller may appoint a data protection officer (advisor); if independent and notified to the FDPIC, it can be consulted instead of the FDPIC after a high-risk DPIA.✓Sources: fedlex.admin.ch, dlapiperdataprotection.com

Local representative

Foreign private controllers must appoint a Swiss representative if they target/monitor people in Switzerland AND the processing is large-scale, regular and high-risk (all conditions).✓Sources: fedlex.admin.ch, dlapiperdataprotection.com

Sending data abroad

Allowed to countries on the Federal Council's adequacy list (incl. EEA, UK) and to Swiss-US DPF certified US firms; otherwise use standard data protection clauses (e.g. adapted EU SCCs), BCRs or a legal exception.✓Sources: fedlex.admin.ch, fedlex.admin.ch, bj.admin.ch, dlapiperdataprotection.com

Cookies and consent

Telecommunications Act requires informing users about cookies and how to refuse them (opt-out model); consent may be needed for some uses depending on circumstances.✓Sources: edoeb.admin.ch, lawbrary.ch, dlapiperdataprotection.com

Maximum penalty

Criminal fines up to CHF 250,000 for wilful breaches of key duties (information, transfers, security, etc.), imposed mainly on the responsible individual; the company can be fined up to CHF 50,000 instead where finding the individual is disproportionate.✓Sources: fedlex.admin.ch, dlapiperdataprotection.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Publish a privacy notice incl. identity, purposes, recipients and destination countries.
• Keep a record of processing (unless the under-250-staff exemption applies).
• Run a DPIA for processing likely to pose a high risk.
• Report high-risk breaches to the FDPIC as soon as possible.
• Answer access requests within 30 days, free of charge.
• Apply privacy by design and by default; sign processor agreements.

Recent changes

No FADP amendments found since entry into force. Swiss-US Data Privacy Framework added to the adequacy list on 15 Sep 2024; FDPIC published cookie guidelines (Jan 2025, updated Oct 2025).✓

Sources

• Primary source: https://edoeb.admin.ch/en/representatives-in-accordance-with-article-14-fadp
• Second source: https://dlapiperdataprotection.com/?c=CH&t=law
• Regulator: Federal Data Protection and Information Commissioner (FDPIC / EDÖB)

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.