When did the revised FADP come into force?

On 1 September 2023, with its Data Protection Ordinance. It was adopted by Parliament on 25 September 2020 and replaced the act of 1992. There was no general transition period, so processing had to comply from that date, with limited exceptions for processing already under way.

Does the FADP apply to companies outside Switzerland?

Yes, when their processing has an effect in Switzerland (Article 3). A foreign company that regularly and extensively processes data about people in Switzerland, to offer them goods or services or to monitor their behaviour, and whose processing carries a high risk, must also appoint a representative in Switzerland (Article 14).

Is there a 72-hour breach deadline under the FADP?

No. Article 24 asks for a report to the FDPIC as soon as possible when a breach is likely to result in a high risk. The 72-hour deadline is the GDPR’s. Companies under both laws usually work to the GDPR timing.

Do we need a data protection officer under the FADP?

No, a private company is not required to appoint one. It may appoint a data protection advisor (Article 10). If the advisor meets the conditions, the company can skip consulting the FDPIC after an impact assessment that shows a remaining high risk.

Who can be fined under the FADP?

Mainly the responsible individuals, up to CHF 250,000, for intentional breaches listed in Articles 60 to 63. The company can be fined up to CHF 50,000 only where finding the responsible person would need a disproportionate investigation (Article 64).

Can we transfer personal data to the United States?

To a US company certified under the Swiss-US Data Privacy Framework, yes: the Federal Council has recognised these companies as adequate since 15 September 2024. To other US recipients, appropriate safeguards such as standard contractual clauses are needed, or an exception must apply (Articles 16 and 17).

Do Swiss websites need cookie consent?

Swiss law requires visitors to be informed and able to refuse (Article 45c of the Telecommunications Act), which is less than the EU opt-in rule. A Swiss site with visitors in the EU usually follows the EU rule. See what makes a cookie banner compliant.

Swiss FADP: the Swiss law on personal data.

Federal Act on Data Protection (FADP, SR 235.1)

Direct answer

The Swiss FADP (Federal Act on Data Protection, SR 235.1) is Switzerland’s data protection law. The revised act has applied since 1 September 2023 and covers personal data about natural persons processed by private companies and federal bodies, including processing abroad that has an effect in Switzerland. It is close to the GDPR but not identical: it asks for records of processing, impact assessments for high-risk processing, breach reports to the FDPIC as soon as possible, and it fines the responsible individuals, up to CHF 250,000.

Who the Swiss FADP applies to

The FADP applies to private persons and companies, and to federal bodies, that process personal data about natural persons (Article 2). Cantonal and communal bodies fall under cantonal data protection law instead.

Since the revision, the FADP protects only natural persons. Data about companies and other legal entities is no longer personal data, which brings the act in line with the GDPR.

Its territorial reach follows the effects principle (Article 3): the act applies to situations that have an effect in Switzerland, even if they were initiated abroad. A company outside Switzerland that regularly processes, on a large scale, data about people in Switzerland when offering them goods or services, or monitoring their behaviour, and whose processing carries a high risk, must appoint a representative in Switzerland under Article 14.

Article 6: the principles, and no general legal basis

Personal data must be processed lawfully, in good faith and proportionately, for a purpose that is recognisable to the person concerned, and kept accurate. It is destroyed or anonymised once no longer needed for the purpose.

This is the most important difference from the GDPR. A private company does not need a legal basis for every processing activity. Processing is allowed as long as it respects these principles and does not unlawfully violate the person’s personality. Where it does, for example when data is processed against the person’s express wishes, a justification is needed: consent, an overriding private or public interest, or the law (Articles 30 and 31).

Where consent is required, it must be given freely and on the basis of adequate information. Consent must be express for processing sensitive personal data and for high-risk profiling.

Sensitive personal data includes data on religious, philosophical or political views, health, the intimate sphere, ethnic origin, genetic and biometric data identifying a person, criminal proceedings and social assistance (Article 5).
Privacy by design and by default (Article 7) require the processing to be set up so the principles are met, and the default settings to limit processing to the minimum needed for the purpose.

What controllers have to do

The table summarises the obligations most companies work on first. The Data Protection Ordinance sets out the details.

Core Swiss FADP obligations for private controllers
Obligation	Article	What it means in practice
Data security	Art. 8; DPO arts. 1 to 6	Technical and organisational measures appropriate to the risk. The ordinance sets minimum requirements, and breaking them intentionally can be fined.
Processors	Art. 9	A processor may be used by contract or law if it processes data only as the controller could. The controller makes sure the processor can guarantee data security. Sub-processors need the controller’s prior authorisation.
Records of processing activities	Art. 12; DPO art. 24	Controllers and processors keep a record of their processing activities. Companies with fewer than 250 employees are exempt unless they process sensitive data on a large scale or carry out high-risk profiling.
Duty to inform	Arts. 19 to 21	When collecting personal data, tell the person at least who the controller is, the purpose, the recipients and any countries the data goes to. Automated individual decisions must be disclosed.
Impact assessment	Arts. 22 and 23	Where processing is likely to result in a high risk to personality or fundamental rights, assess it beforehand. If a high risk remains despite the measures, consult the FDPIC first.
Breach notification	Art. 24	Report a breach of data security likely to result in a high risk to the FDPIC as soon as possible. Inform the people concerned when their protection requires it or the FDPIC asks. Processors tell the controller as soon as possible.
Disclosure abroad	Arts. 16 and 17	Data may go to a country the Federal Council lists as adequate. Otherwise appropriate safeguards are needed, such as standard contractual clauses, or an exception applies.
Data protection advisor	Art. 10	Optional for private controllers. Appointing one who meets the conditions can spare the controller the FDPIC consultation after an impact assessment.

What people can ask you

Right of access (Article 25): anyone can ask whether data about them is processed and receive the information needed to exercise their rights, including the data itself, the purpose, the retention period, the recipients and the source. The answer is due within 30 days (DPO Article 18) and is in principle free of charge.
Data portability (Article 28): a person can ask to receive the data they provided in a common electronic format, or have it transmitted to another controller, under conditions.
Rectification, erasure and objection: a person can ask for inaccurate data to be corrected and can bring claims to stop processing or have data destroyed (Articles 32 and 41).
Automated decisions (Article 21): a person subject to a decision based solely on automated processing, with legal effects or significant impact, can ask to state their view and have a human review it.

Article 24: reporting a breach

A breach of data security is a breach that leads to personal data being lost, deleted, destroyed, modified or disclosed or made accessible to unauthorised persons, whether accidental or unlawful (Article 5).

The controller reports it to the FDPIC as soon as possible when it is likely to result in a high risk to the personality or fundamental rights of the people concerned. There is no fixed number of hours, unlike the GDPR’s 72 hours, so companies under both laws usually work to the shorter GDPR timing. The report covers at least the nature of the breach, its consequences and the measures taken or planned.

The people concerned are informed when their protection requires it or the FDPIC asks. The controller documents every breach, including those it does not report. For a real case, see the Ricardo breach and the FADP.

Articles 60 to 66: fines on individuals

The FADP’s criminal provisions target people, not companies. The cantonal authorities can fine the responsible private individuals up to CHF 250,000 for intentional breaches, such as giving false or incomplete information to the people concerned or to the FDPIC, disclosing data abroad or using a processor in breach of the act, failing to meet the minimum data security requirements, breaching professional secrecy, or ignoring an FDPIC ruling.

Where finding the responsible person would need a disproportionate investigation, the company itself can be fined up to CHF 50,000 instead (Article 64).

The FDPIC does not fine. It investigates and can order measures, such as changing, suspending or stopping a processing activity, or destroying data (Articles 49 and 51).

Swiss FADP vs GDPR

Many companies are under both laws: the FADP for people in Switzerland, the GDPR for people in the EU. The two are close, and the European Commission has recognised Switzerland as providing adequate protection, but the details differ. See the GDPR guide for the European side.

Swiss FADP and GDPR compared (selected points)
Topic	Swiss FADP	GDPR
In force	Revised act since 1 September 2023	Since 25 May 2018
Legal basis	No general requirement for private companies; a justification is needed when personality is unlawfully violated	A lawful basis for every processing activity (Article 6)
Breach notification	To the FDPIC as soon as possible, when a high risk is likely	To the supervisory authority within 72 hours, unless unlikely to result in a risk
Fines	Up to CHF 250,000 on the responsible individuals	Up to EUR 20 million or 4% of worldwide turnover, on the organisation
Access request deadline	30 days	One month, extendable by two months
Records of processing	Exemption below 250 employees unless high-risk processing	Exemption below 250 employees unless risky, regular or special-category processing
Data protection officer	Optional advisor	Mandatory in defined cases
Representative for foreign companies	Article 14	Article 27

Running the Swiss FADP in Acuna GRC

In Acuna GRC, an administrator ticks the Swiss FADP on the Privacy Laws page in Comply, and the GDPR too when it applies. One record of processing in Data Privacy then carries both laws, with a legal basis for each on every activity. The impact assessment screener says when an assessment is required, the breach wizard records the affected activities, assets and suppliers in one record, and access requests arrive through your Privacy Portal with their own due date. The breach clock in Data Privacy counts 72 hours, the GDPR deadline: under the FADP your team decides the timing it works to.

Cookie Manager keeps proof of each visitor’s cookie choice, and processors are the third parties you assess in TPRM. See Swiss FADP compliance software for how this works for your team, with Swiss experts available as DPO.

Sources

This guide explains the law in general terms and is not legal advice.

How do you run the Swiss FADP in Acuna GRC?

Acuna GRC keeps your record of processing activities, DPIAs, data subject requests and breach notifications in one register, and assesses the processors who handle personal data for you.

Request a demo

EXPLORE

Swiss FADP

Swiss FADP compliance softwareSOLUTION

How Acuna GRC keeps one record of processing for the FADP and the GDPR, with Swiss experts as DPO.

What is a record of processing activities?ANSWER

What the register must contain, who must keep one and the 250-employee exemption.

What makes a cookie banner compliant?ANSWER

Prior consent, a Reject all as easy as Accept all, and what Swiss law asks.

What counts as proof of cookie consent?ANSWER

What each consent record should hold, and what a consent log cannot prove.

The GDPR 72-hour breach ruleANSWER

The GDPR deadline that companies under both laws usually work to.

The Ricardo breach and the FADPARTICLE

What the FADP requires after a breach, through a real Swiss case.

Swiss FADP: common questions.

Questions practitioners ask.

What makes a cookie banner compliant?

A compliant cookie banner sets no optional cookies until the visitor has chosen, makes refusing as easy as accepting, explains each purpose before the choice, and lets the visitor change or withdraw that choice at any time. In the EU this follows from Article 5(3) of the ePrivacy Directive and the GDPR definition of consent. Swiss law asks for less: visitors must be informed and able to refuse.

What counts as proof of cookie consent?

Proof of cookie consent is a record that shows what a visitor chose, when, and under which version of the banner and cookie policy, kept for as long as you rely on that consent. Article 7(1) of the GDPR requires you to be able to demonstrate consent. A banner on its own proves nothing: the evidence is the log of each choice and the text the visitor saw.

What is on a Swiss FADP compliance checklist?

A Swiss FADP checklist covers the duties of the revised Federal Act on Data Protection, in force since 1 September 2023: know what you process, inform people, keep a record of processing activities, assess high-risk processing, secure the data, bind your processors, check cross-border disclosures, answer access requests within 30 days and report high-risk breaches to the FDPIC as soon as possible. Acuna GRC keeps these records and clocks in its Data Privacy module.

Does the GDPR apply to Swiss companies?

Sometimes. The GDPR applies to a Swiss company when it has an establishment in the EU, or when it offers goods or services to people in the EU or monitors their behaviour there (Article 3(2)). In that case it may also need an EU representative under Article 27. A Swiss company with only Swiss customers follows the Swiss FADP. Data can flow from the EU to Switzerland freely, because the EU recognises Swiss data protection as adequate. Acuna GRC can run both laws on the same processing register.

Why does data residency matter for GRC data?

Data residency is the choice of the country or region where your data is stored. It matters for GRC data because a GRC platform holds some of your most sensitive information: risk registers, open vulnerabilities, incident records, audit findings, supplier assessments and personal data about staff and data subjects. Where it is stored decides which laws and authorities can reach it and what transfer rules apply. Acuna GRC hosts your data in Switzerland, the EU or the US, as you choose.

Can a DPO be external?

Yes. Article 37(6) of the GDPR lets a data protection officer be a staff member or fulfil the tasks under a service contract, so an external DPO is fully allowed. The DPO must have expert knowledge of data protection law, act independently, report to the highest management level and have no conflict of interests. Under the Swiss FADP, appointing a data protection advisor is optional, and the advisor can also be external. With DPO as a service, Swiss experts run the privacy work with you in Acuna GRC.

How does Switzerland regulate AI?

Switzerland has no AI act. In February 2025 the Federal Council decided to ratify the Council of Europe AI Convention and to meet it mainly through targeted, sector-specific changes to existing laws, plus non-binding measures, with a consultation draft announced for the end of 2026. Until then, existing law applies to AI: above all the FADP, which covers AI that processes personal data. Swiss companies that sell AI into the EU or whose AI output is used there also fall under the EU AI Act. Acuna GRC keeps one AI system register for both.

SWISS FADP

One register for the FADP and the GDPR.

Acuna GRC keeps one record of processing for both laws, with impact assessments, access requests, breaches, cookie consent and processors connected to it.

Swiss FADP compliance software Explore the Data Privacy module

Built for:CISOs Compliance Leaders MSSPs