What US Businesses Need to Know About Switzerland’s Revised Federal Act on Data Protection
Updated April 2026 | International Privacy Law
Switzerland’s revised Federal Act on Data Protection (FADP)—known in German as the Datenschutzgesetz or DSG, in French as the Loi fédérale sur la protection des données or LPD—entered into force on September 1, 2023. The revised law substantially modernizes Swiss data protection, abandons several features of its 1992 predecessor that had grown outdated, and introduces obligations and concepts that will be recognizable to anyone versed in the EU’s General Data Protection Regulation. For US businesses with Swiss customers, Swiss employees, Swiss business partners, or digital services accessible to individuals in Switzerland, the revised FADP is an operative compliance obligation that demands careful attention.
Background: From the 1992 Act to the Revised FADP
Switzerland’s original Federal Act on Data Protection was enacted in 1992—a pioneering piece of legislation for its time, but one that had grown significantly out of step with modern data processing realities and with the European legal landscape that Switzerland’s economy is deeply intertwined with. The law had not been meaningfully updated since its enactment, and by the time the European Union adopted the GDPR in 2016, it was clear that a fundamental revision rather than a series of incremental amendments was required.
The revised FADP is a significant departure from the 1992 Act in several important respects. Most notably, the new law narrows its scope to the personal data of natural persons only—the 1992 Act had unusually extended protections to legal entities, a feature found nowhere else in comparable privacy legislation. The revised law also introduces meaningful new obligations for controllers and processors, strengthens individual rights, establishes a mandatory data breach notification regime, and modernizes the rules around cross-border data transfers. Although it is closely modeled on the GDPR, the revised FADP is not identical to that instrument, and the distinctions matter—particularly for organizations that might otherwise assume GDPR compliance translates directly to Swiss compliance.
Territorial Scope: When Does the Revised FADP Apply to US Businesses?
Like the GDPR, the revised FADP has explicit extra-territorial reach. It applies to any processing of personal data that has effects in Switzerland, regardless of where the processing takes place. This means that a US business that collects, uses, discloses, or otherwise processes personal data about individuals located in Switzerland may be subject to the revised FADP even if that business has no physical presence, no legal entity, and no employees in Switzerland.
The practical implications for US businesses are significant. An e-commerce company that sells goods to Swiss consumers, a SaaS platform used by Swiss subscribers, a US employer with employees working remotely in Switzerland, or a US publisher operating a website that collects personal data from Swiss visitors through analytics or advertising technology may all fall within the revised FADP’s scope. The territorial trigger is the effect on individuals in Switzerland, not the location of the data controller or processor.
Note on EU vs. Swiss Compliance: Switzerland is not a member of the European Union. The GDPR does not apply directly in Switzerland. Organizations serving both EU and Swiss markets must ensure they understand the two frameworks separately. While the revised FADP closely tracks the GDPR in structure and philosophy, there are meaningful differences—in legal bases for processing, in enforcement architecture, and in penalty structure—that make direct equivalence dangerous to assume.
US businesses that are subject to the revised FADP and do not have an establishment in Switzerland should consider whether they are required to designate a representative in Switzerland. The revised FADP, mirroring the GDPR’s approach, requires certain foreign controllers that regularly process personal data of individuals in Switzerland at scale, or that process particularly sensitive personal data, to appoint a representative domiciled in Switzerland. The representative serves as a contact point for individuals and for the Federal Data Protection and Information Commissioner (FDPIC). Failure to appoint a required representative is itself a violation of the Act and can constitute a criminal offense.
Scope of the Law: Personal Data, Sensitive Data, and the New Concept of High-Risk Profiling
The revised FADP defines personal data as any information relating to an identified or identifiable natural person. This is a deliberately broad definition that encompasses not only obvious identifiers such as names, email addresses, and national identification numbers, but also online identifiers, location data, and any information that, alone or in combination with other data, enables an individual to be singled out. The extension to natural persons only—dropping the legal entity coverage of the 1992 Act—brings Switzerland’s law into alignment with the approach taken by virtually all other modern privacy statutes.
The revised FADP identifies a category of particularly sensitive personal data that attracts heightened obligations. This category includes data revealing religious, ideological, political, or trade union views; health and intimate sphere data; genetic and biometric data that uniquely identifies a natural person; data on administrative and criminal proceedings and sanctions; and social welfare data. The processing of sensitive personal data generally requires either explicit consent or another specific legal justification, and the consequences of unlawful processing in this category are correspondingly more serious.
One of the more distinctive features of the revised FADP is its treatment of profiling. The law distinguishes between ordinary profiling—the automated processing of personal data to evaluate certain personal aspects of an individual—and “high-risk profiling,” which is profiling that leads to a high risk to the personality or fundamental rights of the data subject. High-risk profiling receives special treatment throughout the Act, requiring explicit consent in the absence of a statutory authorization or overriding private interest, and triggering additional transparency and impact assessment obligations. For US businesses engaged in behavioral advertising, predictive analytics, credit scoring, or other data-driven profiling activities, this framework requires careful analysis.
Legal Bases for Processing Personal Data
The revised FADP’s approach to legal bases for processing represents one of its most significant structural differences from the GDPR, and one that frequently surprises US practitioners who are more familiar with the European framework. Under the FADP, the default rule is that processing of personal data is permitted unless it unlawfully violates the personality rights of the data subject. This is an unlawfulness-based model rather than a positive-authorization model. In contrast to the GDPR, which requires controllers to identify one of six enumerated legal bases before processing may commence, the FADP begins from a premise of permissibility, subject to a duty not to process in a manner that is unlawful or disproportionate.
Processing is unlawful where it violates the principles of data protection set out in the Act—including the principles of lawfulness, proportionality, purpose limitation, and accuracy—or where it occurs in circumstances that give rise to unlawfulness, such as through deception, coercion, or the breach of a contractual obligation. A violation of personality rights can be justified where the data subject has consented, where an overriding private or public interest exists, or where processing is required by law.
Consent under the revised FADP must be voluntary, informed, unambiguous, and—for the processing of sensitive personal data or high-risk profiling—explicit. However, because the FADP does not require controllers to identify a legal basis at the point of collection in the same way the GDPR does, the role of consent is somewhat different in practice. Consent is most important as a justification for processing that would otherwise unlawfully infringe personality rights—particularly where sensitive data or high-risk profiling is involved—rather than as a general prerequisite to all processing activity. US businesses familiar with the GDPR’s consent requirements should exercise caution before assuming that an identical approach is either necessary or sufficient under the FADP.
Key Obligations for Data Controllers
Privacy Notices and Transparency Obligations
The revised FADP imposes a general duty of transparency on data controllers. When personal data is collected from a data subject, the controller must inform the individual of the identity and contact details of the controller, the purposes of processing, and—where applicable—the recipients or categories of recipients of the data and any intended transfer abroad. Where data is collected from third-party sources rather than directly from the data subject, disclosure obligations apply when the data is recorded or first disclosed to a third party, or at the latest at the time of first communication to the data subject.
Records of Processing Activities
Controllers and processors subject to the revised FADP are required to maintain records of their processing activities. For controllers, the record must include information about the controller’s identity, the purpose of each processing activity, a description of the categories of data subjects and personal data processed, the categories of recipients, the retention periods, and—where applicable—information about transfers abroad. Processors must maintain similar records with respect to their processing on behalf of controllers.
The revised FADP includes an exemption for private companies with fewer than 250 employees whose data processing carries low risk to the personality rights of data subjects, provided that the processing is not a core activity. This mirrors a similar SME threshold in the GDPR, though the precise contours differ, and US businesses should not assume the exemption applies without analysis. Large US businesses with Swiss processing activities will generally be required to maintain complete records.
Data Protection Impact Assessments
Where data processing is likely to result in a high risk to the personality or fundamental rights of data subjects, the revised FADP requires the controller to conduct a data protection impact assessment (DPIA) prior to commencing the processing. High-risk processing activities include, in particular, large-scale processing of sensitive personal data and systematic, large-scale monitoring of publicly accessible areas. The DPIA must describe the envisaged processing, assess the necessity and proportionality of the processing in relation to its purpose, evaluate the risks to the rights of data subjects, and identify measures to address those risks.
If the DPIA reveals a residual high risk that cannot be mitigated, the controller must consult the FDPIC before proceeding. The FDPIC has a defined period in which to provide recommendations, and its response—or failure to respond within that period—determines whether the controller may proceed with the processing. US businesses launching new data-intensive products or services that will be used in Switzerland, or that will process Swiss personal data at scale, should build DPIA requirements into their product development and launch processes.
Data Security and Safeguards
The revised FADP requires controllers and processors to implement appropriate technical and organizational measures to ensure data security commensurate with the state of the art, the nature of the processing, and the risk to data subjects. The Data Protection Ordinance specifies relevant security measures, including encryption, pseudonymization, access controls, and logging. US businesses should review their existing security programs against FADP requirements rather than assuming alignment.
Mandatory Data Breach Notification
One of the most operationally significant changes introduced by the revised FADP is mandatory breach notification. Controllers are required to notify the FDPIC “as soon as possible” when they become aware of a personal data security breach that is likely to result in a high risk to the personality or fundamental rights of the data subjects concerned. Unlike the GDPR’s 72-hour notification window, the revised FADP does not specify a fixed deadline, but the FDPIC has indicated that notifications should generally be made without undue delay and that the “as soon as possible” standard implies a similar sense of urgency.
Where the high risk is likely to materialize in a serious manner—for example, where the breach involves sensitive personal data or large-scale processing—the controller must also notify the affected data subjects, allowing them to take appropriate protective measures. Notification to data subjects may be deferred if a competent authority so requests, for example to avoid compromising a criminal investigation.
For US businesses already subject to state breach notification laws or to GDPR breach notification obligations, the FADP regime adds a further layer of notification analysis that must be conducted in parallel. The threshold—high risk to rights and personality—is broadly comparable to the GDPR’s threshold, but is not identical in all respects, and the FDPIC’s expectations regarding notification content and timing should be reviewed as part of any Swiss-facing incident response plan.
Enforcement Note: Under the revised FADP, willful failure to notify the FDPIC of a qualifying data breach is a criminal offense that can result in a personal fine of up to CHF 250,000. Importantly, this criminal liability is imposed on responsible individuals within the organization—not on the corporate entity as a whole. This individual accountability dimension of Swiss enforcement is one of the most distinctive features of the FADP, and is discussed in detail below.
Rights of Data Subjects
The revised FADP substantially expands the rights available to individuals whose personal data is processed. The right of access allows any individual to request information from a controller about whether their personal data is being processed, and if so, to receive a copy of that data along with information about the processing purposes, data categories, recipients, and retention periods. Controllers must respond to access requests within 30 days, though that period may be extended where justified by the complexity of the request.
Individuals also have the right to rectification of inaccurate personal data and the right to erasure where processing is unlawful, where the data is no longer necessary for the purpose for which it was collected, or where the individual has withdrawn the consent on which processing was based. The revised FADP introduces a right to data portability for personal data processed by automated means: where an individual has provided their personal data to a controller, they may request that it be delivered to them in a structured, commonly used, and machine-readable format, and may request transmission to another controller where technically feasible.
Where processing involves solely automated means that produce legal or similarly significant effects on the individual—an area of increasing importance as algorithmic and AI-driven decision-making becomes prevalent in commerce—the revised FADP grants individuals the right to request that the decision be reviewed by a natural person. This right to human review of automated decisions is an important provision for US businesses deploying AI-driven systems for credit decisioning, hiring, pricing, or any other purpose that materially affects individuals in Switzerland.
Cross-Border Data Transfers and the Swiss-US Data Privacy Framework
The revised FADP maintains Switzerland’s approach of permitting cross-border transfers of personal data only to countries or international organizations that provide an adequate level of data protection, or where an appropriate safeguard is in place. The Federal Council publishes and maintains a list of countries and territories deemed to offer adequate protection. The European Union has been recognized as adequate for these purposes, and numerous other jurisdictions appear on the list.
The United States does not appear on the Federal Council’s adequacy list as a jurisdiction offering general adequate protection. However, US businesses that have certified to the Data Privacy Framework (DPF) have a specific transfer mechanism available to them. Following the European Commission’s adequacy decision for the EU-US Data Privacy Framework in July 2023, the Swiss Federal Council issued a recognition decision bringing the Swiss Extension to the US Data Privacy Framework into effect from July 17, 2023. US organizations that certify to the DPF under both the EU and Swiss extensions thereby obtain a recognized transfer mechanism for personal data from Switzerland.
For US businesses that have not certified to the DPF—or that process categories of data for which DPF certification is unavailable—alternative transfer mechanisms exist. These include standard contractual clauses (SCCs), which may be those approved by the Federal Council or, under certain conditions, those approved by the European Commission adapted to the Swiss context. Binding corporate rules, approved codes of conduct, and approved certifications are also recognized mechanisms. In the absence of an adequate transfer mechanism, transfers may proceed only on the basis of specified derogations—including express consent, contract performance, or important public interest grounds—which are intended to apply in specific, limited circumstances rather than as a routine alternative to an adequate transfer tool.
US businesses that transfer personal data from Switzerland to the United States should undertake a documented transfer impact assessment where SCCs are used, assessing the legal landscape in the United States and determining whether supplementary measures are required to achieve an adequate level of protection in practice. The FDPIC has published guidance on transfer impact assessments that should be consulted as part of this exercise.
Enforcement: The FDPIC and a Distinctive Penalty Structure
The Federal Data Protection and Information Commissioner (FDPIC) is the independent supervisory authority responsible for enforcing the revised FADP. The FDPIC has broad investigative powers, including the authority to initiate investigations on its own motion, request information from controllers and processors, and access premises and systems where relevant. Following an investigation, the FDPIC may issue recommendations requiring the controller to bring its processing activities into compliance. Where a controller does not comply with a FDPIC recommendation, the matter may be referred to the Federal Administrative Court, which can issue binding orders.
The revised FADP’s enforcement model differs fundamentally from the GDPR in one critical respect: it does not provide for administrative fines against corporations. Instead, the Act creates a regime of criminal sanctions targeted at responsible individuals within an organization. Where an individual—a director, officer, or employee—willfully violates one of the Act’s specified provisions, they may be subject to a criminal fine of up to CHF 250,000 upon complaint or, in some cases, at the initiative of cantonal prosecuting authorities.
| Violation | Maximum Criminal Fine | Who Bears Liability |
| Failure to provide required information to data subjects | CHF 250,000 | Responsible individual |
| Failure to notify the FDPIC of a qualifying data breach | CHF 250,000 | Responsible individual |
| Unlawful processing of personal data by a data processor in violation of contract | CHF 250,000 | Responsible individual |
| Failure to appoint a required representative in Switzerland | CHF 250,000 | Responsible individual |
| Violation of minimum contractual requirements for cross-border transfers | CHF 250,000 | Responsible individual |
This individual-liability model has significant implications for how US businesses manage their Swiss data protection compliance programs. Because corporate entities cannot themselves be fined under the FADP—unlike under the GDPR, where fines can reach four percent of global annual turnover—the personal exposure of senior executives and responsible employees becomes a primary driver of compliance governance. US businesses should ensure that roles and responsibilities for Swiss data protection compliance are clearly assigned, that responsible individuals are trained and informed, and that governance structures are in place to prevent willful violations at the individual level.
It should also be noted that while the FADP’s criminal fine ceiling is CHF 250,000, this does not preclude civil liability claims by affected individuals under general Swiss civil law, nor does it prevent the reputational and commercial consequences of a public FDPIC investigation or enforcement action. The FDPIC publishes its investigation outcomes, and a public finding of systemic non-compliance carries significant reputational risk for any organization doing business in Switzerland or with Swiss counterparts.
The FADP and Its Relationship with the GDPR
Because Switzerland is not a member of the European Union, the GDPR does not apply directly in Switzerland. However, many US businesses serving Swiss clients or processing Swiss personal data are also subject to the GDPR—either because they serve EU residents, or because their Swiss operations involve data transfers or processing that engages European data protection law. Understanding the relationship between the two frameworks is essential to building an efficient and coherent compliance program.
The most important divergences are the legal basis framework (unlawfulness-based under FADP versus positive enumerated bases under GDPR), the concept of high-risk profiling, the enforcement architecture (individual criminal liability versus corporate administrative fines), the absence of a mandatory Data Protection Officer requirement under the FADP, and the specific SCCs recognized for cross-border transfers. US businesses should conduct a gap analysis between their GDPR compliance posture and FADP requirements rather than treating the two as interchangeable.
Data Protection Officers and Advisors
Unlike the GDPR, the revised FADP does not impose a mandatory requirement on most private-sector controllers to appoint a Data Protection Officer (DPO). Instead, the Act introduces the concept of a data protection advisor (in some translations, a data protection officer): a voluntary appointment that, where made and notified to the FDPIC, provides the controller with a procedural benefit. Specifically, a controller that has designated a data protection advisor who has been notified to and registered with the FDPIC may—in some circumstances—be exempted from the requirement to conduct a prior consultation with the FDPIC before commencing high-risk processing.
Practical Compliance Steps for US Businesses
For US businesses that have not yet assessed their compliance posture under the revised FADP, the starting point—as with any data protection framework—is a systematic mapping of data flows involving Swiss personal data. An organization must understand what data it collects from Swiss residents, for what purposes, on what legal basis, for how long, and with whom it is shared. This mapping exercise is the prerequisite to assessing compliance with each of the Act’s substantive obligations and to identifying priority gaps.
Privacy notices and consent mechanisms directed at Swiss individuals should be reviewed for compliance with the revised FADP’s transparency requirements. Organizations that are subject to the FADP and have no establishment in Switzerland should assess whether the representative appointment obligation applies to them. Records of processing activities must be established or updated. Contracts with Swiss data controllers or processors—or with third parties to whom Swiss personal data is transferred—should be reviewed for FADP-compliant data processing terms.
Cross-border transfer mechanisms for data flowing from Switzerland to the United States require particular attention. US businesses should confirm whether they hold DPF certification covering the Swiss Extension, and if not, whether SCCs or other mechanisms are in place and properly documented. Transfer impact assessments should accompany any SCC-based transfers. Incident response plans should be updated to address FADP breach notification obligations alongside any applicable US and EU notification requirements.
The individual liability dimension of the FADP’s enforcement model warrants dedicated governance attention. Businesses should identify the individuals within their organization who bear responsibility for Swiss data protection compliance, ensure those individuals have the training, authority, and resources to fulfill their responsibilities, and consider whether directors’ and officers’ liability insurance coverage extends to potential FADP criminal proceedings. This is a meaningfully different risk management conversation from the corporate fine calculus that dominates GDPR compliance discussions.
Conclusion
Switzerland’s revised Federal Act on Data Protection represents a thorough and ambitious modernization of Swiss privacy law that has brought one of the world’s most significant financial and commercial centers into alignment with contemporary data protection standards. For US businesses, the law’s extra-territorial scope means that Swiss compliance cannot be treated as relevant only to organizations with a physical Swiss presence. Any meaningful commercial activity involving the personal data of individuals in Switzerland brings the revised FADP into play—and with it, a set of obligations that differ from both the GDPR and traditional US privacy frameworks in ways that demand specific legal analysis.
Engaging experienced privacy counsel with expertise in Swiss data protection law—and how it interacts with both US law and the GDPR—is the most effective way to manage these risks and build a durable compliance program for the Swiss market.
Speak With a Data Protection Lawyer
Our privacy and data protection practice advises US companies on their obligations under the Swiss revised FADP, the GDPR, and other international privacy frameworks. We assist with compliance assessments, cross-border transfer structuring, breach response, representative appointments, and regulatory matters before the FDPIC. Contact us to discuss your organization’s needs.