GDPR and Swiss Data Protection Compliance: Business Guide
Data protection is a dual-regime concern for Swiss businesses. The revised Swiss Federal Act on Data Protection (nFADDP/revDSG), effective since 1 September 2023, governs the processing of personal data under Swiss law. Simultaneously, the EU General Data Protection Regulation (GDPR) may apply to Swiss companies that offer goods or services to individuals in the EU or monitor their behaviour. This guide covers both regimes and their practical implications for businesses operating from Switzerland.
The Swiss Data Protection Framework
nFADDP (Revised Federal Act on Data Protection)
The revised law (revDSG, commonly referred to as nFADDP) modernises Swiss data protection to align more closely with the GDPR while retaining distinctive Swiss features:
| Feature | nFADDP | GDPR |
|---|---|---|
| Scope | Personal data of natural persons only (no longer legal entities) | Personal data of natural persons |
| Territorial reach | Swiss-based controllers/processors; foreign entities targeting Switzerland | EU-based entities; foreign entities targeting EU data subjects |
| Legal basis for processing | Legitimate interest (default), consent for sensitive data | Legal basis required for all processing (6 bases) |
| Consent standard | Must be informed; explicit for sensitive data and high-risk profiling | Must be freely given, specific, informed and unambiguous |
| Data Protection Officer | Not mandatory (but recommended) | Mandatory for certain controllers/processors |
| Data breach notification | Notify FDPIC as soon as possible | Notify supervisory authority within 72 hours |
| Penalties (max) | CHF 250,000 (against natural persons/individuals) | EUR 20 million or 4% of global turnover (against entities) |
| Supervisory authority | Federal Data Protection and Information Commissioner (FDPIC/EDÖB) | National data protection authorities |
| Data Protection Impact Assessment | Required for high-risk processing | Required for high-risk processing |
Key Difference: Legitimate Interest Default
Under nFADDP, processing of ordinary (non-sensitive) personal data is lawful by default, unless a justification ground is violated. This is the inverse of the GDPR, where processing requires one of six specified legal bases. Swiss law presumes processing is lawful if it respects the principles of proportionality, purpose limitation and transparency. Consent is required only for:
- Processing of sensitive personal data (health, religion, political opinions, social security, criminal records, biometric/genetic data)
- High-risk profiling
- Automated individual decisions with legal effects
When Does the GDPR Apply to Swiss Companies?
The GDPR’s extraterritorial reach (Art. 3(2) GDPR) means the regulation applies to Swiss companies that:
- Offer goods or services to individuals in the EU (regardless of whether payment is required) — indicators include EU-language websites, EU-currency pricing, EU-targeted marketing
- Monitor the behaviour of individuals in the EU — including web tracking, profiling and behavioural analytics targeting EU users
If your Swiss company has an EU customer base, processes EU employee data (e.g., cross-border workers from EU countries) or operates EU-facing digital services, GDPR compliance is required in addition to nFADDP compliance.
EU Representative
Swiss companies subject to the GDPR but without an EU establishment must appoint an EU representative under Art. 27 GDPR. The representative must be established in an EU member state where data subjects are located.
Core Data Protection Principles
Both nFADDP and GDPR share fundamental principles:
| Principle | Requirement |
|---|---|
| Lawfulness | Processing must have a valid legal basis |
| Purpose limitation | Data collected for a specific purpose must not be processed for incompatible purposes |
| Proportionality/data minimisation | Only collect and process data that is necessary for the stated purpose |
| Accuracy | Personal data must be accurate and kept up to date |
| Storage limitation | Data must not be retained longer than necessary |
| Security | Appropriate technical and organisational measures must protect data |
| Transparency | Data subjects must be informed about how their data is processed |
Practical Compliance Steps
Step 1: Data Inventory and Processing Register
Companies with 250 or more employees, or those processing sensitive data or engaging in high-risk profiling, must maintain a register of processing activities (Art. 12 nFADDP):
| Register Entry | Content |
|---|---|
| Identity of controller | Company name and contact details |
| Purpose of processing | Specific purpose for each processing activity |
| Categories of data subjects | Customers, employees, suppliers, etc. |
| Categories of personal data | Name, email, payment data, health data, etc. |
| Recipients | Third parties receiving the data |
| Cross-border transfers | Countries receiving data and safeguards applied |
| Retention periods | How long data is kept for each category |
| Security measures | Technical and organisational protections |
Even for companies below the 250-employee threshold, maintaining a processing register is strongly recommended as evidence of compliance.
Step 2: Privacy Notices
Every company processing personal data must provide clear, accessible privacy information:
- Website privacy policy — covering cookies, analytics, contact forms and marketing
- Employee privacy notice — covering HR data processing, monitoring and pension administration
- Customer/supplier privacy notice — covering contract management, invoicing and communication
- Cookie banner — informing users about tracking technologies and obtaining consent where required
Step 3: Data Processing Agreements
When engaging third-party processors (cloud providers, payroll services, CRM platforms, marketing tools), a data processing agreement (DPA) is required under Art. 9 nFADDP:
| DPA Element | Requirement |
|---|---|
| Subject matter | Description of processing activities |
| Duration | Period of processing |
| Instructions | Processor acts only on controller’s instructions |
| Security | Processor implements adequate security measures |
| Sub-processors | Prior approval required; processor liable for sub-processors |
| Data breach notification | Processor notifies controller without undue delay |
| Audit rights | Controller may audit the processor’s compliance |
| Data return/deletion | At end of contract, data is returned or deleted |
Step 4: Cross-Border Data Transfers
The nFADDP restricts transfers of personal data to countries that do not provide adequate data protection. The Federal Council publishes a list of countries with adequate protection (Annex 1 to the Data Protection Ordinance).
Countries with adequate protection (partial list): EU/EEA member states, United Kingdom, Canada, New Zealand, Uruguay, Israel, Japan, South Korea
Transfers to non-adequate countries require additional safeguards:
| Safeguard | Application |
|---|---|
| Standard contractual clauses (SCCs) | EU-approved SCCs adapted for Swiss law; most common mechanism |
| Binding corporate rules (BCRs) | For intra-group transfers; requires FDPIC approval |
| Explicit consent | Data subject consents to the transfer with full awareness of risks |
| Contractual necessity | Transfer is necessary for contract performance |
| Public interest or legal claims | Transfer is necessary for important public interests or legal proceedings |
US transfers: Following the EU-US Data Privacy Framework, the US has been recognised as providing adequate protection for organisations certified under the framework. Check whether your US service provider is DPF-certified.
Step 5: Data Subject Rights
Both nFADDP and GDPR grant individuals rights over their personal data:
| Right | nFADDP | GDPR |
|---|---|---|
| Right to information/access | Yes (Art. 25–27) | Yes (Art. 15) |
| Right to rectification | Yes | Yes (Art. 16) |
| Right to deletion | Yes | Yes (Art. 17) |
| Right to data portability | Yes (Art. 28) | Yes (Art. 20) |
| Right to object | Implied through personality rights | Yes (Art. 21) |
| Right to restrict processing | Not explicitly stated | Yes (Art. 18) |
Response deadline: nFADDP requires responses within 30 days; GDPR requires responses within one month (extendable by two months for complex requests).
Step 6: Data Breach Notification
Under nFADDP, data breaches that pose a high risk to data subjects must be reported to the FDPIC as soon as possible (no fixed deadline, but promptly). Under GDPR, notification to the supervisory authority must occur within 72 hours.
Practical recommendation: Establish a breach response procedure with a 72-hour notification target to satisfy both regimes:
- Detect and contain — identify the breach and stop ongoing data loss
- Assess severity — determine the type of data affected and the number of data subjects
- Notify the FDPIC (and EU supervisory authority if GDPR applies) — if the breach poses a high risk
- Notify affected data subjects — if the breach is likely to result in high risk to their rights
- Document — maintain a breach register with details of every incident, regardless of severity
Step 7: Data Protection Impact Assessment (DPIA)
A DPIA is required under nFADDP when processing is likely to result in a high risk to data subjects. High-risk processing includes:
- Large-scale processing of sensitive data
- Systematic monitoring of public areas
- Automated decision-making with legal effects
- New technologies with uncertain privacy implications
The DPIA must assess the processing’s necessity, proportionality and risks, and identify mitigation measures.
Industry-Specific Considerations
Financial Services
Companies in banking, insurance and financial services face additional data protection requirements under:
- Banking secrecy (Art. 47 Banking Act) — client data confidentiality
- FINMA circulars on outsourcing and cloud computing
- Cross-border data transfer restrictions for client data
Healthcare and Life Sciences
Processing of health data triggers heightened consent requirements and security obligations under both nFADDP and the Human Research Act (HFG).
Employment Data
Employers process significant quantities of employee data. Key requirements:
- Proportionality: only collect data relevant to the employment relationship
- Monitoring: employee surveillance must be proportionate and disclosed
- Cross-border workers: additional GDPR obligations if processing EU-resident employee data
Enforcement and Penalties
nFADDP Penalties
The nFADDP’s penalty regime is unusual:
- Maximum fine: CHF 250,000
- Directed at natural persons (individuals), not the company — typically the person responsible for data protection compliance (often a director or DPO)
- Criminal nature: Fines are imposed through criminal proceedings, not administrative penalties
- Intentional violations only: Negligent violations are generally not sanctioned (with limited exceptions)
GDPR Penalties
If the GDPR applies to your Swiss business:
- Maximum fine: EUR 20 million or 4% of global annual turnover (whichever is higher)
- Directed at the entity (the company)
- Administrative penalties: Imposed by the competent EU supervisory authority
Practical Recommendations
- Conduct a data mapping exercise — understand what personal data you collect, where it is stored, who processes it and where it flows
- Determine GDPR applicability — if you serve EU customers or employ EU-resident staff, assume GDPR applies
- Implement privacy-by-design — build data protection into new systems, processes and products from the outset
- Draft and publish privacy notices for your website, employees and business contacts
- Review all vendor contracts for data processing agreement compliance
- Establish a data breach response procedure with a 72-hour notification target
- Train staff — ensure employees understand their data protection obligations, particularly those handling customer data, HR records and financial information
- Appoint a data protection advisor — while not mandatory under nFADDP, having a designated person responsible for data protection is strongly recommended and demonstrates compliance commitment
- Review cross-border data flows — ensure all international transfers are covered by adequate safeguards
- Monitor regulatory developments — the FDPIC regularly publishes guidance and the adequacy list is periodically updated
Data protection is not a one-time compliance project. It is an ongoing obligation that requires regular review, documentation and adaptation as your business, technology and regulatory environment evolve.
Donovan Vanderbilt is a contributing editor at ZUG BUSINESS, the institutional intelligence publication of The Vanderbilt Portfolio AG, Zurich. His coverage spans Swiss data protection, privacy regulation and technology compliance for international businesses.