Data protection & privacy law in Switzerland (2026)

Legal framework

Federal Act on Data Protection (FADP / nFADP) of 25 September 2020, in force since 1 September 2023, with its implementing Ordinance (DPO); supervised by the Federal Data Protection and Information Commissioner (FDPIC / EDÖB).

Key points: data & privacy in Switzerland

1. 01Comprehensive GDPR-aligned law

   The revised FADP (25 Sept 2020, in force 1 Sept 2023) replaced the 1992 act and applies across all sectors, public and private. It was deliberately revised to match the GDPR's level of protection while retaining Swiss-specific features.

   edoeb.admin.ch kmu.admin.ch

2. 02Supervisory authority (FDPIC)

   The Federal Data Protection and Information Commissioner (FDPIC / EDÖB) is the independent authority overseeing the FADP (and the Freedom of Information Act). It can open investigations on its own initiative or on report, and can order measures including the adjustment, suspension or termination of processing and the deletion of data.

   edoeb.admin.ch edoeb.admin.ch

3. 03Controller obligations

   The law introduced/strengthened duties including records of processing activities, data protection impact assessments (DPIAs), privacy-by-design and by-default, transparency/information duties, and rules on profiling. Sensitive-data categories were expanded to include genetic and biometric data.

   kmu.admin.ch edoeb.admin.ch

4. 04Data-breach notification

   Controllers must notify the FDPIC of a data security breach as quickly as possible when it is likely to result in a high risk to the data subject's personality or fundamental rights; affected individuals must be informed where necessary for their protection or if the FDPIC so requires.

   edoeb.admin.ch

5. 05Penalties target individuals

   Unlike the GDPR's corporate administrative fines, the FADP provides criminal fines of up to CHF 250,000 imposed on responsible private individuals for breaches of specific duties; a business may be fined up to CHF 50,000 where identifying the individual would require disproportionate effort.

   dlapiperdataprotection.com

6. 06EU adequacy maintained

   On 15 January 2024 the European Commission confirmed Switzerland's adequacy under the GDPR (replacing the 2000 decision under Directive 95/46/EC), so personal data can flow from the EU/EEA to Switzerland without additional safeguards such as Standard Contractual Clauses.

   edoeb.admin.ch bj.admin.ch

Timeline of decisions

1. 20 Mar 2025Enforcement · official
   FDPIC closes X/Twitter Grok AI preliminary investigation

   The Federal Data Protection and Information Commissioner (FDPIC) concluded its informal preliminary investigation into X (Twitter International Unlimited Company) after establishing that an opt-out mechanism for Grok AI training had been introduced since 16 July 2024. This is Switzerland's first significant AI data-processing enforcement action under the nFADP.

   FDPIC (EDÖB)

2. 14 Aug 2024Decision · official
   Federal Council issues Swiss-US Data Privacy Framework adequacy decision

   The Federal Council granted an adequacy decision for certified US companies under the new Swiss-US Data Privacy Framework (DPF); the implementing amendment to the Data Protection Ordinance took effect 15 September 2024, restoring a legal transfer mechanism for Swiss-US personal data flows after the lapse of Privacy Shield.

   Swiss Federal Council

3. 11 Apr 2024Enforcement · official
   FDPIC publishes Ricardo/TX Group investigation report on ad tracking

   The FDPIC found that Ricardo auction platform and its parent TX Group were processing personal data through pseudonymised usage data linked to cross-platform advertising, and recommended mandatory transparency disclosures and valid user consent, the first major nFADP-era enforcement report on adtech.

   Swiss Federal Council / FDPIC

4. 15 Jan 2024Decision · official
   European Commission reaffirms Swiss adequacy under GDPR

   The Commission published its first GDPR-era adequacy review report, confirming that Switzerland's modernised nFADP provides equivalent protections, allowing EU/EEA personal data to continue flowing freely to Switzerland without additional safeguards.

   FDPIC (EDÖB)

5. 9 Nov 2023Guidance · official
   FDPIC guidance: nFADP applies directly to AI systems

   The FDPIC issued an official position clarifying that the technology-neutral nFADP is immediately applicable to AI-supported data processing, requiring providers and users of AI to ensure transparency, purpose limitation, and data-subject rights without waiting for sector-specific AI legislation.

   FDPIC (EDÖB)

6. 7 Sept 2023Law · official
   Switzerland ratifies Council of Europe Convention 108+

   Switzerland ratified the modernised Convention 108+ (CETS 108), the only legally binding international data-protection instrument, adding algorithmic decision-making safeguards and mandatory breach notification to its international commitments.

   FDPIC (EDÖB)

7. 1 Sept 2023Law · official
   Revised Federal Act on Data Protection (nFADP) enters into force

   Switzerland's wholly overhauled data-protection law, plus the new Data Protection Ordinance (DPO) and Ordinance on Data Protection Certification (DPCO), came into force without transition period, introducing mandatory data-breach notification, DPIAs, privacy-by-design, and heightened personal criminal liability for individuals (fines up to CHF 250,000).

   Swiss Federal Administration (sme.admin.ch)

8. 31 Aug 2022Law · official
   Federal Council sets 1 September 2023 commencement and adopts implementing Ordinance

   The Federal Council fixed the entry-into-force date for the nFADP and adopted the revised Data Protection Ordinance (revDPO), detailing rules on data security standards, cross-border transfer mechanisms, data-protection advisors, and data-protection impact assessments.

   Federal Office of Justice (BJ)

9. 25 Sept 2020Law · official
   Swiss Parliament adopts totally revised Federal Act on Data Protection

   Parliament replaced the 1992 FADP with a GDPR-aligned statute introducing data-subject rights (access, portability, erasure), mandatory breach notification, privacy-by-design obligations, and strengthened FDPIC investigative and recommendation powers.

   Fedlex (Swiss Official Legislation)

10. 21 Nov 2019Law · official
    Switzerland signs Convention 108+ modernisation protocol

    Switzerland signed the amending Protocol to Convention 108 at the Council of Europe, committing to adopt enhanced protections for algorithmic decision-making, data-breach reporting, and accountability, a step that preceded and shaped the domestic nFADP revision.

    Council of Europe

11. 1 Jan 2018Law · official
    VÜPF Surveillance Ordinance Enters into Force, Data Retention Obligations for ISPs and Email Providers

    The revised Ordinance on Surveillance of Post and Telecommunications (VÜPF) implemented the 2016 BÜPF statute, placing concrete data retention and technical interception obligations on ISPs, email providers, and hosting services, with requirements calibrated by provider type and scale. This established the operational framework for lawful interception of internet communications.

    fedlex.admin.ch

12. 1 Jul 1993Law · official
    Original Federal Act on Data Protection (FADP/DSG) enters into force

    Switzerland's first comprehensive data-protection statute, adopted 19 June 1992, became operative, establishing foundational principles of data minimisation, purpose limitation, and individual access rights, one of the earliest national data-protection laws globally and the framework that governed Swiss privacy for 30 years.

    Fedlex (Swiss Official Legislation)

Sources

1. 1.edoeb.admin.ch/en
2. 2.edoeb.admin.ch/en/fdpic
3. 3.edoeb.admin.ch/en/new-fdpics-role
4. 4.edoeb.admin.ch/en/data-protection
5. 5.edoeb.admin.ch/en/guidelines-data-breach
6. 6.edoeb.admin.ch/en/15012024-eu-adequacy-decision-regarding-switzerland
7. 7.kmu.admin.ch/kmu/en/home/facts-and-trends/digitization/data-protection/new-federal
8. 8.bj.admin.ch/bj/en/home/staat/datenschutz/internationales/angemessenheit-ch.html
9. 9.dlapiperdataprotection.com/?t=law&c=CH