Federal Act on Data Protection

Article 1 Purpose

This legislation safeguards the fundamental rights and personal identity of individuals whose data is processed.

Article 2 Personal and material scope of application

The law covers processing of personal data by private persons and federal bodies, but excludes data processed by natural persons for purely personal use, data handled by parliament during deliberations, and data of organisations with diplomatic immunity. Court proceedings follow separate rules, while the law applies to first-instance administrative proceedings and public legal registers unless other federal laws provide specific rules.

Article 3 Territorial scope of application

The law applies when effects occur in Switzerland even if initiated elsewhere; private international law rules and criminal code provisions on territorial scope are preserved.

Article 4 Federal Data Protection and Information Commissioner

The FDPIC oversees compliance with federal data protection rules but does not supervise parliament, the federal council, federal courts, the attorney general's office for criminal matters, or federal authorities carrying out judicial functions or international mutual assistance in criminal cases.

Article 5 Definitions

The section defines fifteen key terms including personal data, sensitive personal data (religious, political, or health-related information, genetic data, identifying biometric data, criminal records, and social assistance data), profiling and high-risk profiling, data security breaches, controllers and processors, and federal bodies.

Article 6 Principles

Personal data must be processed lawfully, in good faith and proportionately; collection must have a recognisable specific purpose and further use must be compatible with that purpose; data must be destroyed or anonymised when no longer needed; controllers must ensure accuracy and take appropriate corrective measures; explicit consent is required for processing sensitive data and for high-risk or federal profiling.

Article 7 Data protection by design and data protection by default

Controllers must implement technical and organisational measures respecting data protection regulations from the planning stage, proportionate to the nature and extent of processing and the risk to data subjects' rights; default settings must restrict processing to the minimum necessary for the intended purpose unless data subjects specify otherwise.

Article 8 Data security

Controllers and processors must ensure data security proportionate to risk through appropriate technical and organisational safeguards capable of preventing security breaches. The Federal Council will set minimum security requirements.

Article 9 Processing by processors

Controllers may engage processors to handle personal data by contract or law if the processor handles data only as permitted for the controller and no statutory or contractual confidentiality obligation prevents this. Controllers must verify the processor can provide adequate data security, and processors need prior controller approval to engage third parties, though they may claim the same legal justifications as controllers.

Article 10 Data protection officer

Private controllers have the option to designate a data protection officer who acts as liaison with data subjects and Swiss data protection authorities and provides guidance on data protection compliance. The officer must act independently without instructions, not perform conflicting duties, possess appropriate qualifications, and have their contact details published and reported to the FDPIC. Federal bodies' appointment of data protection officers is regulated by the Federal Council.

Article 11 Code of conduct

Trade, professional or industry associations authorized to protect members' economic interests in their bylaws and federal bodies may propose conduct codes to the FDPIC for its assessment and public disclosure.

Article 12 Record of processing activities

Controllers and processors must each maintain processing activity records. Controllers' records must minimally identify the controller, state processing purposes, describe data subject and personal data categories, list recipient categories, and include retention periods or criteria, security measures, and details of any international disclosures with legal guarantees. Processors' records must identify both processor and controller, describe processing categories, and include the security and international disclosure information.

Article 13 Certification

Data system and program manufacturers, controllers and processors may submit their systems, products and services for evaluation by recognised independent certification bodies. The Federal Council will regulate certification body recognition and introduce a data protection quality mark, considering international law and technical standards.

Article 14 Representative

Foreign private controllers offering goods or services or monitoring behaviour of persons in Switzerland must appoint a Swiss representative if their processing is large-scale, regular, and poses high risk to personality. The representative serves as contact for data subjects and the FDPIC, with the controller publishing the representative's name and address.

Article 15 Duties of the representative

Representatives must maintain a processing activity record containing information specified for controllers, provide requested information from this record to the FDPIC, and on request inform data subjects how to exercise their rights.

Article 16 Principles

Personal data may be transferred abroad when the Federal Council determines the recipient state or international body provides adequate protection, or absent such a decision, when adequate protection is guaranteed by international treaty, controller-processor contractual clauses pre-noticed to the FDPIC, federal body guarantees pre-noticed to the FDPIC, FDPIC-approved standard data protection clauses, or FDPIC-approved or equivalently approved binding corporate rules. The Federal Council may authorise other suitable guarantees.

Article 17 Exceptions

Personal data may transfer abroad despite Article 16 requirements if the data subject explicitly consents, disclosure is directly connected with contract conclusion or performance with the data subject or their interests, disclosure is necessary for public interest protection or establishing or enforcing legal rights in court or foreign authority, disclosure is necessary for protecting life or physical integrity when timely consent is unobtainable, the data subject made it publicly accessible without prohibiting processing, or it originates from a public statutory register accessible to persons with legitimate interest. Controllers and processors must inform the FDPIC on request about disclosures involving contractual partners' interests, legal rights, or physical protection.

Article 18 Publication of personal data in electronic form

Making personal data generally accessible through automated services to inform the public is not considered overseas disclosure even if accessible from abroad.

Article 19 Duty to provide information when collecting personal data

Article 20 Exceptions from the duty to provide information and restrictions

The obligation to inform ceases when the data subject already possesses the information, processing is legally mandated, the controller is bound by statutory confidentiality, or Article 27 requirements apply. For non-directly collected data, the obligation also ceases if providing information is impossible or demands unreasonable effort. Controllers may restrict, delay or withhold disclosure in specific circumstances: when required by third-party interests, when disclosure would undermine the processing's purpose, when private controllers have overriding interests without third-party disclosure, or when federal bodies require it for security or investigative reasons.

Article 21 Duty to provide information in the case of an automated individual decision

Controllers must inform data subjects about automated decisions with legal or significant adverse consequences and must allow them to comment and request human review. These requirements do not apply when the automated decision directly concerns contract formation or processing and the request is granted, or when the data subject has explicitly approved automation. Federal bodies must label automated decisions and human review does not apply if not required under the Administrative Procedure Act or other federal law.

Article 22 Data protection impact assessment

Controllers must carry out a data protection impact assessment before processing likely to create high risk to a data subject's personality or fundamental rights, assessed considering the nature, extent, circumstances and purpose of processing; high risk arises particularly in large-scale processing of sensitive data or systematic large-scale monitoring of public areas. The assessment must describe the planned processing, evaluate risks, and detail protective measures. Private controllers are exempt if required by law to process the data, or may dispense with the assessment if using a certified system for the intended use or complying with a code of conduct that is based on an impact assessment, provides protective measures, and has been submitted to the FDPIC.

Article 23 Consultation of the FDPIC

If a data protection impact assessment indicates that planned processing will still pose high risk despite the controller's planned measures, the controller must seek the FDPIC's opinion beforehand. The FDPIC must respond within two months, extendable by one month for complex data processing, and if objecting must propose suitable measures. Private controllers may dispense with FDPIC consultation if they have consulted their data protection officer.

Article 24 Notifications of data security breaches

Controllers must notify the FDPIC as quickly as possible of any breach likely to create high risk to a data subject's personality or fundamental rights, specifying the breach's nature, consequences, and measures taken or planned. Processors must notify controllers of breaches as quickly as possible. Controllers must inform data subjects if necessary for protection or if the FDPIC requests, though they may limit, delay or dispense with notification if disclosure is prohibited by confidentiality obligations, is impossible or requires disproportionate effort, or is equally guaranteed by public announcement.

Article 25 Right to information

Individuals may ask controllers whether their personal data is processed and receive transparency information including controller identity, the data itself, purposes, retention or determination criteria, data sources, details of automated decisions, and recipient information. Data subjects may authorize a chosen health professional to receive their health data. Controllers remain accountable for information duties even when delegating processing.

Article 26 Limitations on the right to information

A controller may refuse, restrict or delay providing information if required by law, to protect overriding third-party interests, or if a request is clearly unjustified. Private persons may refuse if their overriding interests require it and they do not intend to share the data, while federal bodies may refuse to protect overriding public interests or avoid compromising enquiries or proceedings. Controllers must state reasons for any refusal, restriction or delay.

Article 27 Limitation on the right to information for the media

Controllers publishing personal data in periodicals may refuse, restrict or delay providing information if it would reveal sources, give access to drafts, or compromise public opinion formation. Journalists may also refuse if using the data solely for their personal work.

Article 28 Right to data portability

Data subjects may request a controller to provide their personal data in an electronic format if the controller carries out automated processing and the data were processed with consent or in connection with a contract. Data subjects may also request transfer to another controller if no disproportionate effort is involved. Delivery or transfer must be free of charge, though the Federal Council may allow exceptions for disproportionate effort.

Article 29 Restrictions on the right to data portability

A controller may refuse, restrict or delay delivering or transferring personal data using the same grounds as for refusing information requests under Article 26, and must provide reasons for any refusal, restriction or delay.

Article 30 Breaches of personality rights

Any person processing personal data must not unlawfully breach subjects' personality rights, particularly by processing contrary to core principles, against express wishes, or by disclosing sensitive data to third parties. No breach occurs if data subjects make data generally accessible and have not explicitly prohibited processing.

Article 31 Grounds for justification

Personality rights violations become lawful through data subject consent, overriding private or public interests, or legal authorization. Overriding interests include processing contracting party data for contract performance, competing with others using undisclosed data, verifying creditworthiness (excluding sensitive data and high-risk profiling, limited to parties requiring it for contracts, data under ten years old, and adults only), processing for publication by media, processing for non-person-specific purposes like research and statistics (with anonymization or identification prevention and appropriate handling of sensitive data), and collecting public figures' data on their public activities.

Article 32 Legal rights

Data subjects may request correction of incorrect data unless prohibited by law or archived for public interest, may seek court orders to prohibit processing or disclosure or require deletion, destruction or marking as disputed, and may request that any remedies be communicated or published to third parties.

Article 33 Control and responsibility in the case of the joint processing of personal data

The Federal Council shall establish procedures for overseeing data protection and allocating responsibility when federal bodies jointly process data with other federal bodies, cantonal authorities, or private entities.

Article 34 Legal basis

Federal bodies may only handle personal data when a law permits it. A formal law is required for processing sensitive data, profiling, or data handling likely to seriously harm fundamental rights. A substantive law suffices for these categories if processing is essential for a task mandated by formal law and poses minimal fundamental rights risks.

Article 35 Automated data processing as part of pilot trials

The Federal Council may authorise automated processing of sensitive data or other restricted processing during pilot trials before a formal law takes effect, if underlying tasks are already regulated in force, protective measures limit fundamental rights harm, and testing is essential for practical implementation. The Federal Council must consult the data protection authority first, the responsible body must report within two years proposing continuation or discontinuation, and processing must stop if no formal law establishing the legal basis comes into force within five years.

Article 36 Disclosure of personal data

Federal bodies may only disclose personal data under the same legal basis requirements as processing. They may disclose without such basis in specific cases: to fulfil a statutory duty, with data subject consent, to protect life or physical integrity without time for consent, when data subject made data public without prohibition, or when a recipient shows the data subject refused consent to prevent legal enforcement and the data subject had opportunity to comment. Bodies may disclose as public information under the Freedom of Information Act if data relates to public duties and overriding public interest exists.

Article 37 Objecting to the disclosure of personal data

A data subject showing credible legitimate interest may object to disclosure of specific personal data by a federal body. The body must reject the objection if a legal duty requires disclosure or fulfilling tasks would otherwise be jeopardised, with public interest disclosure rules reserved.

Article 38 Offering documents to the Federal Archives

Federal bodies must offer the Federal Archives any personal data they no longer regularly use; if the Archives declines, bodies must destroy this data unless it is anonymized or necessary for legal, security, or legitimate interest reasons.

Article 39 Data processing for purposes not related to specific persons

Federal bodies may process personal data for research, planning or statistics without identifying data subjects if data are anonymised as soon as possible, sensitive data disclosed to non-public persons only anonymously, recipients do not share data with third parties without body consent, and results are published anonymously. Special requirements for legal basis and specific disclosures do not apply to this category.

Article 40 Private law activities by federal bodies

When federal bodies act under private law, the rules governing personal data processing by private persons apply instead of public body rules.

Article 41 Rights and procedures

Any person with legitimate interest may ask a federal body to stop unlawful data processing, redress its consequences, or declare it unlawful; may request correction, deletion, destruction, or notification of such decisions to third parties. Instead of deleting or destroying data, the body shall restrict processing if accuracy is disputed and unverifiable, third parties have overriding interests, an overriding public interest exists, or deletion may jeopardise investigations or proceedings. If accuracy is unverifiable, the body shall mark data as disputed.

Article 42 Procedure for disclosing official documents that contain personal data

In proceedings about access to official documents containing personal data under the Freedom of Information Act, a data subject may exercise the same rights they have under the data protection act regarding those documents.

Article 43 Election and status

The Federal Assembly elects the head of the Federal Data Protection and Information Commissioner (FDPIC) from any person with federal voting rights. The Commissioner works independently without taking instructions from any authority, is assigned to the Federal Chancellery for administrative purposes, maintains a secretariat and separate budget, appoints their own staff, and is employed under the Federal Personnel Act with retirement cover through PUBLICA until age 68 if requested.

Article 44 Term of office, re-election and termination of office

The Commissioner serves four-year terms that may be extended twice, beginning on 1 January following the start of a National Council legislature. The Commissioner may terminate their contract with six months' notice, or shorter with Judiciary Committee approval. The Federal Assembly may remove the Commissioner before term end for serious violation of official duties through wilfulness or gross negligence, or permanent incapacity to perform duties.

Article 45 Budget

The FDPIC submits their annual draft budget through the Federal Chancellery to the Federal Council, which must submit it unchanged to the Federal Assembly.

Article 46 Incompatibility

The Commissioner cannot serve as a legislator or executive branch official, and cannot hold any work relationship with the national government.

Article 47 Additional occupation

The Commissioner is prohibited from having additional occupations, but the Judicial Committee may permit one if it does not adversely affect duty performance, independence, or FDPIC reputation, with the decision published. When recusal disputes arise, the president of the competent Federal Administrative Court division decides.

Article 48 Self-regulation of the FDPIC

The FDPIC must employ suitable control measures, particularly regarding data security, to ensure legally compliant implementation of federal data protection regulations within the office.

Article 49 Investigation

The FDPIC investigates federal bodies or private persons for potential data protection violations either on their own initiative or based on reports, and may decline to investigate minor violations. The investigated party must provide all necessary information and documents, with information refusal rights governed by Administrative Procedure Act provisions unless superseded. If a data subject filed the report, they must be informed of investigation steps and results.

Article 50 Powers

When a federal body or private entity does not cooperate, the FDPIC may order access to relevant information, documents, records, and premises, may question witnesses, and may commission expert evaluations; professional secrecy is preserved. The FDPIC may call on other federal authorities and regional or municipal police to enforce these measures.

Article 51 Administrative measures

The FDPIC may order modification, suspension, or termination of data processing and deletion or destruction of personal data. The FDPIC may delay or prohibit foreign disclosure if it violates requirements or provisions about disclosure abroad, and may order that bodies or persons provide information, take specified data protection measures, inform data subjects, conduct impact assessments, consult the FDPIC, and provide information to subjects. For foreign private controllers, the FDPIC may order appointment of a representative.

Article 52 Procedure

Investigation proceedings and rulings by the FDPIC follow the Administrative Procedure Act. Only the federal body or private person subject to investigation is a party to proceedings. The FDPIC may appeal decisions of the Federal Administrative Court.

Article 53 Coordination

Federal authorities supervising private persons under other laws must invite the FDPIC to comment before issuing rulings on data protection matters. When the FDPIC investigates the same party, both authorities must coordinate their proceedings.

Article 54 Administrative assistance between Swiss authorities

Federal and cantonal authorities must provide the FDPIC with information and personal data needed for its duties. The FDPIC must provide information and personal data to authorities responsible for data protection, prosecution authorities for reported offences, and police for implementing enforcement measures.

Article 55 Administrative assistance for foreign authorities

The FDPIC may share information or personal data with foreign data protection authorities if mutual administrative assistance is ensured, use is limited to the specific data protection proceeding, the recipient keeps professional and commercial secrets confidential, onward disclosure requires prior consent, and recipient respects the providing authority's conditions. The FDPIC may provide controller and processor identities, data subject categories, data subject identities where subjects have consented or disclosure is essential for statutory duties, categories and purposes of processing, recipient categories, and technical or organisational safeguards. Before sharing secrets, the FDPIC must notify affected parties and allow comment unless impracticable.

Article 56 Register

The FDPIC must maintain and publish a register documenting the processing activities of federal bodies.

Article 57 Information

Each year the FDPIC reports activities to the national legislature and concurrently to the executive, with the report published. On matters of broad significance, the FDPIC makes findings and decisions public.

Article 58 Further tasks

The FDPIC shall inform, train and advise on data protection, support cantonal and foreign data protection bodies, raise public awareness especially for vulnerable persons, provide data subjects with information on exercising rights, comment on draft legislation involving data processing, carry out duties under the Freedom of Information Act, and develop good practice recommendations. The FDPIC may advise federal bodies outside its supervision and inspect their files with permission. The FDPIC may declare direct service as permitted in Switzerland to foreign authorities if reciprocal rights are granted.

Article 59 FDPIC fees for services

The FDPIC charges private persons for conduct code opinions, approval of standard clauses and binding corporate rules, data protection impact assessment consultation, precautionary and corrective measures, and data protection advice. The executive sets fee amounts and may allow waiver or reduction in specified circumstances.

Article 60 Violation of obligations to provide access and information or to cooperate

Private persons who wilfully provide false or incomplete information in fulfilling duties on access and information, or who wilfully fail to provide required information to data subjects, are subject to fines not exceeding 250,000 francs on complaint. The same penalty applies to those who wilfully provide false information to the FDPIC or fail to cooperate in investigations.

Article 61 Violation of duties of care

A fine up to 250,000 francs may be imposed on private persons who intentionally disclose personal data outside the country in breach of the geographic restriction requirements, engage a processor without meeting required safeguards, or fail to meet minimum security standards set by the executive.

Article 62 Violation of the professional duty of confidentiality

Anyone who wilfully discloses secret personal data acquired in a professional capacity or while training with a confidentiality-bound person is liable to fines not exceeding 250,000 francs on complaint. Such disclosure remains an offence even after ceasing the profession or completing training.

Article 63 Disregard of decisions

Private persons who wilfully fail to comply with rulings by the FDPIC or decisions of appeal courts referencing this penalty are liable to fines not exceeding 250,000 francs.

Article 64 Corporate criminal liability

Business criminal responsibility follows the general administrative criminal law rules. When considering a fine not exceeding 50,000 francs and identifying perpetrators would require disproportionate effort, the authority may instead require the business to pay the fine without pursuing individuals.

Article 65 Jurisdiction

Cantons have jurisdiction to prosecute and adjudicate criminal acts under this law. The FDPIC may file complaints with competent prosecution authorities and exercise rights as a private claimant in proceedings.

Article 66 Statute of limitations for prosecution

Criminal prosecution must be commenced within five years.

Article 67 International treaty authority

The Federal Council may negotiate and enter into international agreements on data protection authority cooperation and on recognizing adequacy of data protection for cross-border personal data transfers.

Article 68 Repeal and amendment of other legislation

Annex 1 specifies which laws are repealed and which are amended by this Act.

Article 69 Transitional provisions relating to ongoing instances of processing

Rules governing processor appointment and data protection impact assessment do not apply to processing that started before the Act's entry into force if the processing objective stays the same and no additional data are collected.

Article 70 Transitional provision relating to ongoing proceedings

This Act does not apply to ongoing investigations by the federal data protection authority or to appeals against decisions issued before the Act came into force; such cases continue under the previous law.

Article 71 Transitional provision relating to the data of legal entities

Federal bodies may apply existing federal legislation to data of legal entities for five years after the Act comes into force, and may continue disclosing such data under specified prior legislation for the same five-year period if authorized to disclose personal data.

Article 72 Transitional provision relating to the Commissioner's election and termination of office

Until the current legislative term ends, the Commissioner's election and term follow the prior law; if the sitting Commissioner is reelected on the first ballot, the new term starts the day after election. Prior law governs an incumbent Commissioner's employment contract where one existed.

Article 73 Coordination

Article 74 Referendum and commencement

This Act is subject to optional referendum; the Federal Council sets the commencement date, which is 1 September 2023.