What is the new privacy law in Switzerland and what changed under the FADP?

The revised Federal Act on Data Protection (FADP) entered into force on 1 September 2023. It introduced expanded data subject rights, mandatory DPIAs for high‑risk processing, broader definitions of sensitive data covering genetic and biometric information, and criminal penalties of up to CHF 250,000 against responsible individuals.

How do Swiss rules affect cross‑border transfers to the US?

The Federal Council has recognised the Swiss–US Data Privacy Framework as adequate. Transfers to DPF‑certified US recipients can proceed without additional safeguards. Transfers to non‑certified US recipients require standard contractual clauses or equivalent measures.

What must companies do to comply with the revised FADP in 2026?

Companies must maintain records of processing activities, conduct DPIAs where required, ensure a lawful basis for every cross‑border transfer, update privacy notices, and have a tested breach notification process in place.

When must DPOs notify breaches under the new rules?

Controllers must notify the FDPIC “as soon as possible” of breaches likely to pose a high risk. The FDPIC recommends targeting notification within 72 hours. Processors must notify controllers without undue delay.

Do I need to update my data transfer agreements for US vendors?

Yes. Insert DPF reliance clauses for certified vendors and retain contractual fallback provisions (such as standard contractual clauses) in case certification lapses. Review and update agreements annually.

How can I verify a vendor is DPF‑certified?

Search the official registry at dataprivacyframework.gov using the vendor’s legal entity name. Confirm the status is “Active” and that the Swiss–US DPF extension is listed.

What are practical fallback measures if a US vendor is not DPF‑certified?

Execute standard contractual clauses or an equivalent data transfer agreement, conduct a transfer risk assessment, and implement supplementary technical measures such as encryption or pseudonymisation where necessary to ensure adequate protection.

Data Privacy Lawyers Switzerland

Last reviewed: 9 May 2026

Switzerland’s revised Federal Act on Data Protection (FADP), in force since 1 September 2023, has now moved from a transitional phase into active enforcement, making the guidance of experienced data privacy lawyers in Switzerland indispensable for every organisation that processes personal data in or from the country. The Federal Council’s recognition of the Swiss–US Data Privacy Framework (DPF) as an adequate safeguard for transfers to certified US recipients has added a powerful new transfer mechanism, but one that demands careful verification and contractual planning. Meanwhile, the Federal Data Protection and Information Commissioner (FDPIC) continues to sharpen its supervisory posture, and penalties under the FADP can reach CHF 250,000 against responsible individuals.

This compliance roadmap sets out exactly what in‑house counsel, DPOs and compliance managers at Swiss SMEs and tech vendors need to do now.

Three urgent actions for 2026:

Assess every US vendor, confirm whether each recipient is DPF‑certified via the official registry at dataprivacyframework.gov.
Update data transfer agreements, insert DPF reliance clauses where applicable and retain contractual fallbacks (standard contractual clauses or equivalent) for non‑certified recipients.
Operationalise your breach process, ensure your notification workflow meets the FADP’s “as soon as possible” standard with documented internal escalation timelines.

What Changed Under the Revised FADP, Essential Legal Highlights

The revised FADP replaced Switzerland’s 1992 data protection statute in its entirety on 1 September 2023. Its purpose was to align Swiss law more closely with the EU’s GDPR while preserving distinctly Swiss features, most notably, criminal liability directed at natural persons rather than corporations. By 2026, the transitional period during which organisations were expected to adapt has effectively concluded, and the FDPIC treats full FADP compliance as the operational baseline.

Key changes that data privacy lawyers in Switzerland advise on include the expansion of the definition of “sensitive personal data” to cover genetic and biometric data, a new right to data portability, mandatory data protection impact assessments (DPIAs) for high‑risk processing, a duty to maintain records of processing activities, and a significantly strengthened cross‑border transfer regime that requires an adequate level of protection in the recipient country, or, absent that, appropriate safeguards such as standard contractual clauses or binding corporate rules.

The enforcement architecture also shifted. The FDPIC gained wider investigative powers, including the authority to order corrective measures, while criminal sanctions of up to CHF 250,000 now target the natural person responsible for a violation, typically a senior executive, DPO or compliance officer, rather than the corporate entity itself.

Key FADP Changes at a Glance

Area	Former Position (1992 Act)	Revised FADP (in force 1 September 2023)
Scope of sensitive data	Limited catalogue (religion, health, etc.)	Expanded to include genetic and biometric data
Data portability	No statutory right	New right to receive or have data transmitted in a common electronic format
Data protection impact assessments	Not required	Mandatory where processing poses a high risk to personality or fundamental rights
Penalties	Minimal sanctions; rarely enforced	Fines of up to CHF 250,000 against responsible natural persons; wilful violations of duties of care, professional secrecy and cross‑border transfer rules

Who This Affects, Controllers, Processors and Cross‑Border Actors

The revised FADP applies to all private persons and federal bodies that process personal data. In practice, this means Swiss‑domiciled controllers (companies deciding the purpose and means of processing), processors (service providers acting on a controller’s instructions), and foreign entities whose processing activities have an effect in Switzerland. The obligations are not identical for each role.

Obligations by Entity Type

Entity Type	Core Obligations	Who Must Act
Controller (enterprise)	Maintain processing records, conduct DPIAs, ensure lawful transfer basis, appoint privacy advisor (optional but recommended), notify breaches	DPO / General Counsel / Board
Controller (SME with < 250 staff and low‑risk processing)	May be exempt from record‑keeping duty; all other obligations remain	Managing director / external DPO
Processor	Process data only per controller instructions, ensure data security, notify controller of breaches without delay, obtain controller consent before engaging sub‑processors	Account management / compliance team
Foreign entity with effect in Switzerland	Appoint a representative in Switzerland, comply with all FADP obligations	Local representative / Swiss counsel

Swiss–US Data Privacy Framework (DPF), What It Is and Its Practical Effect

The Swiss–US Data Privacy Framework is the adequacy mechanism that allows Swiss controllers and processors to transfer personal data to US organisations that have self‑certified under the DPF, without the need for additional contractual or organisational safeguards. The Federal Council formally recognised the DPF as providing an adequate level of data protection, enabling Swiss companies to rely on it as a standalone legal basis for transfers to certified US recipients under the FADP’s cross‑border transfer rules.

This recognition is significant because it replaces, for DPF‑certified recipients, the need to execute standard contractual clauses, negotiate bespoke data transfer agreements, or conduct a detailed transfer impact assessment. Industry observers expect most mid‑sized Swiss tech companies to prefer DPF reliance wherever possible, given its lower operational friction. However, the DPF applies only to US organisations that maintain active certification. If a vendor allows certification to lapse, or if it was never certified, the controller must fall back on alternative transfer mechanisms immediately. For a detailed walkthrough of the DPF certification verification process, see our guide on Swiss–US Data Privacy Framework compliance in 2026.

When Can You Rely on the DPF?

Before invoking DPF adequacy as your sole legal basis for a US transfer, confirm every item on this checklist:

Active certification. The US recipient appears on the official DPF list at dataprivacyframework.gov with a current status (not “inactive” or “withdrawn”).
Scope match. The recipient’s certification covers the type of data you are transferring (HR data and non‑HR data are certified separately).
Swiss extension. The recipient has elected to extend its DPF certification to cover the Swiss–US DPF specifically, not only the EU–US DPF.
Documentation. You have recorded your reliance on DPF adequacy in your records of processing activities and in your privacy notice to data subjects.

Practical Steps to Verify a US Vendor’s DPF Status

Visit the public search tool at dataprivacyframework.gov and search by the vendor’s legal entity name. Confirm the entry shows “Active” status and lists the “Swiss–US Data Privacy Framework” extension. Where verification is unclear, for example, where a vendor operates through subsidiaries, send a written request to the vendor’s designated privacy contact asking them to confirm (a) the certifying entity name, (b) the scope of certification, and (c) the date of last annual re‑certification.

Cross‑Border Data Transfers Compared, DPF vs Contractual Measures vs Other Options

Swiss controllers transferring personal data abroad must ensure the recipient country provides adequate protection or implement appropriate safeguards. The FDPIC publishes a list of countries recognised as having adequate protection. For countries not on the list, or for US recipients that are not DPF‑certified, contractual or organisational safeguards are required. The table below provides a practical comparison of the three primary mechanisms.

Mechanism	When to Use	Immediate Steps for Counsel
Swiss–US DPF (adequacy)	US vendor is DPF‑certified with Swiss extension; lowest friction	Verify vendor on DPF registry; document reliance in processing records; update privacy notices
Standard Contractual Clauses / Data Transfer Agreement	Vendor is not DPF‑certified; transfers to countries without adequacy recognition	Execute appropriate clauses (EU SCCs are widely used as a reference); conduct a transfer risk assessment; perform DPIA if high‑risk processing involved
Supplementary technical measures (encryption, pseudonymisation)	Where legal basis alone is insufficient to mitigate identified risks, or as an added layer of protection	Implement end‑to‑end encryption or pseudonymisation; document effectiveness; review annually
Binding Corporate Rules (BCRs)	Intra‑group transfers within multinational corporate groups	Draft and submit BCRs for approval by competent authorities; align with FADP requirements
Explicit consent of the data subject	One‑off or exceptional transfers only; not suitable for systematic processing	Obtain informed, specific, freely given consent; document the consent record

The likely practical effect of the DPF recognition is that Swiss companies will increasingly bifurcate their US vendor portfolio: DPF‑certified vendors will be managed under the adequacy pathway, while non‑certified vendors will require a more resource‑intensive contractual approach. In‑house counsel should maintain a live tracker of every US vendor’s DPF status and set calendar reminders to re‑verify certification annually.

Drafting and Updating Data Transfer Agreements, Sample Clauses and Checklist

Even where the DPF provides the primary legal basis, best practice among data privacy lawyers in Switzerland is to include contractual fallback provisions. This protects the controller if a vendor’s DPF certification lapses or is revoked. Below are three sample clauses that can be adapted for use in data processing agreements and data transfer agreements.

Sample Clause A, DPF Reliance:

“The Importer warrants that it maintains active certification under the Swiss–US Data Privacy Framework, including the Swiss extension, and will notify the Exporter in writing within five (5) business days if its certification status changes.”

Sample Clause B, Contractual Fallback:

“In the event that the Importer’s DPF certification lapses, is revoked, or ceases to be recognised as adequate under Swiss law, the parties agree that the Standard Contractual Clauses annexed hereto shall apply automatically as the legal basis for ongoing transfers.”

Sample Clause C, Audit and Cooperation:

“The Importer shall, upon reasonable notice, make available to the Exporter documentation sufficient to demonstrate compliance with the applicable transfer mechanism, and shall cooperate with any audit or investigation by the FDPIC.”

Contract Review Checklist

Identify the signatory. Ensure the DPF‑certified entity, not a parent or affiliate, is the contracting party.
Confirm scope alignment. Match the categories of personal data transferred against the vendor’s DPF certification scope.
Insert the fallback clause. Annex standard contractual clauses and reference them expressly in the contract body.
Retain evidence. Save a timestamped screenshot of the vendor’s DPF registry entry at the time of contract execution.
Set a review date. Schedule an annual review to re‑verify DPF status and update records of processing.

Red flags when negotiating with US cloud providers: Refusal to confirm the certifying entity name; insistence on broad sub‑processor discretion without notice; reluctance to accept fallback SCC provisions; and absence of a designated privacy contact for Swiss‑specific queries.

DPO Obligations, Records and Breach Notification Under the Revised FADP

The revised FADP requires controllers to notify the FDPIC “as soon as possible” of any data breach that is likely to result in a high risk to the personality or fundamental rights of data subjects. Unlike the GDPR’s fixed 72‑hour deadline, the FADP uses an open‑ended standard, but the FDPIC has indicated in its guidance that notification should occur promptly and without unnecessary delay, and that controllers should aim to report within 72 hours in line with international best practice.

Processors must notify the controller without undue delay upon becoming aware of a breach. Notification to data subjects is required where it is necessary for their protection or where the FDPIC orders it.

Breach Notification Obligations by Entity Type

Entity	When to Notify the FDPIC	When to Notify Data Subjects
Controller	As soon as possible after becoming aware of a breach likely to pose a high risk	Where necessary to protect data subjects, or on FDPIC order
Processor	Not directly, must notify controller without undue delay	Only if contractually obligated by the controller or directed by the FDPIC

Recommended Internal Breach Response Timeline

0–24 hours: Detect and contain the breach; activate the incident response team; perform initial assessment of risk level and categories of data affected.
24–72 hours: Complete risk evaluation; prepare the notification to the FDPIC (using the FDPIC’s recommended reporting template); determine whether data subjects must be notified.
72 hours – 7 days: Submit notification to the FDPIC; notify affected data subjects if required; document all steps taken and retain evidence for the breach register.

DPO obligations also include maintaining accurate and up‑to‑date records of processing activities, ensuring that DPIAs are conducted for high‑risk processing, and acting as the contact point for the FDPIC. Even where appointing a DPO or privacy advisor is not legally mandatory, the FDPIC recommends it, and industry observers expect regulators to scrutinise entities that lack one more closely in enforcement proceedings.

Enforcement, Penalties and Litigation Risk Under the FADP

Penalties under the FADP target responsible individuals, not entities, with fines of up to CHF 250,000 for wilful violations of obligations including duties of information and disclosure to data subjects, the duty of care when engaging processors, and cross‑border transfer rules. Negligent violations can result in fines of up to CHF 50,000 in certain categories. Criminal proceedings are initiated on complaint or, for specific offences, ex officio.

The FDPIC can also issue administrative orders, including orders to modify, suspend or cease processing operations, and orders to delete personal data. Early indications suggest the FDPIC is prioritising cross‑border transfer compliance and breach notification failures in its supervisory activities.

Risk Matrix for Common Non‑Compliance Scenarios

Risk Level	Scenario	Recommended Action
High	Transferring data to a non‑DPF‑certified US vendor without contractual safeguards	Halt transfer immediately; execute SCCs or equivalent; conduct transfer risk assessment
Medium	Records of processing activities incomplete or outdated	Audit and update records within 30 days; assign internal owner for ongoing maintenance
Low	Privacy notice does not reference DPF reliance for US transfers	Update privacy notice at next scheduled review; document the change

Quick 10‑Step FADP Compliance Roadmap for Swiss SMEs and Vendors

Immediate: Inventory all cross‑border data transfers, identifying recipient countries and legal bases.
Immediate: Verify DPF certification status for every US vendor via dataprivacyframework.gov.
By Q3 2026: Update all data transfer agreements with US vendors, insert DPF reliance clauses and contractual fallbacks.
By Q3 2026: Complete or refresh DPIAs for all high‑risk processing activities.
By Q3 2026: Update records of processing activities to reflect current transfer mechanisms and legal bases.
By Q4 2026: Revise privacy notices to inform data subjects of DPF reliance and cross‑border transfer details.
By Q4 2026: Establish or test your data breach notification workflow against the recommended 72‑hour target.
Ongoing: Schedule annual re‑verification of every US vendor’s DPF certification.
Ongoing: Train staff with access to personal data on revised FADP obligations, breach escalation and data subject rights.
Ongoing: Monitor FDPIC enforcement decisions and guidance updates for changes to supervisory expectations.

When to Engage Data Privacy Lawyers in Switzerland

While routine FADP compliance tasks can be managed internally, certain situations warrant engagement of specialist data privacy lawyers in Switzerland. Common triggers include:

Complex DPIAs, where processing involves large‑scale profiling, novel technology (including AI), or sensitive data categories.
Cross‑border data breach incidents, particularly those involving regulatory notifications to the FDPIC and parallel notifications in EU jurisdictions.
Litigation or regulatory proceedings, where the FDPIC has issued an investigation notice or a data subject has filed a complaint.
High‑risk transfers, to jurisdictions without adequacy recognition, or transfers to US vendors whose DPF status is disputed or lapsed.
Vendor contract negotiations, where a US cloud provider or SaaS vendor resists standard Swiss contractual protections.

For referrals to qualified practitioners, consult the Switzerland lawyer directory on Global Law Experts.

Need Legal Advice?

This article was produced by Global Law Experts. For specialist advice on this topic, contact Alexandros Manousakis at Privintelligent Solutions, a member of the Global Law Experts network.