Switzerland nFADP Guide: Revised Data Protection Act Duties for Organisations

Switzerland's revised Federal Act on Data Protection (nFADP, SR 235.1) is close to the GDPR in substance but different where it hurts: fines fall on the responsible individual, not the company, and the security duties are made concrete by an ordinance with specific logging and documentation rules. The revised Act and the Data Protection Ordinance (DPO, SR 235.11) have applied since 1 September 2023, with no transition period. This guide covers who and what the law reaches, the duties security teams own (Art. 8 data security, Art. 24 breach notification to the Federal Data Protection and Information Commissioner (FDPIC), DPIAs, records, cross-border disclosure under Art. 16 and 17), enforcement and the criminal sanctions on individuals, and what the law means for AI agents and machine identities. It concentrates on differences from the GDPR and is for CISOs, data protection advisers, security architects and legal teams at Swiss organisations and at foreign organisations whose processing has effects in Switzerland. Status was checked on admin.ch and the FDPIC's site in October 2026.

Key takeaways

• Individuals are personally liable. Wilful breaches of named duties, including failing to meet the minimum data security requirements, carry criminal fines of up to CHF 250,000 imposed on the responsible person; a company is fined (up to CHF 50,000) only where finding that person would be disproportionate.
• The DPO makes security specific. It sets protection goals, lists measures (including fixing known critical vulnerabilities), and requires logging for high-risk processing, with logs kept at least one year, separate from the system.
• Breach notification has no fixed hour count. Breaches likely to create a high risk go to the FDPIC "as soon as possible"; processors must report every breach to the controller, without a risk threshold.
• Transfers follow a Swiss list. Disclosure abroad relies on the Federal Council's adequacy list in Annex 1 DPO, which since 15 September 2024 includes US organisations certified under the Swiss-US Data Privacy Framework, or on recognised clauses and other safeguards.
• The FDPIC investigates but does not fine. It can order processing to be changed, suspended or deleted; fines are imposed by cantonal prosecutors.

Scope: who and what is covered

• Who is protected: natural persons only. Data about legal entities is no longer covered by the FADP, a change from the 1992 Act.
• Who has duties: private persons and federal bodies; cantonal bodies fall under cantonal laws.
• Territorial reach (Art. 3): the Act applies to circumstances that have an effect in Switzerland, even if initiated abroad. A foreign online shop or SaaS provider serving Swiss users is in scope.
• Swiss representative (Art. 14): a foreign private controller must appoint one only if its processing of people in Switzerland is linked to offering them goods or services or monitoring them, and is large-scale, regular and high-risk, all four together.

Key definitions (Art. 5)

Key obligations

Data security: Art. 8 FADP and Art. 1 to 6 DPO

Art. 8 requires controllers and processors to ensure security appropriate to the risk through technical and organisational measures, and gives the Federal Council power to set minimum requirements. The DPO does so:

Art. 61(c) FADP makes wilful failure to meet these minimum requirements a criminal offence, which is why Swiss security leads document their DPO mapping carefully. The FDPIC's logging recommendations (September 2023) add detail: log the identity of the person or machine, store logs where a ransomware compromise of the processing system cannot reach them, check logs for completeness and tampering, use standard formats such as Syslog or CEF with NTP-synchronised clocks, and do not use logs to monitor staff behaviour. See the Log Management and Retention Guide.

Breach notification: Art. 24 FADP and Art. 15 DPO

• Threshold: notify the FDPIC as soon as possible where a breach is likely to result in a high risk to the personality or fundamental rights of the data subject.
• Content (Art. 15 DPO): nature of the breach; time and duration; categories and approximate amount of data; categories and approximate number of people; consequences and risks; measures taken or planned; a contact person. Missing items can follow later.
• Channel: mandatory reports go through the FDPIC's online reporting portal; voluntary reports are accepted outside it.
• Processors: must inform the controller of every breach as soon as possible, with no high-risk filter.
• Data subjects: inform them if necessary for their protection (for example, to change passwords or block cards) or if the FDPIC requires it.
• Documentation: record every breach and keep the documentation for at least two years from the report.
• Protection of the reporter: under Art. 24(6) a report may be used in criminal proceedings against the reporter only with consent.

The FDPIC guidance (version 1.2, April 2025) is practical: do not wait for long investigations; a ransomware attack may require an initial assumption of high risk; measures planned after the breach do not reduce the assessed risk; properly encrypted data is generally treated as anonymous for unauthorised parties. It also notes that failing to report is not itself a criminal offence under the FADP, though the FDPIC can order the information. Compare other regimes in the Breach Notification Laws by Country Guide.

DPIA and prior consultation: Art. 22 and 23

A DPIA is required where processing is likely to lead to a high risk, particularly large-scale processing of sensitive data or systematic large-scale monitoring of public areas. Private controllers may skip it when using a certified system or product, or following a code of conduct that meets the Act. If high residual risk remains, the FDPIC must be consulted beforehand; it answers within two months, extendable by one. A private controller that has appointed a data protection adviser under Art. 10 can consult the adviser instead. The DPIA must be kept for at least two years after processing ends (Art. 14 DPO). See the DPIA Guide.

Cross-border disclosure: Art. 16 and 17

Under Art. 19 the privacy notice must name the destination countries and the safeguard or exception used. Wilful unlawful disclosure abroad is a criminal offence under Art. 61(a). See the International Data Transfers Map and the EU-US Data Privacy Framework Guide.

Other duties

• Privacy by design and default (Art. 7): apply processing principles from the planning stage; by default limit processing to what the purpose needs.
• Processors (Art. 9): a processor may only process as the controller could; the controller must be satisfied the processor can guarantee security; sub-processing needs prior approval.
• Records of processing (Art. 12, Art. 24 DPO): required, except for organisations with fewer than 250 employees on 1 January, unless they process a large volume of sensitive data or carry out high-risk profiling. See the Data Mapping and ROPA Guide.
• Automated individual decisions (Art. 21): inform the person and, on request, let them state their view and ask for human review.
• Right of access (Art. 25, Art. 16 to 19 DPO): free, normally within 30 days; a contribution of up to CHF 300 only for disproportionate effort. Verify identity before release.

Timeline and current status

The Federal Office of Justice lists no amendment to the Act itself since entry into force; watch Annex 1 DPO and FDPIC guidance, which change more often.

Enforcement and penalties

Prosecution lies with the cantons (Art. 65) and is time-barred after five years (Art. 66). Fines normally target the responsible individual, not the company. Negligence is not punishable. Separately, the FDPIC must investigate violations (Art. 49) and can issue binding rulings (Art. 51), for example ordering processing to be adapted, suspended or stopped and data deleted, appealable to the Federal Administrative Court.

What it means for AI agents and non-human identities

• AI is already in scope: the FDPIC's position (updated May 2025) is that the FADP applies directly to AI-supported processing. Providers and users must disclose purpose, functioning and data sources, users have a right to know when they are dealing with a machine, and high-risk AI needs a DPIA. See the AI and Privacy Guide.
• Agents process personal data: an agent that reads customer records with a service account is processing personal data on your behalf, so its access must meet the Art. 3 DPO access control and traceability measures. A breach caused by an agent is still a breach under Art. 24, as the first AI agent data breach notified to Spain's AEPD shows for the EU.
• Log the machine identity: where Art. 4 DPO logging applies, record the identity of the machine or agent as well as any human behind it, and for scripts the executing identity, script version and run time. See the Agentic AI Identity Guide.
• Credentials are a data security duty: API keys, service accounts and tokens that reach personal data fall within the "access control" and "known critical vulnerabilities" measures; leaked or unrotated secrets are a likely root cause in an Art. 61(c) analysis.
• Cross-border model and tool calls: sending personal data to a model API hosted outside Switzerland is a disclosure abroad; check Annex 1 or put recognised clauses in place, and name the country in the privacy notice.
• Automated decisions: agent-made decisions with legal or significant effect trigger Art. 21 information and human review rights.

Compliance steps

1. Confirm applicability. Identify processing with effects in Switzerland and whether an Art. 14 representative is needed.
2. Map data and records. Build or extend records of processing, flag sensitive data and high-risk profiling, and identify systems that trigger Art. 4 and Art. 5 DPO.
3. Map the DPO to controls. Document how each Art. 3 measure is met per system; name an owner, because Art. 61(c) liability is personal.
4. Turn on logging where required. Start with built-in audit logs, then gateways or database logging; ship logs to separate storage for at least one year; test integrity and restore.
5. Adapt breach response. Add an FDPIC branch to the incident plan: high-risk test, portal report, processor clauses that require notice of every breach, two-year documentation.
6. Review transfers. List every foreign recipient, including AI and SaaS providers; confirm Annex 1 status or clauses; update privacy notices with countries and safeguards.
7. Run DPIAs. For high-risk processing, including high-risk AI, before go-live; consult the FDPIC or your adviser if residual risk stays high.
8. Test and maintain. Run a tabletop exercise on a ransomware scenario with Swiss data; re-check after each DPO amendment or FDPIC guidance update.

Choosing your approach

Already GDPR-compliant: reuse your records, DPIAs and SCCs, then close the Swiss gaps: Art. 4 DPO logging, Swiss transfer annexes, the FDPIC reporting route and named owners for criminal exposure. Swiss-only SME under 250 staff: records may be exempt, but Art. 8 security, breach notification and transparency still apply; focus on the DPO measures and a simple breach procedure. Large group: appointing an Art. 10 data protection adviser is optional but lets you consult internally instead of the FDPIC after a DPIA. See the GDPR Compliance Guide for Security Teams.

Detection, measurement and framework mapping

• Logging coverage: share of Art. 4 DPO systems with complete, separately stored logs kept at least one year.
• Critical vulnerability age: time to fix known critical vulnerabilities on systems processing personal data.
• Breach triage time: time from detection to the high-risk decision and FDPIC report.
• Transfer coverage: share of foreign recipients with a documented Art. 16 or 17 basis.
• DPIA coverage: share of high-risk processing with a current DPIA.

Common failure patterns

• GDPR copy-paste: assuming GDPR compliance covers Swiss duties, missing Art. 4 DPO logging and Swiss transfer wording.
• No named owner: nobody accountable for the DPO measures, so criminal exposure lands on whoever is found to have decided.
• Logs on the same system: audit logs stored where ransomware encrypts them alongside the data.
• Processors filtering breaches: contracts that let processors apply a risk test before telling the controller, contrary to Art. 24(3).
• Waiting for the forensic report: delaying the FDPIC report until the investigation ends, which the FDPIC guidance says not to do.
• Unlisted AI destinations: agents and plugins sending personal data to model providers in countries not on Annex 1 without clauses.

Practitioner checklist

• Confirm whether your processing has effects in Switzerland and whether an Art. 14 representative is needed.
• Document a DPO Art. 1 to 3 mapping per system with a named owner.
• Enable Art. 4 logging, including machine and agent identities, stored separately for at least one year.
• Patch known critical vulnerabilities on personal data systems to a defined SLA.
• Add the FDPIC portal report and two-year breach documentation to the incident plan.
• Require processors to report every breach without a risk threshold.
• Record the Art. 16 or 17 basis for each foreign recipient, including AI providers.
• Run DPIAs for high-risk processing and keep them two years after processing ends.

Standards and references

• Federal Office of Justice: Data protection legal bases (FADP SR 235.1, DPO SR 235.11)
• FDPIC: The new Data Protection Act from the FDPIC's perspective
• FDPIC: Guidelines on reporting data security breaches and informing data subjects under Art. 24 FADP
• FDPIC: Technical recommendations on logging under Art. 4 DPO
• Federal Council: Swiss-US Data Privacy Framework, certified US companies offer adequate protection
• FDPIC: Current data protection legislation is directly applicable to AI

Related NHI Mgmt Group resources: Global Privacy Regulatory Map · International Data Transfers Map · UK GDPR and Data Protection Act 2018 Guide · Privacy Programme Guide for Security Teams. This guide summarises the Swiss Federal Act on Data Protection and Data Protection Ordinance and is not legal advice.