CevroSwitzerland: Swiss FADP and what it requires
Federal Act on Data Protection (revised FADP): an established law with an active enforcement record. Overseen by Federal Data Protection and Information Commissioner (FDPIC).
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Not required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Criminal fines of up to CHF 250,000 on the responsible individuals (up to CHF 50,000 on the company where the individual cannot be identified). The FDPIC itself cannot impose fines.
What to know in practice
In force since 1 September 2023. Report breaches likely to cause a high risk to the FDPIC as soon as possible; there is no fixed number of hours. Appointing a data protection advisor is optional. Switzerland has EU adequacy status.
The security duty
Under Art. 8: Data security: suitable technical and organisational measures that guarantee security appropriate to the risk and avoid data security breaches. Source: published text, checked 2026-10.
How Cevro helps
- Maps Swiss FADP to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Counts your automated technical checks as evidence toward the security duty in Art. 8.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Switzerland?
Federal Data Protection and Information Commissioner (FDPIC) oversees Federal Act on Data Protection (revised FADP).
Is breach notification mandatory under Swiss FADP?
Our reference does not record a fixed hourly deadline for Swiss FADP. Check the statute and Federal Data Protection and Information Commissioner (FDPIC) guidance for the notification timing that applies to you.
Does Switzerland restrict cross-border data transfers?
Yes. Moving personal data out of Switzerland is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Swiss FADP?
It is not a general requirement in our reference, though naming an accountable person is still good practice.
What are the penalties for non-compliance in Switzerland?
Criminal fines of up to CHF 250,000 on the responsible individuals (up to CHF 50,000 on the company where the individual cannot be identified). The FDPIC itself cannot impose fines.