Data protection for private individuals in Switzerland

SR 235.11

Data Protection Ordinance (DPO)

Status: 1 December 2025Checked against Fedlex: 2 November 2026Version on Fedlex

The Data Protection Ordinance (DPO) implements the Federal Act on Data Protection – for example on data security, the right of access and notifications to the FDPIC. Here you will find every article in the official wording, with explanations in plain language.

This translation is not an official version. Only the German, French and Italian versions are legally binding.

The ordinance implements the Federal Act on Data Protection. Data Protection Act (FADP) →

  1. Chapter 1: General Provisions

    Section 1: Data Security

    1. Art. 1Principles
    2. Art. 2Goals
    3. Art. 3Technical and organisational measures
    4. Art. 4Logging
    5. Art. 5Processing regulations for private persons
    6. Art. 6Processing regulations for federal bodies

    Section 2: Processing by Processors

    1. Art. 7Processing by Processors

    Section 3: Disclosure of Personal Data Abroad

    1. Art. 8Assessing the adequacy of the data protection offered by a State, territory, specified sector in a State, or international body
    2. Art. 9Data protection clauses and specific guarantees
    3. Art. 10Standard data protection clauses
    4. Art. 11Binding corporate rules
    5. Art. 12Code of conduct and certification

  2. Chapter 2: Obligations of the Controller

    1. Art. 13Modalities of the duty to provide information
    2. Art. 14Retention of the data protection impact assessment
    3. Art. 15Report of breaches of data security

  3. Chapter 3: Rights of the Data Subject

    Section 1: Right of Access

    1. Art. 16Modalities
    2. Art. 17Responsibility
    3. Art. 18Deadline
    4. Art. 19Exception to the requirement not to charge fees

    Section 2: Right to Data Portability

    1. Art. 20Scope of the right
    2. Art. 21Technical requirements for implementation
    3. Art. 22Deadline, modalities and responsibility

  4. Chapter 4: Special Provisions on Data Processing by Private Persons

    1. Art. 23Data protection officer
    2. Art. 24Exemption from the obligation to keep a record of processing activities

  5. Chapter 5: Special Provisions on Data Processing by Federal Bodies

    Section 1: Data Protection Officer

    1. Art. 25Appointment
    2. Art. 26Requirements and tasks
    3. Art. 27Obligations of the federal body
    4. Art. 28Contact point for the FDPIC

    Section 2: Duties to Provide Information

    1. Art. 29Duty to provide information in the event of the disclosure of personal data
    2. Art. 30Duty to provide information in the event of the systematic collection of personal data

    Section 3: Notifying the FDPIC of Projects for the Automated Processing of Personal Data

    1. Art. 31Notifying the FDPIC of Projects for the Automated Processing of Personal Data

    Section 4: Pilot Projects

    1. Art. 32Mandatory nature of the pilot trial
    2. Art. 33Procedure for authorising the pilot trial
    3. Art. 34Evaluation report

    Section 5: Data Processing for Purposes not related to Specific Persons

    1. Art. 35Data Processing for Purposes not related to Specific Persons

  6. Chapter 6: Federal Data Protection and Information Commissioner

    1. Art. 36Seat and permanent secretariat
    2. Art. 37Method of communication
    3. Art. 37aConclusion and amendment of declarations of intent
    4. Art. 38Notice of decisions, guidelines and projects
    5. Art. 39Processing personal data
    6. Art. 40Self-regulation
    7. Art. 41Cooperation with the National Cybersecurity Centre
    8. Art. 42Register of processing activities by federal authorities
    9. Art. 43Code of conduct
    10. Art. 44Fees

  7. Chapter 7: Final Provisions

    1. Art. 45Repeal and amendment of other legislation
    2. Art. 46Transitional provisions
    3. Art. 47Commencement