Data protection for private individuals in Switzerland

Art. 11 DPO

Binding corporate rules

Chapter 1: General ProvisionsSection 3: Disclosure of Personal Data Abroad

Statutory textStatus: 1 December 2025

1 Binding corporate rules in accordance with Article 16 paragraph 2 letter e FADP apply to all undertakings that belong to the same group of undertakings.

2 They shall include as a minimum the points mentioned in Article 9 paragraph 1 as well as the following information:

  • a.

    details of the organisational structure and the contact details for the group of undertakings and its members;

  • b.

    details of the measures taken within the group of undertakings to comply with the binding corporate rules.

3 The FDPIC shall give notice of the result of its assessment of the binding corporate rules that it has been submitted within 90 days.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

Binding corporate rules apply to all companies in the same group (Art. 16 para. 2 FADP). They must contain the same minimum points as data protection clauses (Art. 9 DPO) as well as details of the group’s organisation and the measures taken to ensure compliance. The FDPIC communicates the result of its review within 90 days.

What does this mean for me?

This rule is aimed at groups of companies. For you, it means: if an international group passes your data on to a company abroad, the same binding data protection rules apply there.

Implements these provisions of the Federal Act on Data Protection (FADP)

  1. Art. 16 FADPPrinciples

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.