Data protection for private individuals in Switzerland

Art. 12 DPO

Code of conduct and certification

Chapter 1: General ProvisionsSection 3: Disclosure of Personal Data Abroad

Statutory textStatus: 1 December 2025

1 Personal data may be disclosed abroad if a code of conduct or certification guarantees an appropriate level of data protection.

2 The code of conduct must be submitted beforehand to the FDPIC for approval.

3 The code of conduct or certification must be combined with a binding and enforceable obligation for the controller or the processor in the third State to apply the measures contained therein.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

Personal data may also be disclosed abroad if a code of conduct or a certification guarantees appropriate data protection. A code of conduct must first be submitted to the FDPIC for approval, and the recipient in the third country must give a binding and enforceable commitment to apply the measures it contains.

What does this mean for me?

This rule is aimed at companies. For you, it means: a code or certificate alone is not enough – the recipient abroad must also give a binding commitment to comply with it.

Implements these provisions of the Federal Act on Data Protection (FADP)

  1. Art. 16 FADPPrinciples

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.