Data protection for private individuals in Switzerland

Art. 15 DPO

Report of breaches of data security

Chapter 2: Obligations of the Controller

Statutory textStatus: 1 December 2025

1 The report to the FDPIC of a breach of data security must include the following information:

  • a.

    the form of breach;

  • b.

    the time and duration, if possible;

  • c.

    the categories and approximate amount of personal data concerned, if possible;

  • d.

    the categories and the approximate number of data subjects, if possible;

  • e.

    the consequences, including any risks, for the data subjects;

  • f.

    the measures that have been taken or are planned in order to remedy the breach and mitigate the consequences, including any risks;

  • g.

    the name and the contact details of a contact person.

2 If the controller is unable to report all the details at one time, it shall supply the missing details as quickly as possible.

3 If the controller is required to inform the data subject, it shall provide the data subject with the details specified in paragraph 1 letters a and e–g in simple and comprehensible language.

4 The controller must document the breaches. The documentation must contain a summary of the circumstances of the incidents, their effects and the measures taken. It shall be retained from the time of the report under paragraph 1 for a minimum of two years.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

A report of a data security breach to the FDPIC must include, among other things, the form of breach, where possible the time, duration and scale, the consequences for the data subjects, the measures taken and a contact person. If the company has to inform you, it must tell you, in simple and comprehensible language, at least the form of breach, the consequences, the measures and a contact person. Every breach must be documented; the documentation is kept for at least two years (Art. 24 FADP).

What does this mean for me?

If you receive a notification of a data breach, it must make clear what happened, what consequences and risks it has for you, what the company is doing about it and whom you can contact.

Example

An online shop informs you that unknown persons have copied customer data. The notification explains in simple terms what happened, what risks exist, what the shop is doing about it and who will answer your questions.

Implements these provisions of the Federal Act on Data Protection (FADP)

  1. Art. 24 FADPNotifications of data security breaches

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.