Data protection for private individuals in Switzerland

Art. 18 DPO

Deadline

Chapter 3: Rights of the Data SubjectSection 1: Right of Access

Statutory textStatus: 1 December 2025

1 The information must be provided within 30 days of receipt of the request.

2 If it is not possible to provide the information within 30 days, the controller must notify the data subject of this and of how long it will take to provide the information.

3 If the controller decides to refuse, restrict or defer the right of access, it must notify the data subject of this within the same deadline.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

The information must be provided within 30 days of receipt of the request. If this is not possible, the company must inform you and tell you by when the information will be provided. If it refuses, restricts or defers the information, it must also notify you within the same period.

What does this mean for me?

Make a note of when your request was received. If you hear nothing after 30 days, you can follow up, referring to Art. 25 FADP and Art. 18 DPO.

Example

You send an access request to an insurance company. Within 30 days it must either provide the information or tell you when it will follow or why it is being refused or restricted.

Implements these provisions of the Federal Act on Data Protection (FADP)

  1. Art. 25 FADPRight to information
  2. Art. 26 FADPLimitations on the right to information

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.