Data protection for private individuals in Switzerland

Art. 23 DPO

Data protection officer

Chapter 4: Special Provisions on Data Processing by Private Persons

Statutory textStatus: 1 December 2025

The controller must grant the data protection officer:

  • a.

    access to the required resources;

  • b.

    access to all information, documents, records of processing activities and personal data that the officer requires to fulfil his or her tasks;

  • c.

    the right to notify the highest management or governing body in important cases.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

If a private company has appointed a data protection officer (Art. 10 FADP), it must give the officer the required resources, access to all information, documents and data the officer needs, and the right to notify the highest management body in important cases.

What does this mean for me?

This obligation is aimed at companies. For you, it means: a company’s data protection officer has access to the necessary information and is therefore a suitable point of contact for your concerns.

Implements these provisions of the Federal Act on Data Protection (FADP)

  1. Art. 10 FADPData protection officer

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.