Data protection for private individuals in Switzerland

Art. 23 FADP

Consultation of the FDPIC

Chapter 3: Duties of the Controller and of the Processor

Statutory textStatus: 7 July 2025

1 If the data protection impact assessment indicates that the planned processing despite the measures planned by the controller will still pose a high risk to the personality or the data subject's fundamental rights, the controller shall seek the FDPIC's opinion beforehand.

2 The FDPIC shall inform the controller within two months of any objections to the planned processing. This deadline may be extended by one month if the data processing is complex.

3 If the FDPIC objects to the planned processing, he or she shall propose suitable measures to the controller.

4 A private controller may dispense with consulting the FDPIC if it has consulted the data protection officer under Article 10.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

If the impact assessment shows a high risk despite protective measures, the company must consult the FDPIC beforehand. The FDPIC responds within two months.

What does this mean for me?

For particularly risky projects, a prior review by the supervisory authority is provided for.

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.