Data protection for private individuals in Switzerland

Art. 7 FADP

Data protection by design and data protection by default

Chapter 2: General ProvisionsSection 1: Definitions and Principles

Statutory textStatus: 7 July 2025

1 The controller is obliged to arrange the data processing in technical and organisational terms so that the data protection regulations, and in particular the principles under Article 6, are respected. It shall take account of this from the planning stage.

2 The technical and organisational measures must in particular be appropriate with regard to the state of the art, the nature and the extent of the data processing and the risk that the processing poses to the data subject's personality or fundamental rights.

3 The controller is obliged to ensure by means of suitable default settings that the processing of personal data is limited to the minimum required for the purpose intended, unless the data subject specifies otherwise.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

Data protection must be built in from the planning stage (“privacy by design”). Default settings must keep data to a minimum (“privacy by default”).

What does this mean for me?

You should not have to hunt for settings to protect your privacy – the privacy-friendly option must be the default setting.

Example

A new customer profile is private by default and not publicly visible.

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.