Data protection for private individuals in Switzerland

Art. 8 FADP

Data security

Chapter 2: General ProvisionsSection 1: Definitions and Principles

Statutory textStatus: 7 July 2025

1 The controller and the processor shall guarantee a level of data security appropriate to the risk by taking suitable technical and organisational measures.

2 The measures must make it possible to avoid breaches of data security.

3 The Federal Council shall issue provisions on the minimum requirements for data security.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

Companies and their service providers must protect data with appropriate technical and organisational measures. The minimum requirements are set out in the Data Protection Ordinance.

What does this mean for me?

Anyone who processes your data must secure it against loss, theft and unauthorised access – the more sensitive the data, the better the protection.

Example

Passwords are stored encrypted, and only authorised staff have access to customer data.

Implementing provisions in the Data Protection Ordinance (DPO)

  1. Art. 1 DPOPrinciples
  2. Art. 2 DPOGoals
  3. Art. 3 DPOTechnical and organisational measures
  4. Art. 4 DPOLogging
  5. Art. 5 DPOProcessing regulations for private persons

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.