Data protection for private individuals in Switzerland

Art. 9 FADP

Processing by processors

Chapter 2: General ProvisionsSection 1: Definitions and Principles

Statutory textStatus: 7 July 2025

1 The processing of personal data may be assigned by contract or by the legislation to a processor if:

  • a.

    the data is processed only in the manner in which the controller itself is permitted to do it; and

  • b.

    no statutory or contractual duty of confidentiality prohibits assignment.

2 The controller must satisfy itself in particular that the processor is able to guarantee data security.

3 The processor may only assign processing to a third party with prior approval from the controller.

4 It may claim the same grounds for justification as the controller.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

A company may outsource data processing to service providers (processors), such as a cloud or IT provider. It remains responsible for this and must ensure that the service provider protects the data.

What does this mean for me?

Even if your data is held by a service provider, your contact remains the company you are dealing with.

Implementing provisions in the Data Protection Ordinance (DPO)

  1. Art. 7 DPOProcessing by Processors

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.