Crash course on the Act · Part 1 of 12
An overview of the Swiss Federal Act on Data Protection
Since 1 September 2023, the revised Federal Act on Data Protection (FADP; German: DSG) has been in force in Switzerland. It governs how companies, associations, private individuals and federal authorities may handle information about people.
Whom the Act protects
The FADP protects the personality and fundamental rights of natural persons (Art. 1). Data about companies, associations or foundations is not covered. Personal data is any information relating to an identified or identifiable person (Art. 5 let. a) – for example name, address, phone number, customer number or purchasing behaviour.
Sensitive personal data enjoys greater protection, for example information about health, religious or political views, genetic and biometric data or criminal prosecutions (Art. 5 let. c).
Who the Act applies to
The FADP applies to private persons – that is, companies, associations and individuals – and to federal bodies (Art. 2). It does not cover anything you process exclusively for personal use, such as your private address book. Cantonal and municipal authorities, such as state schools or cantonal hospitals, are subject to the data protection act of the canton concerned. Companies abroad must also comply with the FADP if their data processing has an effect in Switzerland (Art. 3).
Principles instead of a general consent requirement
Contrary to what many people assume, processing personal data does not in principle require your consent. Processing is permitted if it complies with the principles of Art. 6:
- lawful, in good faith and proportionate,
- only for a specific purpose that is recognisable to you,
- destruction or anonymisation as soon as the data is no longer needed,
- ensuring that the data is accurate.
Anyone who fails to comply with these principles infringes your personality, unless the processing is justified by consent, an overriding interest or the law (Art. 30 and 31). Consent is therefore only one possible ground for justification. If a company relies on your consent for sensitive data or for high-risk profiling, that consent must be explicit (Art. 6 para. 7).
Supervision and penalties
Supervision is the responsibility of the Federal Data Protection and Information Commissioner (FDPIC). Certain intentional violations, such as providing false information, are punishable by a fine of up to CHF 250,000 – usually only upon complaint and, in principle, against the responsible natural persons rather than the company (Art. 60–66). Prosecution is a matter for the cantons.
Differences from the GDPR
The EU’s General Data Protection Regulation (GDPR) pursues similar aims. However, the FADP does not require private parties to have a legal basis for every single processing operation, provides for fines against individuals instead of turnover-based fines against companies, and has no fixed deadline in hours for reporting data breaches.
Read the legal text: Art. 6 FADP – Principles.