Your rights under the Federal Act on Data Protection

The FADP gives you specific rights against companies and federal authorities. You can exercise most of them without a lawyer and free of charge.

Right of access (Art. 25)

You can ask to be told whether a company is processing data about you. If it is, you will receive, among other things:

the processed data itself,
the purpose and the retention period,
the source of the data, if it did not come from you,
the recipients, including those abroad,
where applicable, information on automated individual decisions.

The information is free of charge and must generally be provided within 30 days (Art. 25 para. 6 and 7 FADP, Art. 18 DPO). You cannot waive the right of access in advance. It is best to make your request in writing and enclose proof of identity. The company may only restrict the information for the reasons set out in Art. 26, for example because of overriding interests of third parties.

Data disclosure and transfer (Art. 28)

You can ask for data you have provided yourself to be handed over in a common electronic format or transferred to another provider – provided it is processed automatically and on the basis of your consent or a contract.

Correction, objection and deletion

Correction: inaccurate data must be corrected (Art. 32 para. 1).
Objection: you can expressly object to processing. Anyone who disregards this without a ground for justification infringes your personality (Art. 30 para. 2 let. b).
Deletion: if processing is unlawful, you can demand that it be prohibited or that the data be deleted – if necessary by bringing a civil action (Art. 32 para. 2). Independently of this, data must be deleted or anonymised as soon as it is no longer needed (Art. 6 para. 4).

Automated individual decisions (Art. 21)

If a computer makes a decision about you without human review and this has a legal effect or significantly affects you – such as the automatic rejection of an application – you must be informed. You can state your point of view and request that a human review the decision.

If a company does not respond

First send a written reminder and set a deadline. If that does not help, you can report a violation to the FDPIC (Art. 49). The FDPIC can open an investigation and will inform you of the steps taken; however, you are not a party to the proceedings (Art. 52 para. 2), and the FDPIC does not enforce your personal claims. For that, civil proceedings are open to you. In addition, intentionally providing false or incomplete information is a criminal offence, prosecuted upon complaint (Art. 60).

Templates for your request: access, deletion, correction, data disclosure and the deadline calculator.