Data protection for private individuals in Switzerland

Crash course on the Act · Part 3 of 12

Obligations of companies under the FADP

Published: 2 March 2024Updated: 2 November 2026

Under the FADP, whoever decides on the purpose and means of data processing is the controller (Art. 5 let. j). Anyone who only processes data on the controller’s behalf, such as an IT service provider, is a processor (Art. 5 let. k). If you know these obligations, you also know what you can expect from a company.

Data protection from the planning stage (Art. 7)

Companies must design their systems from the outset so that the principles of Art. 6 are complied with (“privacy by design”). Default settings must limit processing to what is necessary (“privacy by default”) – so a customer profile, for example, should not be public by default.

Duty to inform (Art. 19)

Anyone who collects personal data must inform you appropriately, at least about:

  • the identity and contact details of the controller,
  • the purpose of processing,
  • the recipients or categories of recipients,
  • in the case of disclosure abroad, the country and the safeguards.

This is usually done in a privacy policy. If the data did not come from you, you must be informed no later than one month after it was obtained.

Records of processing activities (Art. 12)

The records describe, among other things, purposes, categories of data, recipients and retention periods. Companies with fewer than 250 employees are exempt, provided they neither process sensitive data on a large scale nor carry out high-risk profiling (Art. 24 DPO).

Data security and reporting obligation

Data must be adequately protected by technical and organisational measures (Art. 8). Data security breaches likely to result in a high risk must be reported to the FDPIC (Art. 24). More on this in Part 4.

Data protection impact assessment (Art. 22)

If planned processing may entail a high risk for the data subjects – for example in the case of large-scale processing of health data or systematic monitoring of public areas – an impact assessment must be carried out in advance. If a high risk remains despite the measures taken, the FDPIC must be consulted (Art. 23).

Processors (Art. 9)

A company may outsource data to service providers if they only process the data in the way the company itself would be permitted to, and if they guarantee data security. Further subcontractors may only be engaged with prior authorisation.

Other points

  • A data protection advisor is voluntary for private parties (Art. 10).
  • Certain foreign companies must designate a representative in Switzerland (Art. 14).
  • Requests from data subjects must be answered within the deadlines (Art. 25–29).

You can find more information in the For businesses section and in the legal text of Art. 19 FADP.

← Back to overview