Transferring data abroad

Whether it’s an online shop, cloud storage or a newsletter service: many providers store data on servers abroad. The FADP allows this, but only under certain conditions.

Countries with adequate protection (Art. 16 para. 1)

The Federal Council determines which countries offer adequate data protection. The list is set out in Annex 1 to the Data Protection Ordinance (DPO) and includes, among others, the EU and EEA states and the United Kingdom. Data may be transferred to these countries without additional safeguards.

This applies to the USA only to a limited extent: it covers companies certified under the Swiss-US Data Privacy Framework. Additional safeguards are required for all other US recipients.

Countries without adequate protection (Art. 16 para. 2)

If there is no Federal Council decision, appropriate data protection must be ensured in other ways, in particular through:

• standard data protection clauses approved, issued or recognised by the FDPIC,
• binding corporate rules on data protection,
• contractual data protection clauses notified to the FDPIC in advance,
• an international treaty.

Exceptions (Art. 17)

In individual cases, a transfer is permitted even without these safeguards, for example if you have given your explicit consent, if the transfer is directly connected with a contract – such as a hotel booking abroad – or if it is necessary to enforce legal claims before a court.

Publication on the internet (Art. 18)

If data is made generally accessible to inform the public, for example on a website, this does not count as disclosure abroad, even if the page can be accessed worldwide.

Your right to transparency

Companies must tell you which countries your data is sent to and which safeguards or exceptions they rely on (Art. 19 para. 4). This information is usually found in the privacy policy, but you can also request it with an access request (Art. 25 para. 2 let. g).

Anyone who intentionally transfers data abroad without meeting the necessary conditions can be fined upon complaint (Art. 61 let. a).

And the other way round?

For its part, the EU recognises Switzerland as a country with an adequate level of data protection. Companies in the EU may therefore transfer personal data to Switzerland without additional safeguards.

Read the legal text: Art. 16 FADP and Art. 17 FADP. Information for businesses: For businesses.