Current developments in data protection

Data protection is constantly evolving. This part is limited to developments that have already been established.

The revised FADP is part of everyday life

The revised FADP has been in force since 1 September 2023 and replaced the Data Protection Act of 1992. The most important changes:

• Only natural persons are now protected, no longer companies.
• The duty to inform applies to every collection of personal data (Art. 19).
• New features include the obligation to report data breaches (Art. 24), the data protection impact assessment (Art. 22) and the right to data disclosure (Art. 28).
• Fines for intentional violations can reach up to CHF 250,000 (Art. 60–63).

Artificial intelligence falls under the FADP

The FDPIC has made it clear that the current FADP is directly applicable to AI-supported data processing. Providers and users of AI applications must therefore already comply with the principles, the duty to inform and the rules on automated individual decisions (Art. 21). The Federal Council has also decided to ratify the Council of Europe’s Convention on AI and to amend Swiss law where necessary.

The EU AI Regulation also affects Swiss companies

The EU’s AI Regulation (“AI Act”) does not only apply to companies in the EU. It also covers Swiss providers that offer AI systems in the EU or whose output is used in the EU. Its obligations are becoming applicable in stages.

Data transfers to the USA

The Federal Council has added the USA to the list of countries with adequate data protection for companies certified under the Swiss-US Data Privacy Framework (Annex 1 DPO). For US companies that are not certified, safeguards such as standard data protection clauses are still required (Art. 16 para. 2).

Cybersecurity and data protection are converging

Operators of critical infrastructure must report cyberattacks to the Federal Office for Cybersecurity (NCSC); this is governed by the Information Security Act. The FADP also provides that the FDPIC may, with the controller’s consent, forward a report of a data breach to the NCSC (Art. 24 para. 5bis).

What this means for you

Your rights as a data subject remain unchanged: access, data disclosure, correction and objection also apply to AI providers and to companies with servers abroad. New technologies do not change the fact that a company must explain to you what it does with your data.

Read the legal text: Art. 16 FADP – information for businesses: For businesses.