Data protection for private individuals in Switzerland

Crash course on the Act · Part 12 of 12

Summary and where to get help

Published: 2 December 2024Updated: 2 November 2026

To conclude the crash course, we summarise the most important points and show you who you can turn to if there are problems.

The essentials in brief

  • The FADP protects natural persons and applies to private parties and federal bodies; cantonal and municipal authorities are subject to cantonal law.
  • Consent is not required in principle. What counts are the principles of Art. 6; consent is one of several grounds for justification (Art. 31).
  • Companies must inform you (Art. 19), secure your data (Art. 8) and report serious data breaches to the FDPIC (Art. 24).
  • You have the right of access (Art. 25), data disclosure (Art. 28), correction and deletion (Art. 32) and the right to object (Art. 30 para. 2 let. b).
  • Transfers abroad require adequate protection or safeguards (Art. 16 and 17).
  • Advertising emails and text messages generally require your prior consent (Art. 3 para. 1 let. o UCA).

What to do if there is a problem

  1. Write to the company directly: set out your request in writing and keep a copy. Note the date; a deadline of 30 days generally applies to access requests.
  2. Send a reminder: if you receive no reply, set a short extension.
  3. Report to the FDPIC: in the case of violations by companies or federal bodies, you can inform the FDPIC (Art. 49). The FDPIC decides itself whether to open an investigation. You are not a party to the proceedings (Art. 52 para. 2), but you will be informed of the steps taken and the outcome.
  4. Cantonal data protection authority: if the matter concerns a municipality, a state school or a cantonal office, your canton’s data protection commissioner is responsible.
  5. Civil action: to enforce deletion, a processing ban or damages, civil proceedings are open to you (Art. 32 FADP, Art. 28 et seq. CC). The proceedings usually begin before the conciliation authority.
  6. Criminal complaint: certain intentional violations, such as providing false information, are punishable upon complaint (Art. 60–62). The complaint must be filed with the cantonal prosecution authorities within three months of you learning who the offender is (Art. 31 SCC).

Other points of contact

  • Unwanted advertising: State Secretariat for Economic Affairs (SECO).
  • Cyber fraud and phishing: Federal Office for Cybersecurity (NCSC) and, if you have suffered loss, the police.
  • Legal advice: lawyers, legal expenses insurers or consumer organisations.

Your tools: request access, calculate deadlines and report to the FDPIC.

← Back to overview