Switzerland. Comprehensive data protection. Act
FADP / nDSGFederal Act on Data Protection of 25 September 2020 (revised FADP; Datenschutzgesetz, nDSG / LPD)
§1Summary
- Synopsis
Switzerland's federal data protection law for private persons and federal bodies, modernised to align closely with the GDPR and Convention 108+. It introduces privacy by design, records of processing, DPIAs, breach notification and expanded information duties, enforced by the FDPIC and criminal courts.
- Key themes
- Unique features
Sanctions are criminal fines on responsible individuals (not administrative fines on companies); protects only natural persons; 'high-risk profiling' concept; foreign controllers need a Swiss representative only if processing is regular, extensive and high-risk.
- SaaS relevance
Applies to any SaaS provider whose processing has effects in Switzerland, regardless of location; controllers must name the countries data are disclosed to in privacy notices.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- FDPIC as soon as possible where high risk; individuals where needed for their protection
- DPO
- No
- Cross-border transfers
- Federal Council adequacy list (Annex 1 DPO); SCCs (Swiss-adapted EU SCCs) ; BCRs; Swiss–US DPF
- Maximum penalty
- CHF 250,000 criminal fine on responsible individuals (CHF 50,000 on the business in limited cases)
§3Dates
- Key dates
- Adopted
- In force
- Revised Act in force 2023-09-01 with no transition period, replacing the 1992 FADP
§4Text and authority
- Text
- Authoritative text fedlex.admin.ch
- English text fedlex.admin.ch
- Authority
- Federal Data Protection and Information Commissioner (FDPIC / EDÖB)
§5Where it applies
- Domestic law of
- Switzerland
§6Sources and verification
- Sources consulted
- Verification
High confidence.
EU adequacy Decision 2000/518/EC, confirmed in the Commission's January 2024 review. Cantonal data protection acts (26 cantons) govern cantonal and communal public bodies, are separate from the FADP and are not listed individually here.