FADP: The Complete Guide
Switzerland's revised Federal Act on Data Protection, effective September 1, 2023, represents a major overhaul of the country's data protection framework. Originally enacted in 1992, the revised FADP aligns Swiss law closely with the GDPR to maintain the EU's adequacy finding and ensure seamless cross-border data flows with Europe.
What the FADP Covers
The revised FADP applies to the processing of personal data of natural persons by private individuals and federal bodies. Unlike the GDPR, it does not directly protect legal entities' data, though related provisions may apply. The law requires data controllers to process data lawfully, in good faith, and proportionately to the purpose.
A key feature is the broad duty to inform. Controllers must proactively notify data subjects when collecting any personal data — not just sensitive data — providing identity, purpose, recipients, and cross-border transfer details. This goes beyond the previous law, which only required notification for sensitive data collection.
Privacy by design and by default are codified requirements. Technical and organizational measures must be implemented from the design stage, and default settings must limit processing to what is necessary for the stated purpose.
Who Needs to Comply
The FADP applies to processing that has effects in Switzerland, regardless of where the processing occurs. Foreign organizations targeting Swiss residents or processing data with effects in Switzerland must comply and, in certain cases, designate a representative in Switzerland.
Criminal Penalties — A Key Distinction
Unlike the GDPR, which focuses on organizational fines, the FADP imposes criminal penalties on responsible individuals. Willful violations of information duties, breach notification obligations, and certain other provisions can result in fines of up to CHF 250,000 against the responsible natural person. This personal liability makes the FADP a uniquely powerful deterrent at the individual level.
Practical Compliance Steps
- Gap analysis against GDPR — Identify Swiss-specific requirements beyond existing GDPR compliance
- Information notices — Update privacy notices to meet the FADP's broad duty to inform
- Records of processing — Maintain processing activity records (exemptions available for SMBs with low-risk processing)
- DPIA process — Establish Data Protection Impact Assessment procedures for high-risk processing
- Breach notification — Implement processes to notify the FDPIC as quickly as possible
- Cross-border transfers — Verify adequacy of destination countries per the Swiss Federal Council's list
- Representative appointment — Designate a Swiss representative if required as a foreign controller