The Federal Act on Data Protection (FADP), in force since 1 September 2023, regulates automated individual decision-making in its Article 21. A company or federal service that lets an algorithm decide a case on its own must inform the person concerned. That person can then state their point of view and demand that a human being review the decision.
This page deals with this single question: a person's rights when faced with a decision made by an automated system. The general framework, AI included, is set out in our page on AI regulation in Switzerland.
Key figures
- 1 September 2023: entry into force of the revised FADP, according to Fedlex, the publication platform for federal law.
- 30 days: the period within which, as a rule, a company responds to an access request (Art. 25 FADP).
- 10 years: the maximum age of data a company may use to assess a customer's creditworthiness (Art. 31 FADP).
- Fewer than one company in five has a person validate all of its generative AI content, according to the swissVR Monitor.
- Early 2027: deadline for a preliminary draft of AI regulation, according to the SME portal of the State Secretariat for Economic Affairs (SECO).
What is an automated individual decision under the FADP?
The law sets three cumulative conditions. First, there must be a decision that concerns a person. Second, that decision must be taken "exclusively on the basis of automated processing of personal data". Finally, it must have "legal effects" for the person, or affect them "significantly".
The word "exclusively" draws the line. Our analysis: a decision taken by a person with the help of a score calculated by software does not, to the letter, meet this condition.
An automated decision is distinct from profiling, which the FADP defines as automated processing that evaluates a person: work performance, economic situation, health, reliability. Profiling evaluates; an automated decision settles. High-risk profiling carried out by a private company also requires express consent (Art. 6).
Who must comply with these rules?
The FADP covers data on natural persons processed by private persons or federal bodies. The obligation rests with the controller, the one who determines the purposes and means of the processing.
Where the processing takes place matters little. Under its Article 3, the FADP applies to situations that have effects in Switzerland, even if they originate abroad. Our analysis: an algorithm operated outside Switzerland can therefore fall under Article 21.
When must the company inform the person concerned?
Information is owed for every automated individual decision, without waiting for the person to ask. It comes on top of the general duty to inform when data is collected (Art. 19).
The right of access complements this duty. Under Article 25, a person can ask whether data concerning them is being processed. Where applicable, the answer must state the existence of an automated individual decision "as well as the logic on which the decision is based".
The answer is free of charge, except in cases provided for by the Federal Council, and as a rule arrives within 30 days. No one can waive this right in advance.
How do you state your point of view and obtain a human review?
The person concerned must request it. Article 21 then provides for two separate rights. The controller first gives them the opportunity to state their point of view. They can then demand that the decision be reviewed by a natural person.
Our analysis: the law does not ban the algorithm; it opens a route of human recourse to anyone who asks for it. Article 21 sets neither a deadline nor a form for this request.
In which cases do these rights not apply?
Article 21 provides for two exceptions, which set aside both the duty to inform and the rights of recourse:
- The decision is directly related to the conclusion or performance of a contract between the company and the person, and the latter's request is granted.
- The person has expressly consented to the decision being taken in an automated manner.
Our analysis: to the letter, the first exception covers the customer who gets what they asked for, for example an accepted order. A refusal issued by the system does not meet the condition of a request that is "granted".
What does the law change when the decision comes from a federal body?
A federal body must label its decision as an automated individual decision. The right to state one's point of view and obtain a review has one limit: it does not apply when the person does not have to be heard before the decision.
This limit refers to Article 30, paragraph 2, of the Federal Act on Administrative Procedure (APA), or to another federal act. How AI is organised within the Confederation's services is described in our page on AI in the federal administration.
Example: a credit application handled by an algorithm
Creditworthiness assessment shows how the rules fit together. Under Article 31, a company can invoke it as an overriding interest subject to several conditions: no sensitive data and no high-risk profiling, data no more than ten years old, and an adult person.
Our analysis: this rule concerns the data, not the way the decision is made. If software decides on its own, Article 21 also applies. A credit that is granted may fall under the contractual exception; an automatic refusal in principle opens the right to a human review, unless the customer has given express consent.
Banks and insurers also follow the Swiss Financial Market Supervisory Authority (FINMA). Its Guidance 08/2024 of 18 December 2024 deals with AI governance, with no intended legal effect, as detailed in our page FINMA and artificial intelligence.
What can the Federal Commissioner do about an automated decision?
The Federal Data Protection and Information Commissioner (FDPIC), an independent authority, supervises the application of the FADP. In its note of 24 September 2025, it points out that this law applies directly to processing that uses AI.
Its powers also cover Article 21. Under Article 49, the FDPIC opens an investigation on its own initiative or following a report, if there are sufficient indications of a breach. Article 51 allows it to order a company or a federal body to inform the persons concerned in accordance with Articles 19 and 21.
The person who filed a report is informed of the follow-up and the outcome of any investigation. For questions, the FDPIC hotline answers Monday to Friday, from 10 am to 11:30, on 058 462 43 95.
What automated decisions change for an SME in Switzerland
A small or medium-sized enterprise (SME) that entrusts decisions to software must first identify them. Its obligations under the FADP:
| Situation | Obligation | Basis in the FADP |
|---|---|---|
| A system decides on its own, with a significant effect on a person | Inform the person of the decision | Art. 21, para. 1 |
| The person objects | Hear their point of view and have the decision reviewed by a natural person | Art. 21, para. 2 |
| The person requests access to their data | State the existence of the decision and its logic, as a rule within 30 days | Art. 25 |
| The processing presents a high risk | Carry out an impact assessment beforehand | Art. 22 |
| High-risk profiling by a private company | Obtain express consent | Art. 6, para. 7 |
Some companies draw a line themselves. According to Alexander Finger, chief technology officer of SAP Switzerland, quoted by PME magazine, SAP has ruled out systems that make decisions about people.
Human oversight remains uneven: fewer than one company in five has all of its generative AI content validated, according to the swissVR Monitor. Our analysis: for a decision that affects a customer or an employee, Article 21 makes this oversight enforceable on request.
Could the framework still change?
Work is under way, with no known text. Switzerland has signed the Council of Europe AI convention, opened for signature on 5 September 2024. This treaty requires states to provide enough information to challenge a decision taken by means of AI.
According to SECO's SME portal, Switzerland has committed to adapting its law, and a preliminary draft is due to be drawn up by early 2027. Its content and its effects on Article 21 are not known. The other texts of the legal framework for AI are gathered in our section.
What we don't know yet
- The degree of human involvement needed for a decision to no longer be taken "exclusively" by a system: the text of the law does not specify it.
- The FDPIC's practice on Article 21: the sources consulted cite no investigation concerning an automated decision.
- Possible criminal penalties: the part of the FADP text consulted stops at the tasks of the FDPIC.
- The effect of the future preliminary draft on AI on the rights provided for in Article 21.
Sources
- Swiss Confederation, Fedlex: Federal Act on Data Protection (FADP), SR 235.1, as at 7 July 2025
- Federal Data Protection and Information Commissioner: FDPIC home page, with the note « IA et protection des données » of 24 September 2025
- 2clics.com, « IA pour PME : usages concrets et premiers pas en Suisse », based on PME magazine and SECO's SME portal
