The new Federal Act on Data Protection (revFADP) has applied in Switzerland since 1 September 2023. It protects the data of natural persons processed by companies and by the federal administration. It imposes a duty to inform and the reporting of serious breaches to the Federal Commissioner, and punishes certain offences with a fine of up to 250,000 francs.

The text is dated 25 September 2020, the day it was adopted by Parliament. It appears in the Classified Compilation of Federal Legislation (Fedlex), under number SR 235.1. According to the Federal Council's press release of 31 August 2022, two ordinances accompany it: the Data Protection Ordinance (DPO) and the Ordinance on Data Protection Certification (DPCO).

Why did Switzerland replace its 1992 law?

The first Federal Act on Data Protection dated from 19 June 1992, according to Fedlex. The Confederation's SME portal (kmu.admin.ch) points out that it had been designed before the rise of the cloud and connected devices, and had only been partially revised, in 2009 and in 2019.

The second reason is European. According to the Federal Office of Justice (FOJ), the revision brings Swiss law closer to the European Union's General Data Protection Regulation (GDPR). What is at stake is the free flow of data with the EU. The FOJ states that the European Commission confirmed on 15 January 2024 that Switzerland offers an adequate level of protection. This adequacy decision, issued on 26 July 2000, allows data to flow from the EU without additional safeguards.

Key figures

  • 1 September 2023: entry into force of the revFADP, the DPO and the DPCO;
  • 250,000 francs: maximum fine provided for in Article 60, or 25 times the former ceiling according to the online commentary on that article;
  • 30 days: deadline for responding to an access request, as a general rule;
  • 250 employees: threshold below which the Federal Council provides for exceptions to the record of processing activities;
  • 455 breach reports received by the Commissioner in 2026 up to 25 October, compared with 343 over the whole of 2025.

Who does the revFADP apply to?

The law covers the data of natural persons processed by private persons or by federal bodies (Art. 2). The data of legal entities, such as companies, are no longer covered, notes the SME portal. Exclusively personal use falls outside the law.

The law also covers events abroad that have effects in Switzerland (Art. 3). A foreign company that targets people in Switzerland appoints a representative in Switzerland if its processing is regular, large-scale and high-risk (Art. 14).

What principles must a company comply with?

Article 6 sets out the basic rules for any processing of personal data:

  • it must be lawful, carried out in good faith and proportionate;
  • the data serve a specific purpose that is recognisable to the person concerned;
  • they must be accurate;
  • they are destroyed or anonymised as soon as they are no longer needed.

Consent must be explicit for sensitive data, the list of which now includes genetic and biometric data (Art. 5).

The law also introduces data protection by design and by default (Art. 7). In practice, a service's default settings must limit processing to the minimum required by its purpose. Data security must be appropriate to the risk (Art. 8). A processor must be able to guarantee this security (Art. 9).

What concrete obligations for an SME?

The duty to inform comes first. According to the SME portal, it now covers the collection of all personal data, and no longer only sensitive data. Article 19 requires at least the identity and contact details of the controller, the purpose of the processing and any recipients. Sending data abroad must be disclosed, together with the country concerned. If the data do not come from the person concerned, they are informed no later than one month after the data were obtained.

Three other tools complete the framework:

  • the record of processing activities (Art. 12), with exceptions for companies with fewer than 250 employees whose processing presents a limited risk;
  • the impact assessment (Art. 22), mandatory before any high-risk processing;
  • the data protection advisor (Art. 10), optional for a private company.

If the impact assessment leaves a high risk, the company consults the Commissioner, who has two months to raise objections (Art. 23). An independent advisor within the meaning of Article 10 makes it possible to dispense with this.

What rights do data subjects have?

The right of access heads the list. Anyone can ask a company whether it processes data about them (Art. 25). The response is free of charge and is generally given within 30 days. It includes the data, the purpose, the retention period and the recipients. A refusal remains possible, for example in the case of a manifestly unfounded request, but must be justified (Art. 26).

The person can obtain their data in a common electronic format (Art. 28). They can also demand the rectification of inaccurate data, a ban on processing or the erasure of their data before a civil court (Art. 32).

When must a data breach be reported to the Commissioner?

A data security breach means a loss, modification, destruction, disclosure or unauthorised access, whether accidental or unlawful (Art. 5). Article 24 requires it to be reported to the Federal Data Protection and Information Commissioner (FDPIC) "as soon as possible". The obligation applies when the breach is likely to result in a high risk for the persons concerned.

The report states at least the nature of the breach, its consequences and the measures taken or planned. A processor, for its part, must report any incident to its client, with no severity threshold. The persons affected are informed when their protection requires it or when the Commissioner requests it. Since 1 April 2025, the Commissioner may, with the controller's consent, forward the report to the Federal Office for Cybersecurity (FOCS) for analysis.

The number of reports is rising. In an interview with SonntagsBlick relayed on 25 October 2026 by the Keystone-ATS agency, Commissioner Adrian Lobsiger reported 455 reports received since the start of the year, compared with 343 in 2025. He believes that many incidents never reach him, as 2clics reported in its coverage of data breaches in Switzerland. 2clics' data protection section follows these cases.

What powers does the Federal Commissioner have?

The FDPIC is an independent authority which, according to its website, supervises federal bodies and private companies. It opens an investigation on its own initiative or following a report when there are sufficient indications that processing violates the law (Art. 49). If it finds a violation, it can order processing to be modified, suspended or stopped, or data to be erased (Art. 51).

A dated example illustrates this procedure. On 23 October 2026, the Commissioner opened a formal investigation against PK Softech, a software supplier to several Swiss pension funds, including the Federal Pension Fund PUBLICA. The company had itself reported a cyberattack to him on 8 October. As 2clics reported in its coverage of the Commissioner's investigation into PK Softech, the Commissioner wants to establish what data the pension funds had entrusted to it, on what legal basis, and what was stolen.

What penalties does the revFADP provide for?

The fines target specific failings. Article 60 punishes with a fine of up to 250,000 francs private persons who, intentionally:

  • provide inaccurate or incomplete information when informing data subjects or in response to an access request;
  • fail to inform the person concerned of the collection of their data or of an automated decision;
  • provide false information to the Commissioner or refuse to cooperate with the Commissioner's investigation.

According to the online commentary on Article 60, written by Jonas D. Gassmann on Onlinekommentar.ch, negligence is not punished. Conditional intent (dolus eventualis), however, is sufficient. The first two cases are prosecuted on complaint, the third ex officio.

The same commentary highlights the difference from the GDPR: in Switzerland, the fine targets the natural persons acting for the company, executives or other responsible persons. These fines fall within the remit of the criminal courts, not the Commissioner.

revFADP and GDPR: what are the differences?

The two texts are similar in substance. According to the Confederation's SME portal, a company that already complies with the GDPR has few changes to make. The following table summarises the main differences between the two texts.

PointrevFADP (Switzerland)GDPR (European Union)
Supervisory authorityFDPIC, in BernNational authority, for example the Commission nationale de l'informatique et des libertés (CNIL) in France
Threshold for reporting a breachLikely high risk for the persons concernedRisk to the rights and freedoms of persons
Reporting deadline"As soon as possible", with no set deadlineWithout undue delay, with an initial notification within 72 hours where feasible
Who is penalisedThe responsible natural persons, fine of up to 250,000 francsThe company concerned

The CNIL, the French authority, specifies that any delay beyond 72 hours must be justified. A Swiss SME that is also subject to the GDPR must therefore keep this benchmark in mind.

What we don't know yet

  • The number of breaches never reported: the Commissioner believes it to be significant, without putting a figure on it.

Sources