Switzerland

Full entry AI-checked Checked 5 November 2026

Laws

Law	Citation	Status	In force from
Federal Act on Data Protection (FADP)	SR 235.1, Federal Act of 25 September 2020	In force	1 September 2023
Data Protection Ordinance (DPO)	SR 235.11, Ordinance of 31 August 2022	In force	1 September 2023
Telecommunications Act (TCA)	SR 784.10, Federal Act of 30 April 1997	In force	1 January 1998
Federal Act on Unfair Competition (Unfair Competition Act, UCA)	SR 241, Federal Act of 19 December 1986	In force	1 March 1988
No AI-specific law yet (planned rules to ratify the Council of Europe AI Convention)	Federal Council decision of 12 February 2025. A consultation draft, first due by the end of 2026, is now expected in spring 2027	No law	—

Federal Act on Data Protection (FADP): The revised Act replaced the Data Protection Act of 19 June 1992. It protects personal data of natural persons only. Its latest change of substance, on 1 April 2025, lets the FDPIC pass breach reports to the Federal Office for Cybersecurity with the controller’s consent. The English translation still uses that office’s old name, National Cyber Security Centre.
Data Protection Ordinance (DPO): Details on data security, breach reports, records, the list of countries with adequate protection (Annex 1) and FDPIC fees. Amended with effect from 1 December 2025, mainly on logging by federal bodies and how adequacy is assessed.
Telecommunications Act (TCA): Article 45c, in force since 1 April 2007, covers cookies and other processing of data on users’ devices. The link is the German text.
Federal Act on Unfair Competition (Unfair Competition Act, UCA): Article 3(1)(o), in force since 1 April 2007, covers spam. Letters (u) to (w) cover telemarketing.
No AI-specific law yet (planned rules to ratify the Council of Europe AI Convention): The Federal Council chose targeted changes to existing laws, covering transparency, data protection, non-discrimination and supervision. On 23 September 2026 SECO’s SME portal said the consultation draft would be prepared in spring 2027. No draft had been published by 5 November 2026.

Regulators

Federal Data Protection and Information Commissioner (FDPIC)

What builders must do

Who it covers

The FADP covers personal data of natural persons processed by private persons and federal bodies. It applies to anything that has an effect in Switzerland, even if it starts abroad. A private controller based abroad must appoint a Swiss representative if it processes data of people in Switzerland on a large scale, regularly and with a high risk, in connection with offering them goods or services or monitoring their behaviour.

Lawful bases

Unlike federal bodies, which need a basis in law, private persons need no legal basis to process data. They must follow the processing principles. Processing that breaches someone’s personality rights, for example by going against their express wishes, is allowed only with the person’s consent, where a law permits it, or where a private or public interest outweighs theirs. Consent must be explicit for sensitive data and high-risk profiling.

The FADP sets no age for consent. Under the Civil Code, a minor who has capacity of judgement exercises strictly personal rights on their own. Capacity of judgement depends on the ability to act rationally, not on a fixed age. For a child who lacks it, the legal representative acts.

Sources: fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/24/233_245_233/… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/24/233_245_233/…

Children

The FADP has no child-specific rules, so the general rules apply. A Federal Act on communication platforms and search engines is pending. On 14 October 2026 the Federal Council decided to add to the draft duties for very large platforms and search engines to assess and reduce risks to minors, and a ban on showing minors ads based on profiling. The dispatch to Parliament is due by the end of June 2027.

Sources: admin.ch/de/newnsb/NMn5s24l8NjQ · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/202507…

Cookies and similar technologies

Storing or reading data on users’ devices is allowed if users are told about it and its purpose and that they can refuse, unless it’s for providing or billing a telecoms service. This is an opt-out rule. The FDPIC’s cookie guidelines (January 2025, updated October 2025) say explicit consent is needed when cookies involve sensitive data or high-risk profiling, which cross-site third-party tracking can reach. Refusing must not take much more effort than accepting.

Sources: fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/1997/2187_2187_… · edoeb.admin.ch/dam/en/sd-web/brLL9rM3ny9d/Leitfaden des EDÖB betreffe… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/202507…

Electronic marketing

Mass advertising by email, SMS or other telecoms needs prior consent, the correct sender and a simple, free way to refuse. A seller that got a customer’s contact details in a sale, and offered a way to refuse, may advertise its own similar products to them without consent. Advertising calls must respect the phone directory’s no-advertising note, which also covers people with no entry, and show a registered number. Wilful breaches are crimes, prosecuted on complaint.

Sources: fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/1988/223_223_22… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/1988/223_223_22…

Breach notification

Report a breach likely to cause a high risk to people’s personality or fundamental rights to the FDPIC as quickly as possible, in stages if needed; there’s no fixed deadline. Processors tell the controller as quickly as possible. Tell those affected if needed to protect them or the FDPIC asks. Keep breach records at least two years. Since 1 April 2025, critical infrastructure operators and others, such as Swiss cloud, search engine and data centre providers and some makers of software the operators use, must report certain cyberattacks to the Federal Office for Cybersecurity within 24 hours.

Sources: fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/202507… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/568/202512… · edoeb.admin.ch/dam/en/sd-web/T64CAUyvAMcF/1_2 Leitfaden des EDÖB betr… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/232/202510… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/232/202510…

Registration and fees

Private controllers don’t register or pay a fee. They keep a record of processing activities, unless they have fewer than 250 employees and don’t process large volumes of sensitive data or do high-risk profiling. Only federal bodies report their records to the FDPIC. The FDPIC charges CHF 150 to 250 an hour for some services, such as opinions on codes of conduct, approving clauses or binding corporate rules, and DPIA consultations, plus up to 50% for exceptionally extensive, complex or urgent work, or up to 100% if the payer can use the service commercially.

Sources: fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/202507… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/568/202512… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/202507… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/568/202512… · edoeb.admin.ch/en/reporting-portals

Data protection officer

Private controllers may appoint a data protection officer but don’t have to. If the officer is independent, has the expertise and no conflicting tasks, and their contact details are published and notified to the FDPIC, the controller can consult the officer instead of the FDPIC after a high-risk DPIA. Federal bodies must appoint one.

International transfers

Data may go to countries on the Federal Council’s list (Annex 1 of the Ordinance), which includes the EU and EEA states and the UK, and since 15 September 2024 US organisations certified under the Swiss-US Data Privacy Framework. Otherwise use a safeguard, such as standard clauses the FDPIC recognises (the EU SCCs, adapted for Swiss law), binding corporate rules, or other clauses notified to the FDPIC first. A few exceptions apply, such as explicit consent.

Impact assessments

Carry out a DPIA before processing likely to cause a high risk, such as large-scale sensitive data or systematic large-scale monitoring of public areas. If a high risk remains despite the planned measures, ask the FDPIC first. It has two months to object, or three for complex cases. A private controller can consult its data protection officer instead. A certified system or a qualifying code of conduct can replace the DPIA.

Sources: fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/202507… · fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/202507…

Automated decisions and AI

Tell people about decisions based solely on automated processing that have legal effects or a considerable adverse effect on them. On request, let them give their view and have a person review the decision, unless it’s tied to a contract and their request is met, or they explicitly consented. The FDPIC says the FADP applies directly to AI. There’s no AI-specific law yet. The Federal Council plans targeted changes to ratify the Council of Europe AI Convention. A consultation draft, first due by the end of 2026, is now expected in spring 2027.

Sources: fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/202507… · edoeb.admin.ch/en/ai-and-data-protection · bj.admin.ch/de/kuenstliche-intelligenz · kmu.admin.ch/de/bis-anfang-2027-soll-ein-vorentwurf-zur-ki-regulierun…

Penalties

The FDPIC doesn’t fine. It can order processing to change or stop and data to be deleted. Cantonal authorities can fine responsible individuals up to CHF 250,000 for wilful breaches of duties to inform and cooperate, the transfer and processor rules, minimum data security, professional secrecy and FDPIC rulings, mostly on complaint. A business is fined instead only for amounts up to CHF 50,000, when finding the person responsible would be disproportionate. Since 1 October 2025, wilfully ignoring a ruling of the Federal Office for Cybersecurity can be fined up to CHF 100,000.

History

Date	Change
5 November 2026	First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review.

Report a change

If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/ch.yaml.