Swiss FADP vs EU GDPR: The Differences That Matter for Your Business
The revised Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023, closely follows the GDPR. Three differences matter most: fines of up to CHF 250,000 are imposed on responsible individuals, private processing needs no legal basis unless it breaches personality rights, and a Swiss representative is required only when four conditions all apply.
Key Takeaways
• A GDPR programme covers most of what the FADP asks for. The gaps are breach reporting, transfer rules, privacy notice content, and the representative test.
• FADP fines are criminal fines aimed at the responsible people, prosecuted by the cantons. A company is fined only as a fallback, up to CHF 50,000.
• A company outside Switzerland needs a Swiss representative only if its processing of data about people in Switzerland is targeted, large-scale, regular and high-risk, all at once.
What Is the Swiss FADP?
The Federal Act on Data Protection (SR 235.1) is Switzerland’s main data protection law. The revised Act was adopted on 25 September 2020 and came into force on 1 September 2023, replacing the 1992 Act. The Data Protection Ordinance (SR 235.11) provides the details.
The Act protects natural persons whose personal data is processed (Article 1). It applies to private persons and federal bodies (Article 2), and to circumstances that have an effect in Switzerland, even if they were initiated abroad (Article 3). That last rule is how the FADP reaches a company with no Swiss office.
The regulator is the Federal Data Protection and Information Commissioner (FDPIC).
FADP vs GDPR: Comparison Table
| Topic | Swiss FADP | EU GDPR |
|---|---|---|
| Scope | Circumstances that have an effect in Switzerland, even if initiated abroad (Art. 3) | Establishments in the EU, and non-EU companies that offer goods or services to, or monitor, people in the EU (Art. 3) |
| Who it protects | Natural persons (Art. 1) | Natural persons (Art. 1) |
| Legal bases | No general legal basis needed for private processing. A breach of personality rights must be justified by consent, an overriding interest or law (Arts. 30 and 31) | Every processing operation needs one of the six legal bases in Art. 6 |
| Sensitive data | Includes data on administrative and criminal proceedings and on social assistance measures (Art. 5(c)) | Special categories in Art. 9, criminal offence data in Art. 10 |
| Data subject rights | Access, generally within 30 days (Art. 25(7)), portability (Art. 28), review of automated decisions (Art. 21) | Access within one month, extendable (Art. 12(3)), portability (Art. 20), automated decisions (Art. 22) |
| Breach reporting | To the FDPIC “as quickly as possible” if the breach is likely to lead to a high risk (Art. 24) | To the supervisory authority without undue delay and, where feasible, within 72 hours, unless unlikely to result in a risk (Art. 33) |
| Records of processing | Required for controllers and processors (Art. 12). Organisations under 250 employees are exempt unless they process a large volume of sensitive data or carry out high-risk profiling (Ordinance Art. 24) | Required (Art. 30). Under 250 employees exempt unless the processing is likely to result in a risk, is not occasional, or includes special category or criminal data (Art. 30(5)) |
| DPIAs | Required where processing is likely to result in a high risk (Art. 22). FDPIC consultation if high risk remains, unless the data protection officer was consulted (Art. 23) | Required where processing is likely to result in a high risk (Art. 35). Prior consultation if high risk remains (Art. 36) |
| DPO | Optional for private companies (Art. 10) | Mandatory in the cases listed in Art. 37(1) |
| Representative | Required only if all four conditions in Art. 14 apply | Required for non-EU companies covered by Art. 3(2), unless an Art. 27(2) exemption applies |
| International transfers | Countries on the Federal Council’s adequacy list, or safeguards such as clauses notified to the FDPIC or standard clauses it has approved or recognised (Art. 16) | Adequacy decisions or appropriate safeguards (Arts. 44 to 49). Switzerland has an EU adequacy decision |
| Fines | Criminal fines of up to CHF 250,000 on responsible private persons for wilful breaches of listed duties (Arts. 60 to 63). Company fines of up to CHF 50,000 only as a fallback (Art. 64) | Administrative fines on controllers and processors of up to €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83) |
Personal data can move freely in both directions. Switzerland appears on the European Commission’s list of adequacy decisions, and every EU and EEA state appears on the Swiss adequacy list in Annex 1 of the Ordinance.
Who Gets Fined Under the FADP?
Under the GDPR, administrative fines are imposed on the controller or processor, which in practice means the company. Article 83 sets two tiers: up to €10 million or 2% of worldwide annual turnover, and up to €20 million or 4%, whichever is higher in each case.
Under the FADP, fines are criminal penalties imposed on “private persons” who wilfully breach specific duties. Articles 60 to 63 set a maximum of CHF 250,000 for:
• wilfully giving false or incomplete information to data subjects, or wilfully failing to inform them (Art. 60(1));
• wilfully giving the FDPIC false information or failing to cooperate with an investigation (Art. 60(2));
• wilfully transferring data abroad without the required safeguards, using a processor without meeting the legal requirements, or failing to meet the minimum data security requirements (Art. 61);
• wilfully disregarding a ruling of the FDPIC or an appeal court (Art. 63).
Several of these offences are prosecuted only on complaint. The cantons prosecute, and the FDPIC can file a complaint and participate in the proceedings (Art. 65). The FDPIC does not impose fines itself.
The company itself can be ordered to pay only in a narrow case. Under Article 64, if a fine of no more than CHF 50,000 is under consideration and identifying the responsible people would take disproportionate effort, the authority may order the business to pay the fine.
For managers and staff who make data protection decisions, this means personal exposure. Training them on the FADP’s specific duties is part of compliance.
Do You Need a Swiss Representative?
Not always. Under Article 14 FADP, a private controller with its registered office or domicile abroad must appoint a representative in Switzerland only if it processes the personal data of people in Switzerland and the processing meets all four of these conditions:
• it is connected with offering goods or services to, or monitoring the behaviour of, people in Switzerland;
• it is on a large scale;
• it is carried out regularly;
• it poses a high risk to the personality of the data subjects
If any one condition is missing, Article 14 does not require a representative. This is a narrower test than Article 27 of the GDPR, which applies to any company caught by Article 3(2) unless its processing is occasional and low risk.
Where a representative is required, the controller must publish the representative’s name and address (Art. 14(3)). Under Article 15, the representative:
• keeps a record of the controller’s processing activities with the content set out in Article 12(2);
• gives the FDPIC the information in that record on request;
• tells data subjects, on request, how they can exercise their rights.
The representative is the contact point for data subjects and the FDPIC (Art. 14(2)). Companies already working with an Article 27 EU representative will recognise the role.
If You’re GDPR-Compliant, What’s Left to Do for Switzerland?
Most of the work carries over. These are the points to check:
• Run the Article 14 test. Record whether each of the four conditions applies to your Swiss processing, and appoint and publish a representative if all four do.
• Update your privacy notice. Article 19(4) requires you to name the State or international body to which personal data is disclosed, and the safeguard or exception relied on.
• Add the FDPIC to your breach procedure. Notify it as quickly as possible where a breach is likely to lead to a high risk (Art. 24). The Ordinance requires you to document every breach and keep the records for at least two years (Ordinance Art. 15(4)). Our guide to personal data breaches covers the GDPR side.
• Check your transfer mechanisms. Transfers from Switzerland rely on the Swiss adequacy list or on safeguards recognised under Article 16, which is separate from the EU process.
• Widen your sensitive data list. Add data on social assistance measures and on administrative and criminal proceedings or sanctions (Art. 5(c)).
• Recheck the records exemption. The Swiss test for organisations under 250 employees differs from Article 30(5) GDPR.
• Keep DPIAs. The Ordinance requires keeping a DPIA for at least two years after processing ends (Ordinance Art. 14).
• Brief the people who decide. FADP fines fall on individuals who act wilfully, so managers responsible for data protection need to know the Swiss duties.
Conclusion
The revised FADP and the GDPR share most of their structure, so a GDPR-compliant company starts from a strong position. The work for Switzerland is targeted: run the Article 14 test, add the FDPIC to breach reporting, check transfers and privacy notices, and brief the managers who carry personal liability.
If the Article 14 test shows you need a representative, GDPRLocal’s Swiss representative service acts as your contact point for the FDPIC and Swiss data subjects through our Swiss office. It starts from £99 a month, excluding VAT, for companies with fewer than 10 staff.
Frequently Asked Questions
Does the FADP Apply to Companies Outside Switzerland?
It can. Article 3 applies the Act to circumstances that have an effect in Switzerland, even if they were initiated abroad. A company that processes personal data of people in Switzerland should check its obligations under the Act.
Is a GDPR-Compliant Company Automatically FADP-Compliant?
No. Most GDPR measures carry over, and the FADP still has its own requirements, including breach notification to the FDPIC, naming destination countries in privacy notices, the Swiss transfer rules and the Article 14 representative test.
When Did the Revised FADP Come Into Force?
On 1 September 2023. The Act was adopted on 25 September 2020 and replaced the Federal Act on Data Protection of 19 June 1992.
Who Enforces the FADP?
The FDPIC supervises compliance and can investigate and issue rulings. Cantons prosecute and decide criminal fines, and the FDPIC can file a complaint and participate in those proceedings (Art. 65).
Disclaimer: This blog post is for informational purposes only. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.
About the Author
Head of Commercial & Country Manager
Zlatko Delev is Head of Commercial and Country Manager at GDPRLocal, where he leads the company’s commercial strategy and market presence. He brings international experience across sales, marketing, and customer success, along with a legal background from his studies at Iustinianus Primus Law School in Skopje, Macedonia.
Zlatko sits at the front line of GDPRLocal’s client relationships, guiding organisations through the first stages of their compliance journey and helping them understand where they stand and where they need to go on GDPR, information security, and the emerging landscape of AI regulation. His role bridges commercial strategy with practical data protection knowledge, ensuring clients get clear, actionable direction from their very first conversation with GDPRLocal.
Alongside his commercial focus, Zlatko has trained extensively in project management and organisational leadership, including risk management, stakeholder communication, agile methodology, and digital marketing, a broad skill set that supports his structured, delivery-focused approach to growing GDPRLocal’s business internationally.