← Global Privacy Laws Research Library
Federal Act on Data Protection (FADP / revDSG)
Federal Act on Data Protection: Switzerland
Prepared by Shubhank Suman · Last reviewed
CURRENT: REVISED FADP IN FORCE SINCE 1 SEPTEMBER 2023
- Legal character
- Federal statute
- Region
- Europe
What it covers
The revised FADP regulates:
- personal data of natural persons
- processing
- sensitive data
- profiling
- high-risk profiling
- privacy by design/default
- transparency
- data-subject rights
- automated decisions
- DPO/representative obligations
- processing records
- DPIAs
- security
- breach notification
- international disclosure
- sanctions.
Why it matters
The revised FADP is particularly relevant to AI because Switzerland expressly regulates automated individual decisions and the FDPIC has expressly stated that the FADP applies directly to AI-supported processing. (edoeb.admin.ch)
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: High
AI
VERY HIGH
The FDPIC explicitly states that the revised FADP is technology-neutral and directly applicable to AI-supported data processing. It identifies transparency, automated decisions and human review as central AI/privacy issues. (edoeb.admin.ch)
Cybersecurity
HIGH/VERY HIGH
Security obligations and breach reporting apply across the framework.
Applicability
Private controllers and processors and federal bodies within the FADP's territorial scope.
Foreign organisations may also fall within the FADP where their processing has effects in Switzerland.
Current validity
CURRENT REVISED FADP: IN FORCE SINCE 1 SEPTEMBER 2023.
The 1992 FADP has been repealed and replaced.
Read first
Articles 5–7 → Article 12 → Articles 19–22 → Article 24 → Articles 25–32 → Data Protection Ordinance.
Provisions / sections covered
Article 5: Definitions
Important definitions include:
- personal data
- sensitive personal data
- processing
- profiling
- high-risk profiling
- controller
- processor.
Article 6: Processing principles
Covers:
- lawfulness
- good faith
- proportionality
- purpose
- accuracy.
Article 7: Privacy by design/default
The revised FADP incorporates privacy-by-design and privacy-by-default obligations. The FDPIC describes these obligations as applying from the planning stage of processing. (sidd.swiss)
Article 12: Processing records
Certain private organisations and federal bodies must maintain records of processing activities; the FDPIC notes that large private organisations and organisations processing sensitive information at scale/high-risk profiling may fall within the requirements. (edoeb.admin.ch)
Article 21: Automated individual decisions
Where a decision is made exclusively through automated processing and has legal effects or significantly affects the individual, the controller must inform the person and, upon request, allow:
- expression of their point of view
- review by a natural person.
The FDPIC explicitly identifies Article 21 as the relevant provision for AI-supported automated individual decisions. (edoeb.admin.ch)
Article 22: DPIA
A DPIA is required where processing is likely to result in a high risk to personality or fundamental rights.
The FDPIC identifies as important high-risk examples:
- large-scale processing of sensitive data
- systematic large-scale public-area monitoring
- high-risk profiling/new technologies. (edoeb.admin.ch)
Article 24: Data-security breaches
Contains data-security incident notification obligations.
Article 25 onward: Data-subject rights
Includes information/access rights.
Article 28: Data portability
The FDPIC identifies Article 28 as the statutory data-portability provision, supplemented by Articles 20–22 of the DPO. (edoeb.admin.ch)
Subject-matter tags
- Sensitive data
- Data subject rights
- Data portability
- Profiling
- Automated decision-making
- Impact assessment
- Data breach
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Privacy by design
- Enforcement and penalties
- Surveillance
- Transparency
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.