Strengthened FDPIC investigative/order powers and an active enforcement docket are confirmed; the no-administrative-fine model and gaps in collective-redress and funding/capacity data warrant amber rather than green.
Primary frameworkFederal Act on Data Protection (FADP), revised version, Arts 49-51, 60-63
Traffic-light rationale — AmberStrengthened FDPIC investigative/order powers and an active enforcement docket are confirmed; the no-administrative-fine model and gaps in collective-redress and funding/capacity data warrant amber rather than green.
Periodic update · new data 2026-11-04Enforcement & Redress
The Federal Data Protection and Information Commissioner has moved from a quiet statutory baseline into a period of visible case activity. The clearest marker is a formal investigation opened on 22 October 2026 into PK Softech AG, the IT services provider at the centre of a cyberattack that the company notified on 8 October 2026 and that reached infrastructure used by Publica and other Swiss pension funds. The Commissioner is understood to have moved in two steps: an informal preliminary inquiry addressed to Publica on 14 October 2026, followed eight days later by the formal investigation into PK Softech AG itself. Because the affected infrastructure serves multiple pension funds, the inquiry may extend further to other federal bodies and pension schemes drawing on the same systems, though that extension has not itself been confirmed.
On the same date, 22 October 2026, the Commissioner issued a separate and binding order against Add Conti GmbH, prohibiting the company from processing or disclosing personal data for advertising purposes without valid consent and requiring comprehensive deletion of the data concerned. This is a completed enforcement outcome rather than an open inquiry: the prohibition and deletion order took effect on issuance.
A third matter closed shortly afterward. On 29 October 2026 the Commissioner concluded an investigation into a credit-reporting agency, issuing a ruling that imposes measures on the firm. The agency's identity does not appear in the Commissioner's own published summary of the matter, so the ruling's scope and the measures it imposes are noted here without a named subject; nothing in the material reviewed resolves that gap.
Taken together, these three matters mark a step up in the volume and visibility of formal Commissioner action within a statutory framework that has not itself changed. The pattern spans a cybersecurity-driven inquiry into a service provider touching retirement-system data, a completed consent-and-deletion order against an advertising-sector processor, and a concluded ruling against a credit-reporting business — three different sectors, three different triggers, converging in the same three-week window.
Outlook
The pension-fund-linked investigation into PK Softech AG is the one to watch for scope: whether the Commissioner's inquiry draws in other federal bodies or pension funds that relied on the same compromised infrastructure will determine whether this stays a single-vendor matter or becomes a sector-wide examination of outsourced IT risk in occupational pension administration. Separately, the rise in breach-notification volume reported across 2026 provides the backdrop against which all three matters are landing: a Commissioner receiving more reports is, on this evidence, also issuing more formal findings, and the unnamed credit-reporting ruling suggests further outcomes may surface with incomplete public detail before fuller particulars become available.
Periodic update · new data 2026-10-25Enforcement & Redress
Switzerland's data-protection enforcement posture tightened materially. The Federal Data Protection and Information Commissioner concluded its investigation into Baselland Transport AG's bodycam use with a decision dated 29 September 2026, prohibiting the company from processing the data at issue. This confirmed enforcement outcome sits alongside a broader, probable pattern of capacity growth: the Commissioner's office has increased its enforcement staff by approximately 30 percent and has concluded its first formal supervisory proceedings under the revised Federal Act on Data Protection, with several of those proceedings reported as contested and currently pending before the Federal Administrative Court.
The combination of a concluded, binding enforcement decision and a meaningfully expanded enforcement staff base is a structural signal that Switzerland's data-protection regulator is moving from an early, establishment-phase posture under the revised Act toward an active, caseload-driven enforcement posture. The presence of contested proceedings now before the Federal Administrative Court is itself significant: it indicates that at least some of the Commissioner's own supervisory decisions are being tested through judicial review, which will over time generate case law clarifying the boundaries of the Commissioner's enforcement powers under the revised Act.
On the Commissioner's formal powers, the standing penalty architecture remains unchanged: criminal fines of up to CHF 250,000 apply to responsible individuals, rather than to organisations as such, reflecting the revised Act's choice to place ultimate criminal liability on the natural persons responsible for a violation rather than on the corporate entity itself. The Commissioner also retains the ability to issue administrative orders, the kind of binding prohibition exercised in the Baselland Transport matter, independent of any criminal-fine process against a responsible individual.
A further standing enforcement reference point, not itself an in-window development, is the Commissioner's earlier investigation into Digitec Galaxus' advertisement-personalisation practices, which led the retailer to implement a one-click opt-out for customers. This earlier case remains a useful comparator for understanding the Commissioner's general approach to concluding investigations with concrete behavioural remedies, of which the Baselland Transport prohibition is a further, and more severe, example in a different sectoral and technological context.
Outlook
The contested proceedings now pending before the Federal Administrative Court are the clearest near-term indicator of how judicial review will shape the practical boundaries of the Commissioner's enforcement powers going forward. Continued growth in enforcement staffing suggests further concluded investigations, of the kind seen in the Baselland Transport matter, should be expected in the period ahead, as scheduled, though the Commissioner's criminal-fine powers remain capped at CHF 250,000 and directed at responsible individuals rather than organisations under the current statutory framework.
Periodic update · new data 2026-10-04Enforcement & Redress
The FDPIC concluded its investigation into Baselland Transport AG (BLT) over the company's use of bodycams, in a decision dated 29 September 2026 and published 1 October 2026, and the outcome is a prohibition on BLT processing the data at issue. This is a dated, confirmed enforcement action rather than a standing framework statement, and it is the single in-window development identified for Switzerland's data-protection regime this cycle. The decision concerns surveillance technology deployed by a transport operator, a sector where bodycam use sits at the intersection of employee monitoring, passenger safety, and public-facing data collection, and the FDPIC's conclusion that processing should be prohibited indicates the Commissioner found the deployment incompatible with the applicable standard under the Federal Act on Data Protection.
The mechanism behind this outcome rests on the FDPIC's standing statutory powers rather than any new legal basis introduced this cycle. Under Article 51 of the revised Federal Act on Data Protection, the FDPIC can order the adjustment, suspension, or cessation of processing, require erasure, and prohibit or condition disclosure abroad, but the Commissioner cannot itself impose administrative fines on companies; criminal fines of up to CHF 250,000 apply instead to the responsible individual rather than the corporate entity. The BLT outcome, a prohibition on processing, is consistent with the ordering powers available to the FDPIC under Article 51, rather than a financial penalty against the company, and this distinction is a structural feature of the Swiss enforcement model that differentiates it from regimes in which the regulator can fine the controller directly.
This single enforcement action should be read against the broader statistical baseline reported for the FDPIC's prior reporting year, in which the Commissioner received 2,447 reports, the substantial majority (2,347) directed against private entities, resulting in 156 low-threshold interventions, 22 preliminary investigations, and 9 formal investigations. The BLT matter fits the pattern of a formal investigation reaching a dated conclusion, and its public conclusion this cycle indicates that at least one of the Commissioner's formal-investigation caseload has now produced an outcome with a prohibition attached, a comparatively significant escalation relative to the lower-threshold interventions that make up the bulk of the FDPIC's caseload.
No other enforcement matter or redress-mechanism development fell within this window. The broader standing features of Switzerland's enforcement and redress architecture, including the FDPIC's general statutory powers and the overall shape of its reporting and investigation pipeline, remain as previously established and are not restated here as new findings.
Outlook
The BLT decision is likely to be read as a signal of the FDPIC's willingness to use its full range of Article 51 ordering powers against a named controller in a sector involving continuous surveillance of employees and the public. The principal open question is whether comparable bodycam or surveillance-camera deployments by other transport operators or public-facing service providers draw similar scrutiny, and whether the FDPIC publishes further guidance specific to bodycam use following this decision. Given that the Commissioner cannot impose administrative fines on companies directly, the practical consequence of this and any follow-on action will continue to be expressed through processing prohibitions and adjustment orders rather than financial penalties against the corporate controller.
D10 · Enforcement & Redress — Full Module Record6 sub-modules · 163 words · 21 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Switzerland