Data Protection Monitor
Global Privacy & Data Protection Intelligence

Switzerland (CH) · Module Detail

Switzerland: Controller/Processor Duties

← Full Switzerland overview Build report with Switzerland Request deeper dive

#

Core accountability infrastructure (DPIA, security, retention, breach notification) is in force and GDPR-adjacent, but breach-notification timing and DPO-threshold specifics carry residual uncertainty.

Primary frameworkFederal Act on Data Protection (FADP), revised version, Arts 6-9, 22-24
Supervisory authorityFederal Data Protection and Information Commissioner (FDPIC / EDÖB)
Traffic-light rationale — AmberCore accountability infrastructure (DPIA, security, retention, breach notification) is in force and GDPR-adjacent, but breach-notification timing and DPO-threshold specifics carry residual uncertainty.

Sub-modules (7)

Accountability And DpiaGreen

Articles 22 and 23 of the revFADP mandate federal bodies and private persons to conduct a Data Protection Impact Assessment where data processing poses high risks to personality or fundamental rights; the FDPIC has published a factsheet with templates and flowcharts.

Claims (1):

  • Articles 22 and 23 of the revFADP mandate federal bodies and private individuals to conduct a Data Protection Impact Assessment if data processing poses high risks to personality or fundamental rights.

Dpo RequirementsAmber

No universal mandatory DPO-appointment threshold analogous to GDPR member-state gold-plating was confirmed; the FDPIC operates a reporting portal for DPOs, suggesting appointment is encouraged/registrable rather than confirmed as strictly mandatory across all controllers in the sources reviewed.

Claims (1):

  • The FDPIC operates a dedicated reporting portal for data protection officers, but a universally mandatory DPO-appointment threshold was not confirmed in the sources reviewed for this run.

Ropa RequirementsGreen

Controllers, including the Swiss representative for foreign controllers, are required to maintain records of processing activities and provide them to the FDPIC upon request.

Claims (1):

  • The Swiss representative appointed by a non-Swiss controller is responsible for maintaining the controller's record of processing activities and providing it to the FDPIC upon request.

Joint Controller ArrangementsRed

No source reviewed specified a distinct statutory joint-controller regime analogous to GDPR Art 26.

Absence provenance: unavailable. Searched: FADP joint controller arrangement Article, revFADP joint controllership.

Security MeasuresGreen

Article 7 of the FADP requires that personal data be protected against unauthorised processing through adequate technical and organisational measures.

Claims (1):

  • Article 7 of the FADP requires that personal data be protected against unauthorised processing through adequate technical and organisational measures.

Breach NotificationAmber

The revFADP introduces an obligation to notify the FDPIC of a data breach as soon as possible where it is likely to result in high risk to the data subject's personality or fundamental rights; no fixed numerical deadline equivalent to the GDPR's 72 hours was confirmed as of the guidance reviewed.

Claims (1):

  • Controllers are obliged to inform the FDPIC of a data breach as soon as possible when it is likely to result in a high risk to the data subject's personality or fundamental rights, with no confirmed fixed statutory time limit equivalent to the GDPR's 72 hours.

Retention And DisposalGreen

Article 6(4) of the revised FADP clarifies that data must either be deleted or anonymised once the purpose for its collection has been achieved.

Claims (1):

  • Article 6(4) of the revised FADP requires that all personal data be either deleted or anonymised once the purpose for its collection has been achieved.
Category narrative96 words

The revFADP introduces mandatory DPIAs for high-risk processing (Arts 22-23), strengthened security-of-processing obligations (Art 7 FADP baseline), an explicit purpose-limitation-driven retention/disposal duty (Art 6(4)), and a new breach-notification obligation owed to the FDPIC 'as soon as possible' where a breach is likely to result in high risk, though no fixed numerical deadline (unlike the GDPR's 72 hours) was confirmed. Records-of-processing obligations attach to controllers (and, for foreign controllers, their Swiss representative). DPO appointment does not appear to carry a universal mandatory threshold as under some GDPR member-state laws; the FDPIC operates a voluntary DPO reporting portal.

no periodic updates on record for this sub-brief

Sources and claims (6)
  1. ConfirmedOneTrust DataGuidance — Articles 22 and 23 of the revFADP mandate federal bodies and private individuals to conduct a Data Protection Impact Assessment if data processing poses high risks to personality or fundamental rights.observed
  2. UncertainOneTrust DataGuidance — The FDPIC operates a dedicated reporting portal for data protection officers, but a universally mandatory DPO-appointment threshold was not confirmed in the sources reviewed for this run.observed
  3. ProbableInternational Association of Privacy Professionals — The Swiss representative appointed by a non-Swiss controller is responsible for maintaining the controller's record of processing activities and providing it to the FDPIC upon request.observed
  4. ProbableOneTrust DataGuidance — Article 7 of the FADP requires that personal data be protected against unauthorised processing through adequate technical and organisational measures.observed
  5. ProbableInternational Association of Privacy Professionals — Controllers are obliged to inform the FDPIC of a data breach as soon as possible when it is likely to result in a high risk to the data subject's personality or fundamental rights, with no confirmed fixed statutory time limit equivalent to the GDPR's 72 hours.observed
  6. ProbableOneTrust DataGuidance — Article 6(4) of the revised FADP requires that all personal data be either deleted or anonymised once the purpose for its collection has been achieved.observed