--- title: "Switzerland — Enforcement & Redress | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/switzerland/enforcement-and-redress/ source_html: /jurisdictions/switzerland/enforcement-and-redress/index.html description: "Switzerland — Enforcement & Redress: enforcement_and_redress Enforcement & Redress 6 sub-modules 5 claims Amber ▾ # Strengthened FDPIC investigative/order powers and an active enforcement docket are confirmed; the no-" generated_at: 2026-10-25T04:46:50Z content_sha256: af6d6a8485c0c81350243a93b2be0b0c21449378d4c568b834bbb7601e677e18 generator: "fe-fleet/md-twin@1.0" --- # Switzerland — Enforcement & Redress | Data Protection Monitor ### D10Enforcement & Redress6 sub-modules5 claimsAmber▾# Strengthened FDPIC investigative/order powers and an active enforcement docket are confirmed; the no-administrative-fine model and gaps in collective-redress and funding/capacity data warrant amber rather than green. Primary framework Federal Act on Data Protection (FADP), revised version, Arts 49-51, 60-63 Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Strengthened FDPIC investigative/order powers and an active enforcement docket are confirmed; the no-administrative-fine model and gaps in collective-redress and funding/capacity data warrant amber rather than green. #### Sub-modules (6) #### Regulator Powers And PenaltiesAmber The FDPIC may open investigations ex officio or following complaint and issue binding orders, but is not authorised to impose administrative fines on organisations; instead, individuals may be fined up to CHF 250,000 for a limited set of enumerated criminal offences under the revFADP. Claims (2): - Under the revised FADP, the FDPIC's position is strengthened such that it will be able to open an investigation, ex officio or following a complaint, against a controller and processor, and to issue an order at the end of the investigation. - Unlike most European data protection supervisory authorities, the FDPIC is not authorised to impose administrative sanctions directly on organisations; individuals may instead be fined up to CHF 250,000 for a limited range of enumerated criminal offences under Article 63 and related provisions of the revFADP. #### Enforcement Activity IndexAmber Recent FDPIC enforcement activity includes an enforcement notice to Digitec Galaxus, a decision on PostFinance's biometric voice recognition, an investigation into BLT's bodycam use, and Administrative Court confirmation of an FDPIC processing ban. Claims (1): - Recent FDPIC enforcement matters include an enforcement notice issued to Digitec Galaxus, a decision concerning PostFinance's voice-recognition system, an investigation opened into BLT's bodycam use, and an Administrative Court ruling confirming an FDPIC processing ban. #### Regulator Funding And CapacityRed No specific FDPIC headcount or budget figures were confirmed in this research pass. Absence provenance: unavailable . Searched: FDPIC budget headcount staffing capacity. #### Collective Redress And Class ActionsRed No dedicated collective-redress or class-action mechanism for data protection claims was confirmed for Switzerland in this research pass. Absence provenance: unavailable . Searched: Switzerland collective redress class action data protection. #### Private Right Of ActionAmber Data subjects may pursue civil claims for breach of personality rights under the Swiss Civil Code, which operates alongside the FADP as a governing text for data subject rights enforcement. Claims (1): - The Swiss Civil Code is listed as a governing text alongside the FADP and its Ordinance for data subject rights matters, providing a civil personality-rights avenue for redress. #### Recent Developments 180DAmber Within the last 180 days, reported FDPIC activity includes Digitec Galaxus's implementation of a one-click cookie opt-out (reported mid-February 2026) and the opening of an FDPIC investigation into BLT's use of bodycams (reported late February 2026). Claims (1): - Digitec Galaxus implemented a one-click cookie opt-out mechanism, as reported by the FDPIC in mid-February 2026, following prior enforcement engagement. Category narrative 163 words The FDPIC can open investigations ex officio or on complaint against controllers and processors and, since the revFADP, may issue binding orders at the conclusion of an investigation — a marked strengthening from its prior merely-recommendatory role. Unlike most European DPAs, the FDPIC is not authorised to impose administrative fines directly on organisations; instead, the revFADP creates criminal offences punishable by fines of up to CHF 250,000 against responsible individuals (not the entity) for a limited, enumerated set of violations. Recent enforcement activity includes an enforcement notice to Digitec Galaxus over cookie-consent practices (with subsequent remediation), a decision concerning PostFinance's biometric voice-recognition system, an investigation opened into BLT's use of bodycams, and Administrative Court confirmation of an FDPIC processing ban — though full text of these matters was paywalled and not independently verified beyond title level. Data subjects may also pursue civil claims for breach of personality rights under the Swiss Civil Code. No dedicated collective-redress/class-action mechanism for data protection claims was confirmed. Periodic update · new data 2026-10-04 #### Enforcement & Redress The FDPIC concluded its investigation into Baselland Transport AG (BLT) over the company's use of bodycams, in a decision dated 29 September 2026 and published 1 October 2026, and the outcome is a prohibition on BLT processing the data at issue. This is a dated, confirmed enforcement action rather than a standing framework statement, and it is the single in-window development identified for Switzerland's data-protection regime this cycle. The decision concerns surveillance technology deployed by a transport operator, a sector where bodycam use sits at the intersection of employee monitoring, passenger safety, and public-facing data collection, and the FDPIC's conclusion that processing should be prohibited indicates the Commissioner found the deployment incompatible with the applicable standard under the Federal Act on Data Protection. The mechanism behind this outcome rests on the FDPIC's standing statutory powers rather than any new legal basis introduced this cycle. Under Article 51 of the revised Federal Act on Data Protection, the FDPIC can order the adjustment, suspension, or cessation of processing, require erasure, and prohibit or condition disclosure abroad, but the Commissioner cannot itself impose administrative fines on companies; criminal fines of up to CHF 250,000 apply instead to the responsible individual rather than the corporate entity. The BLT outcome, a prohibition on processing, is consistent with the ordering powers available to the FDPIC under Article 51, rather than a financial penalty against the company, and this distinction is a structural feature of the Swiss enforcement model that differentiates it from regimes in which the regulator can fine the controller directly. This single enforcement action should be read against the broader statistical baseline reported for the FDPIC's prior reporting year, in which the Commissioner received 2,447 reports, the substantial majority (2,347) directed against private entities, resulting in 156 low-threshold interventions, 22 preliminary investigations, and 9 formal investigations. The BLT matter fits the pattern of a formal investigation reaching a dated conclusion, and its public conclusion this cycle indicates that at least one of the Commissioner's formal-investigation caseload has now produced an outcome with a prohibition attached, a comparatively significant escalation relative to the lower-threshold interventions that make up the bulk of the FDPIC's caseload. No other enforcement matter or redress-mechanism development fell within this window. The broader standing features of Switzerland's enforcement and redress architecture, including the FDPIC's general statutory powers and the overall shape of its reporting and investigation pipeline, remain as previously established and are not restated here as new findings. #### Outlook The BLT decision is likely to be read as a signal of the FDPIC's willingness to use its full range of Article 51 ordering powers against a named controller in a sector involving continuous surveillance of employees and the public. The principal open question is whether comparable bodycam or surveillance-camera deployments by other transport operators or public-facing service providers draw similar scrutiny, and whether the FDPIC publishes further guidance specific to bodycam use following this decision. Given that the Commissioner cannot impose administrative fines on companies directly, the practical consequence of this and any follow-on action will continue to be expressed through processing prohibitions and adjustment orders rather than financial penalties against the corporate controller. Evidence 5 Sources and claims (5) - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/opinion/switzerland-revised-fadp-high-risk-profiling) — Under the revised FADP, the FDPIC's position is strengthened such that it will be able to open an investigation, ex officio or following a complaint, against a controller and processor, and to issue an order at the end of the investigation.observed 2026-08-03 - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/opinion/switzerland-revised-fadp-high-risk-profiling) — Unlike most European data protection supervisory authorities, the FDPIC is not authorised to impose administrative sanctions directly on organisations; individuals may instead be fined up to CHF 250,000 for a limited range of enumerated criminal offences under Article 63 and related provisions of the revFADP.observed 2026-08-03 - Uncertain[OneTrust DataGuidance](https://www.dataguidance.com/news/switzerland-fdpic-issues-enforcement-notice-digitec) — Recent FDPIC enforcement matters include an enforcement notice issued to Digitec Galaxus, a decision concerning PostFinance's voice-recognition system, an investigation opened into BLT's bodycam use, and an Administrative Court ruling confirming an FDPIC processing ban.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/notes/switzerland-data-subject-rights-0) — The Swiss Civil Code is listed as a governing text alongside the FADP and its Ordinance for data subject rights matters, providing a civil personality-rights avenue for redress.observed 2026-08-03 - Uncertain[OneTrust DataGuidance](https://www.dataguidance.com/news/switzerland-fdpic-announces-digitec-galaxus-implements) — Digitec Galaxus implemented a one-click cookie opt-out mechanism, as reported by the FDPIC in mid-February 2026, following prior enforcement engagement.observed 2026-08-03