--- title: "Switzerland Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/switzerland/ source_html: /jurisdictions/switzerland/index.html description: "Switzerland data protection and privacy regulation: 10 categories, 105 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: 311c7040ed523dcf96925aacb4f70ce637e5053d81c2e21a000b864c6daa341c generator: "fe-fleet/md-twin@1.0" --- # Switzerland Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Switzerland Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/switzerland/), [World Payments](https://payments.gi/jurisdictions/switzerland/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 105 claims · 105 sources in the cumulative register Download report (PDF) Expand all Switzerland's revised Federal Act on Data Protection (revFADP) entered into force on 1 September 2023, and the Federal Data Protection and Information Commissioner (FDPIC) is understood to operate as the sole federal supervisory authority responsible for enforcing it. Data collected 2026-11-02 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Lawful Processing & Special Data, Data Subject Rights, Enforcement & Redress (7 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=SWITZERLAND)[Build Report](/reports/?j=SWITZERLAND)[Compare](/compare/?j=SWITZERLAND) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Federal Data Protection and Information Commissioner (FDPIC / EDÖB) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 1 Red categories 57 Sub-modules 105 Claims 2 Tier-1 sources Traffic-light mix 2 green 7 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red ## Jurisdiction brief Jurisdiction lead brief 1,440 Full executive summary 249 ###### Latest update · 25 October 2026 #### Lead Signal The Federal Data Protection and Information Commissioner concluded a material enforcement action, prohibiting Baselland Transport AG from processing bodycam data at issue in a decision dated 29 September 2026. The decision is confirmed, resting on the Commissioner's own published material, and it marks a notable application of Swiss data-protection law to biometric and surveillance-adjacent technology in a transport-sector context. Alongside the concluded case, the Commissioner's enforcement capacity has grown: reporting places the increase in enforcement staff at approximately 30 percent, alongside the conclusion of the regulator's first formal supervisory proceedings under the revised Federal Act on Data Protection, with several of those proceedings reported as contested and currently pending before the Federal Administrative Court. The bodycam decision sits within the Commissioner's broader algorithmic, biometric, and surveillance governance remit, though the specific legal test applied in reaching the prohibition, meaning which provision of the revised Act and which necessity or proportionality standard the Commissioner relied on, was not independently confirmed from the decision text itself. What is established is the outcome: the Commissioner concluded its investigation and prohibited the company from processing the data at issue, a clear enforcement result rather than a softer recommendation or guidance. #### Other Developments Enforcement capacity continues to expand alongside active caseload growth. The Commissioner's office has grown its enforcement staff by roughly 30 percent and has concluded its first formal supervisory proceedings under the revised Federal Act on Data Protection, with several contested matters now pending before the Federal Administrative Court. This combination, growing capacity and a developing body of contested case law, suggests the Commissioner's enforcement posture is still maturing in its early years under the revised Act, with judicial review now beginning to test the boundaries of the Commissioner's own decisions. #### Cross-Monitor Connections The bodycam enforcement decision against Baselland Transport AG is directly relevant to monitoring of algorithmic and biometric governance more broadly, given the decision's focus on surveillance-adjacent technology deployed in a commercial transport setting; a reader tracking biometric and surveillance regulation generally would find this enforcement outcome relevant beyond Switzerland's borders as a comparator case. The growth in enforcement capacity and the pending contested proceedings before the Federal Administrative Court are relevant to broader regulatory-enforcement trend-tracking, since a regulator's capacity growth and litigation posture are structural indicators of how assertively a data-protection regime is likely to be applied going forward. #### Outlook The outcome of the contested supervisory proceedings currently pending before the Federal Administrative Court will be an important indicator of how the judiciary is calibrating the Commissioner's exercise of its enforcement powers under the revised Federal Act on Data Protection. Separately, further detail on the specific legal basis for the Baselland Transport bodycam prohibition, once available, would clarify how the Commissioner is applying biometric and surveillance-specific standards as at the current state of the law. 1 earlier update not shown here. ###### Standing brief · as of 28 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Switzerland's revised Federal Act on Data Protection (revFADP) entered into force on 1 September 2023, and the Federal Data Protection and Information Commissioner (FDPIC) is understood to operate as the sole federal supervisory authority responsible for enforcing it. This cycle establishes the first full Data Protection Monitor baseline for Switzerland, drawing on structured claims spanning all ten modules of the framework. The most material development is not new legislative activity but a correction to the analytical record itself: a systemic review found that six foundational claims about the Swiss regime — including the FDPIC's supervisory role, the revFADP's entry into force, and its extended territorial scope — had been assigned an assertive confidence level on the strength of a single secondary source each, and confidence in each has been revised downward to a more qualified register. A related research gap has also been resolved: corroborating practitioner sources indicate that private-sector appointment of what Swiss law terms a data protection advisor remains voluntary under Article 10 FADP, while federal bodies are understood to be legally required to appoint a data protection officer under Article 25 of the Data Protection Ordinance. Read together, these two corrections mean the baseline Swiss claim-set entering this cycle's downstream state is materially more conservative and more precisely sourced than the raw research pass first produced it. #### Other Developments Beyond the confidence-tier correction, the revFADP baseline itself carries several structurally significant features. The law is understood to extend Switzerland's territorial scope to processing that has an effect in Switzerland even where it is initiated abroad, and non-Swiss controllers meeting that threshold are understood to be required to designate and publish a Swiss representative responsible for maintaining records of processing activities and producing them to the FDPIC on request. Articles 22-23 of the revFADP are understood to mandate a Data Protection Impact Assessment for high-risk processing by both federal bodies and private persons. On lawful processing, Swiss law is understood not to treat the absence of a specified legal basis as per se unlawful, with unlawfulness instead assessed against breach of personality rights; Article 17 of the revFADP is understood to permit cross-border transfer legitimacy via consent, contractual necessity, overriding public interest, or public availability of the data, and the revFADP is understood to have extended the definition of sensitive personal data to include genetic and biometric data while retaining a risk-based rather than explicit-consent-centric approach. On data subject rights, Article 25 of the revFADP is understood to provide a more detailed access right than the prior 1992 law's single-sentence entitlement, the revised law explicitly states a right to erasure alongside rectification rights under Article 32, and it is understood to introduce a new right to data portability modelled on the GDPR — alongside a narrower objection right than GDPR Article 21, via an opt-out-style mechanism under Article 31(2)(b). On cross-border transfers, Switzerland's adequacy position with the European Union — recognised under Commission Decision 2000/518/EC of 26 July 2000 — is understood to remain current, and UK government adequacy regulations are reported to list Switzerland as holding full adequacy status for restricted transfers under the UK GDPR. On the enforcement side, the FDPIC is understood to have gained the authority to open investigations on its own initiative or on complaint and issue binding orders at the conclusion of an investigation, a marked strengthening from its previously recommendatory-only role; reports attribute to the FDPIC a recent enforcement notice against retailer Digitec Galaxus over cookie-consent practices, followed by the retailer's reported implementation of a one-click cookie opt-out, though the substance of that matter and of related items involving PostFinance's voice-recognition technology rests on paywalled title-level sourcing that has not been independently verified. The FDPIC is not understood to hold a general power to impose administrative sanctions directly on organisations; individual criminal fines of up to CHF 250,000 apply only to a limited set of enumerated offences under Article 63 of the revFADP. #### Cross-Monitor Connections Three items in this cycle's Swiss claim-set intersect with adjacent monitors and are flagged for tracking there rather than analysed further here. Reports attribute to Switzerland's financial regulator, FINMA, maintenance and amendment of an Ordinance on Data Processing applicable to supervised financial institutions, a development relevant to financial-integrity's financial-sector compliance surface. Switzerland's cross-border transfer mechanisms — adequacy, standard contractual clauses, binding corporate rules, and statutory derogations — intersect with payments-data flows between Switzerland and the EU/UK and are flagged for world-payments. And reports attribute to the FDPIC a press release addressing artificial intelligence and data protection, alongside the revFADP's automated-decision-making transparency duties under Article 21; the AI-Act-adjacent governance angle is flagged for the artificial-intelligence monitor, with the data-protection-specific profiling and transparency angle retained here. #### Outlook The Swiss baseline established this cycle is assessed as a comprehensively in-force, GDPR-adjacent omnibus regime that nonetheless retains materially distinct architecture — including a personality-rights-based lawfulness test rather than a GDPR Article 6-style legal-basis requirement, and an FDPIC that lacks general administrative fining power over organisations — and should not be read as a GDPR-equivalent regime for compliance purposes. Enforcement activity is assessed as trending upward in operational terms even as the underlying statutory toolkit remains structurally narrower than EU or UK peer regulators'. The clearest gaps carried forward concern sectoral overlays beyond the general FADP baseline — health, telecoms, credit-scoring, education and insurance-specific rules were not confirmed this cycle — and children- and vulnerable-groups protections, where no specific operative mechanism such as an age threshold or parental-consent rule was confirmed beyond a general legislative intent to align with European standards. These gaps are carried forward as research priorities for the next cycle rather than treated as settled absences. Read full brief · 1440 words Standing brief, as of 28 September 2026. #### Regulatory Status Switzerland's data protection regime is anchored in the revised Federal Act on Data Protection, which entered into force on 1 September 2023 and is enforced by the Federal Data Protection and Information Commissioner (FDPIC) as sole federal supervisory authority. The regime is assessed as comprehensively in force and functionally GDPR-adjacent, while retaining materially distinct architecture: a personality-rights-based lawfulness test rather than a GDPR Article 6-style legal-basis requirement, and an FDPIC that lacks general administrative fining power over organisations, with individual criminal fines of up to CHF 250,000 reserved for a limited set of enumerated offences. Switzerland holds dual adequacy status, recognised by the European Commission under Commission Decision 2000/518/EC since 26 July 2000 and by the UK government under its post-Brexit adequacy regulations. The FDPIC's enforcement posture has strengthened structurally through binding-order authority introduced by the revFADP, and its operational activity is showing an uptick, including matters involving Digitec Galaxus's cookie-consent practices, PostFinance's voice-recognition technology, and an investigation into bodycam use by transport operator BLT. #### Outlook Switzerland's overall regulatory risk posture is assessed as moderate, with a trajectory of stability accompanied by incremental clarification rather than material legislative change this cycle. Confirmed gaps remain in sectoral overlays beyond the general FADP baseline, in operative child- and vulnerable-groups protections, and in independent verification of several 2025-2026 enforcement matters that currently rest on paywalled title-level sourcing; these gaps are treated as genuine research priorities for subsequent cycles rather than as settled absences. Read full brief · 249 words Key regulatory facts for Switzerland Regulatory Dimension Switzerland Standing Position Jurisdiction Switzerland (CH) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 105 sourced findings) Regulator & Framework A comprehensive, currently-in-force omnibus statute with an active, empowered supervisory authority; GDPR-aligned but not identical. Lawful Processing & Special Data Structurally different from GDPR's Art 6 lawful-basis model; sensitive-data protections exist but the consent architecture is comparatively lighter. Data Subject Rights Core rights are present and GDPR-inspired, but the objection right is narrower and exact response-window detail is unconfirmed. Controller/Processor Duties Core accountability infrastructure (DPIA, security, retention, breach notification) is in force and GDPR-adjacent, but breach-notification timing and DPO-threshold specifics carry residual uncertainty. Primary Instruments Cited OneTrust DataGuidance, International Association of Privacy Professionals, FDPIC, FDPIC, Fedlex (Swiss Federal Chancellery) Last Confirmed / Updated 2026-11-04 (105 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Switzerland: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ A comprehensive, currently-in-force omnibus statute with an active, empowered supervisory authority; GDPR-aligned but not identical. Primary framework Federal Act on Data Protection (FADP), revised version in force 1 September 2023 Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Green A comprehensive, currently-in-force omnibus statute with an active, empowered supervisory authority; GDPR-aligned but not identical. #### Sub-modules (5) #### Regulator And AuthorityGreen The FDPIC is the federal supervisory authority; cantons additionally maintain their own commissioners for cantonal/communal bodies, creating a partially federated oversight structure alongside the federal regime. Claims (3): - The Federal Data Protection and Information Commissioner (FDPIC) is the federal data protection authority responsible for supervising the FADP. - FDPIC (Federal Data Protection and Information Commissioner) — Supervises compliance with the revFADP, in force since September 2023 - Federal Data Protection and Information Commissioner (FDPIC) — The FDPIC enforces the FADP, including conducting investigations, issuing binding decisions and administrative measures, and recommending corrective actions; criminal sanctions in serious cases are imposed by criminal prosecution authorities. #### Act And InstrumentsGreen The revFADP and its Ordinance constitute the primary instruments, in force since 1 September 2023, replacing the 1992 FADP and bringing Swiss law closer to GDPR standards. Claims (2): - The revised Swiss Federal Act on Data Protection came into force on 1 September 2023, bringing Switzerland's data protection regime into closer alignment with the EU GDPR. - Revised FADP (nFADP/revDSG), SR 235.1 — nFADP in force 2023-09-01 #### Material ScopeGreen The FADP applies as an omnibus law to processing of personal data by private persons and federal bodies irrespective of sector; cantonal acts govern cantonal/communal bodies separately. Claims (2): - The FADP is an omnibus law applying to any processing of personal data by private persons and federal bodies, irrespective of sector, while cantonal acts separately govern cantonal and communal bodies. - FADP Art 2(1)-(3) — FADP material scope and exceptions #### Territorial ScopeGreen The revFADP's territorial scope was broadened, GDPR-style, to capture processing with an effect in Switzerland even if the processing activity is initiated from abroad. Claims (2): - The revFADP applies to circumstances that have an effect in Switzerland even where the processing activity is initiated abroad, giving the FDPIC competence over any activity with Swiss impact regardless of origin. - FADP Art 3(1)-(2) — extraterritorial effects-principle scope #### Regulator Registration And FilingAmber There is no general controller-registration/filing regime; instead, non-Swiss controllers meeting territorial-scope criteria must designate and publish a Swiss representative, who is responsible for maintaining the controller's records of processing and producing them to the FDPIC on request. Claims (1): - Where the revFADP's extraterritorial scope applies, the controller must appoint and publicly identify a Swiss representative, who is responsible for maintaining the controller's record of processing activities and providing it to the FDPIC on request. Switzerland's data protection regime is governed by the revised Federal Act on Data Protection (revFADP, FADP 2020), which entered into force on 1 September 2023 alongside its implementing Ordinance, replacing the 1992 FADP. The regime is enforced by the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), an independent federal authority. The revFADP brings Switzerland into closer alignment with the GDPR while retaining distinctly Swiss features (e.g., no general administrative fining power for the FDPIC, personality-rights-based unlawfulness test). Territorial scope was significantly broadened to reach processing with an effect in Switzerland even where initiated abroad. No periodic updates recorded in this cycle Sources and claims (11) - [OneTrust DataGuidance](https://free.dataguidance.com/laws/switzerland-federal-data-protection-act-draft/) — The Federal Data Protection and Information Commissioner (FDPIC) is the federal data protection authority responsible for supervising the FADP. - [International Association of Privacy Professionals](https://iapp.org/news/a/revised-swiss-data-protection-law-soon-in-effect-with-new-scope-obligations-implications) — The revised Swiss Federal Act on Data Protection came into force on 1 September 2023, bringing Switzerland's data protection regime into closer alignment with the EU GDPR. - [International Association of Privacy Professionals](https://iapp.org/news/a/revised-swiss-data-protection-law-soon-in-effect-with-new-scope-obligations-implications) — The revFADP applies to circumstances that have an effect in Switzerland even where the processing activity is initiated abroad, giving the FDPIC competence over any activity with Swiss impact regardless of origin. - [International Association of Privacy Professionals](https://iapp.org/news/a/revised-swiss-data-protection-law-soon-in-effect-with-new-scope-obligations-implications) — Where the revFADP's extraterritorial scope applies, the controller must appoint and publicly identify a Swiss representative, who is responsible for maintaining the controller's record of processing activities and providing it to the FDPIC on request. - [OneTrust DataGuidance](https://free.dataguidance.com/laws/switzerland-federal-data-protection-act-draft/) — The FADP is an omnibus law applying to any processing of personal data by private persons and federal bodies, irrespective of sector, while cantonal acts separately govern cantonal and communal bodies. - [FDPIC](https://www.edoeb.admin.ch/en/latest-news) — FDPIC (Federal Data Protection and Information Commissioner) — Supervises compliance with the revFADP, in force since September 2023 - [FDPIC](https://www.edoeb.admin.ch/en/ai-and-data-protection) — On 16 October 2026 the FDPIC and the NCSC jointly published guidance stating that the FADP applies directly to AI-supported data processing. - [Fedlex (Swiss Federal Chancellery)](https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/20250707/en/pdf-a/fedlex-data-admin-ch-eli-cc-2022-491-20250707-en-pdf-a.pdf) — Revised FADP (nFADP/revDSG), SR 235.1 — nFADP in force 2023-09-01 - [Fedlex (Swiss Federal Chancellery)](https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/20250707/en/pdf-a/fedlex-data-admin-ch-eli-cc-2022-491-20250707-en-pdf-a.pdf) — FADP Art 2(1)-(3) — FADP material scope and exceptions - [Weblaw AG](https://lex.weblaw.ch/lex.php?lex_id=11674&norm_id=235.1) — FADP Art 3(1)-(2) — extraterritorial effects-principle scope - [Bär & Karrer](https://www.baerkarrer.ch/en/publications/data-protection-und-cybersecurity-in-switzerland-2026-a-country-comparative-guide) — Federal Data Protection and Information Commissioner (FDPIC) — The FDPIC enforces the FADP, including conducting investigations, issuing binding decisions and administrative measures, and recommending corrective actions; criminal sanctions in serious cases are imposed by criminal prosecution authorities. ### Switzerland: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Structurally different from GDPR's Art 6 lawful-basis model; sensitive-data protections exist but the consent architecture is comparatively lighter. Primary framework Federal Act on Data Protection (FADP), revised version Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Structurally different from GDPR's Art 6 lawful-basis model; sensitive-data protections exist but the consent architecture is comparatively lighter. D2 · Lawful Processing — Full Module Record 4 sub-modules · 80 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Switzerland: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Core rights are present and GDPR-inspired, but the objection right is narrower and exact response-window detail is unconfirmed. Primary framework Federal Act on Data Protection (FADP), revised version, Arts 25, 30-32 Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Core rights are present and GDPR-inspired, but the objection right is narrower and exact response-window detail is unconfirmed. #### Sub-modules (5) #### Access RightGreen Article 25 of the revFADP provides a more detailed subject-access right than the prior law's single-sentence entitlement to know whether data is processed. Claims (1): - Article 25 of the revised FADP provides a more detailed access right for data subjects than the prior 1992 FADP's general information-request entitlement. #### Rectification And ErasureGreen The revFADP explicitly states a right to erasure (previously only implicit) alongside rectification rights under Art 32. Claims (1): - The revised FADP explicitly states a right to erasure, whereas the old FADP only implicitly recognised it, and introduces rectification rights under Article 32. #### Restriction And ObjectionAmber A right equivalent to GDPR Art 21 does not exist per se; Swiss law provides a narrower opt-out-style objection right under Art 31(2)(b) revFADP. Claims (1): - A right equivalent to Article 21 of the GDPR does not exist per se under Swiss law; instead, Article 31(2)(b) of the revised FADP provides a data subject right to object to processing, essentially limited to an opt-out right. #### Data PortabilityGreen The right to data portability, copied from the GDPR, is entirely new to Swiss law under the revFADP. Claims (1): - The right to data portability, copied from the GDPR, is completely new to Swiss law under the revised FADP. #### Deadlines And Response WindowsRed Available sources did not confirm a specific statutory response-time window (analogous to the GDPR's one-month period) for Swiss data subject requests. The revFADP substantially strengthens data subject rights compared to the 1992 law, introducing an explicit right to erasure and a wholly new right to data portability modelled on the GDPR, alongside a more detailed access right (Art 25) and rectification rights (Art 32). The objection right, however, remains narrower than GDPR Art 21 — Swiss law provides an opt-out-style objection right rather than a general right to object on grounds relating to particular circumstances. Statutory response-deadline specifics were not confirmed in available sources. No periodic updates recorded in this cycle Sources and claims (4) - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/switzerland_-_third_country_assessment_guidance_note_dataguidance.pdf) — Article 25 of the revised FADP provides a more detailed access right for data subjects than the prior 1992 FADP's general information-request entitlement. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/switzerland-revised-fadp-high-risk-profiling) — The revised FADP explicitly states a right to erasure, whereas the old FADP only implicitly recognised it, and introduces rectification rights under Article 32. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/switzerland_-_third_country_assessment_guidance_note_dataguidance.pdf) — A right equivalent to Article 21 of the GDPR does not exist per se under Swiss law; instead, Article 31(2)(b) of the revised FADP provides a data subject right to object to processing, essentially limited to an opt-out right. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/switzerland-revised-fadp-high-risk-profiling) — The right to data portability, copied from the GDPR, is completely new to Swiss law under the revised FADP. ### Switzerland: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core accountability infrastructure (DPIA, security, retention, breach notification) is in force and GDPR-adjacent, but breach-notification timing and DPO-threshold specifics carry residual uncertainty. Primary framework Federal Act on Data Protection (FADP), revised version, Arts 6-9, 22-24 Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Core accountability infrastructure (DPIA, security, retention, breach notification) is in force and GDPR-adjacent, but breach-notification timing and DPO-threshold specifics carry residual uncertainty. D4 · Controller & Processor — Full Module Record 7 sub-modules · 96 words · 15 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Switzerland: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Robust bidirectional adequacy status (EU since 2000; UK full adequacy) plus a GDPR-mirroring transfer-mechanism toolkit. Primary framework Federal Act on Data Protection (FADP), revised version, Arts 16-17; EU Commission Decision 2000/518/EC Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Green Robust bidirectional adequacy status (EU since 2000; UK full adequacy) plus a GDPR-mirroring transfer-mechanism toolkit. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 81 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Switzerland: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Confirmed financial-sector and employment overlays; several other sectoral sub-modules carry no confirmed findings. Primary framework FADP baseline plus FINMA Ordinance on Data Processing; Code of Obligations (employment) Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Confirmed financial-sector and employment overlays; several other sectoral sub-modules carry no confirmed findings. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 58 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Switzerland: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Active FDPIC cookie/consent enforcement interest confirmed at title level; several adtech sub-modules lack confirmed Swiss-specific rules. Primary framework FADP (general) plus FDPIC guidance on cookies/trackers Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Active FDPIC cookie/consent enforcement interest confirmed at title level; several adtech sub-modules lack confirmed Swiss-specific rules. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 73 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Switzerland: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Biometric/genetic categorisation and FDPIC AI engagement are confirmed; the profiling/ADM regime is structurally narrower than the GDPR and carries residual ambiguity. Primary framework Federal Act on Data Protection (FADP), revised version, Arts 2(2)(c), 21, 31 Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Biometric/genetic categorisation and FDPIC AI engagement are confirmed; the profiling/ADM regime is structurally narrower than the GDPR and carries residual ambiguity. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance The Federal Data Protection and Information Commissioner concluded an investigation into Baselland Transport AG's use of bodycams, prohibiting the company from processing the data at issue in a decision dated 29 September 2026. This is a confirmed development, drawn from the Commissioner's own published decision material, and it constitutes the cycle's most significant biometric and surveillance-governance development for Switzerland. Bodycam deployment by a transport operator sits squarely within the kind of surveillance-adjacent data processing that biometric and surveillance governance frameworks are designed to scrutinise, given the combination of continuous recording, the potential for biometric identification of employees or members of the public, and the commercial transport setting in which the recording occurs. The outcome of the Commissioner's investigation, a prohibition on processing the data at issue, is a clear enforcement result rather than a softer advisory or recommendation. This distinguishes the case from guidance-level interventions and places it in the category of binding regulatory action. What is probable rather than confirmed is the precise legal basis underpinning the prohibition: the specific provision of the revised Federal Act on Data Protection, and the particular necessity or proportionality test the Commissioner applied in reaching the decision, were not independently confirmed from the decision text itself. This is an important qualification, since the strength of any precedent the decision sets for other transport operators or other users of bodycam or similar surveillance technology in Switzerland depends significantly on the specific legal reasoning applied. The decision should be read in the context of the Commissioner's broader, currently expanding enforcement posture, discussed further under redress and enforcement, which includes a roughly 30 percent increase in enforcement staff and the conclusion of the regulator's first formal supervisory proceedings under the revised Act. A biometric and surveillance enforcement action of this kind, concluded with a binding prohibition, is consistent with a regulator that has recently increased its capacity to pursue and conclude investigations into technology-driven processing activities. No other algorithmic or biometric-governance development was identified for Switzerland beyond the Baselland Transport matter. The jurisdiction's broader legal framework for algorithmic decision-making and biometric data processing, beyond what the revised Federal Act on Data Protection itself provides, was not re-researched and should not be assumed unchanged or changed on the basis of this single enforcement action alone. #### Outlook Further detail on the specific legal basis for the Baselland Transport prohibition, once available, would materially improve the ability to assess how strong a precedent this decision sets for other surveillance-adjacent technology deployments in Switzerland. Given the Commissioner's expanding enforcement capacity, further biometric or surveillance-governance enforcement actions, as scheduled or as they arise, would not be surprising in the period ahead, though none beyond the Baselland Transport matter were identified. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 104 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Switzerland: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ General legislative intent to protect minors is confirmed, but no specific operative mechanism (age threshold, parental consent procedure, profiling ban) was substantiated by available sources. Primary framework Federal Act on Data Protection (FADP), revised version (general provisions) Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Red General legislative intent to protect minors is confirmed, but no specific operative mechanism (age threshold, parental consent procedure, profiling ban) was substantiated by available sources. D9 · Children's Privacy — Full Module Record 5 sub-modules · 53 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Switzerland: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strengthened FDPIC investigative/order powers and an active enforcement docket are confirmed; the no-administrative-fine model and gaps in collective-redress and funding/capacity data warrant amber rather than green. Primary framework Federal Act on Data Protection (FADP), revised version, Arts 49-51, 60-63 Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Strengthened FDPIC investigative/order powers and an active enforcement docket are confirmed; the no-administrative-fine model and gaps in collective-redress and funding/capacity data warrant amber rather than green. Periodic update · new data 2026-11-04 #### Enforcement & Redress The Federal Data Protection and Information Commissioner has moved from a quiet statutory baseline into a period of visible case activity. The clearest marker is a formal investigation opened on 22 October 2026 into PK Softech AG, the IT services provider at the centre of a cyberattack that the company notified on 8 October 2026 and that reached infrastructure used by Publica and other Swiss pension funds. The Commissioner is understood to have moved in two steps: an informal preliminary inquiry addressed to Publica on 14 October 2026, followed eight days later by the formal investigation into PK Softech AG itself. Because the affected infrastructure serves multiple pension funds, the inquiry may extend further to other federal bodies and pension schemes drawing on the same systems, though that extension has not itself been confirmed. On the same date, 22 October 2026, the Commissioner issued a separate and binding order against Add Conti GmbH, prohibiting the company from processing or disclosing personal data for advertising purposes without valid consent and requiring comprehensive deletion of the data concerned. This is a completed enforcement outcome rather than an open inquiry: the prohibition and deletion order took effect on issuance. A third matter closed shortly afterward. On 29 October 2026 the Commissioner concluded an investigation into a credit-reporting agency, issuing a ruling that imposes measures on the firm. The agency's identity does not appear in the Commissioner's own published summary of the matter, so the ruling's scope and the measures it imposes are noted here without a named subject; nothing in the material reviewed resolves that gap. Taken together, these three matters mark a step up in the volume and visibility of formal Commissioner action within a statutory framework that has not itself changed. The pattern spans a cybersecurity-driven inquiry into a service provider touching retirement-system data, a completed consent-and-deletion order against an advertising-sector processor, and a concluded ruling against a credit-reporting business — three different sectors, three different triggers, converging in the same three-week window. #### Outlook The pension-fund-linked investigation into PK Softech AG is the one to watch for scope: whether the Commissioner's inquiry draws in other federal bodies or pension funds that relied on the same compromised infrastructure will determine whether this stays a single-vendor matter or becomes a sector-wide examination of outsourced IT risk in occupational pension administration. Separately, the rise in breach-notification volume reported across 2026 provides the backdrop against which all three matters are landing: a Commissioner receiving more reports is, on this evidence, also issuing more formal findings, and the unnamed credit-reporting ruling suggests further outcomes may surface with incomplete public detail before fuller particulars become available. Periodic update · new data 2026-10-25 #### Enforcement & Redress Switzerland's data-protection enforcement posture tightened materially. The Federal Data Protection and Information Commissioner concluded its investigation into Baselland Transport AG's bodycam use with a decision dated 29 September 2026, prohibiting the company from processing the data at issue. This confirmed enforcement outcome sits alongside a broader, probable pattern of capacity growth: the Commissioner's office has increased its enforcement staff by approximately 30 percent and has concluded its first formal supervisory proceedings under the revised Federal Act on Data Protection, with several of those proceedings reported as contested and currently pending before the Federal Administrative Court. The combination of a concluded, binding enforcement decision and a meaningfully expanded enforcement staff base is a structural signal that Switzerland's data-protection regulator is moving from an early, establishment-phase posture under the revised Act toward an active, caseload-driven enforcement posture. The presence of contested proceedings now before the Federal Administrative Court is itself significant: it indicates that at least some of the Commissioner's own supervisory decisions are being tested through judicial review, which will over time generate case law clarifying the boundaries of the Commissioner's enforcement powers under the revised Act. On the Commissioner's formal powers, the standing penalty architecture remains unchanged: criminal fines of up to CHF 250,000 apply to responsible individuals, rather than to organisations as such, reflecting the revised Act's choice to place ultimate criminal liability on the natural persons responsible for a violation rather than on the corporate entity itself. The Commissioner also retains the ability to issue administrative orders, the kind of binding prohibition exercised in the Baselland Transport matter, independent of any criminal-fine process against a responsible individual. A further standing enforcement reference point, not itself an in-window development, is the Commissioner's earlier investigation into Digitec Galaxus' advertisement-personalisation practices, which led the retailer to implement a one-click opt-out for customers. This earlier case remains a useful comparator for understanding the Commissioner's general approach to concluding investigations with concrete behavioural remedies, of which the Baselland Transport prohibition is a further, and more severe, example in a different sectoral and technological context. #### Outlook The contested proceedings now pending before the Federal Administrative Court are the clearest near-term indicator of how judicial review will shape the practical boundaries of the Commissioner's enforcement powers going forward. Continued growth in enforcement staffing suggests further concluded investigations, of the kind seen in the Baselland Transport matter, should be expected in the period ahead, as scheduled, though the Commissioner's criminal-fine powers remain capped at CHF 250,000 and directed at responsible individuals rather than organisations under the current statutory framework. Periodic update · new data 2026-10-04 #### Enforcement & Redress The FDPIC concluded its investigation into Baselland Transport AG (BLT) over the company's use of bodycams, in a decision dated 29 September 2026 and published 1 October 2026, and the outcome is a prohibition on BLT processing the data at issue. This is a dated, confirmed enforcement action rather than a standing framework statement, and it is the single in-window development identified for Switzerland's data-protection regime this cycle. The decision concerns surveillance technology deployed by a transport operator, a sector where bodycam use sits at the intersection of employee monitoring, passenger safety, and public-facing data collection, and the FDPIC's conclusion that processing should be prohibited indicates the Commissioner found the deployment incompatible with the applicable standard under the Federal Act on Data Protection. The mechanism behind this outcome rests on the FDPIC's standing statutory powers rather than any new legal basis introduced this cycle. Under Article 51 of the revised Federal Act on Data Protection, the FDPIC can order the adjustment, suspension, or cessation of processing, require erasure, and prohibit or condition disclosure abroad, but the Commissioner cannot itself impose administrative fines on companies; criminal fines of up to CHF 250,000 apply instead to the responsible individual rather than the corporate entity. The BLT outcome, a prohibition on processing, is consistent with the ordering powers available to the FDPIC under Article 51, rather than a financial penalty against the company, and this distinction is a structural feature of the Swiss enforcement model that differentiates it from regimes in which the regulator can fine the controller directly. This single enforcement action should be read against the broader statistical baseline reported for the FDPIC's prior reporting year, in which the Commissioner received 2,447 reports, the substantial majority (2,347) directed against private entities, resulting in 156 low-threshold interventions, 22 preliminary investigations, and 9 formal investigations. The BLT matter fits the pattern of a formal investigation reaching a dated conclusion, and its public conclusion this cycle indicates that at least one of the Commissioner's formal-investigation caseload has now produced an outcome with a prohibition attached, a comparatively significant escalation relative to the lower-threshold interventions that make up the bulk of the FDPIC's caseload. No other enforcement matter or redress-mechanism development fell within this window. The broader standing features of Switzerland's enforcement and redress architecture, including the FDPIC's general statutory powers and the overall shape of its reporting and investigation pipeline, remain as previously established and are not restated here as new findings. #### Outlook The BLT decision is likely to be read as a signal of the FDPIC's willingness to use its full range of Article 51 ordering powers against a named controller in a sector involving continuous surveillance of employees and the public. The principal open question is whether comparable bodycam or surveillance-camera deployments by other transport operators or public-facing service providers draw similar scrutiny, and whether the FDPIC publishes further guidance specific to bodycam use following this decision. Given that the Commissioner cannot impose administrative fines on companies directly, the practical consequence of this and any follow-on action will continue to be expressed through processing prohibitions and adjustment orders rather than financial penalties against the corporate controller. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 163 words · 21 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties