Data Protection Monitor
Global Privacy & Data Protection Intelligence

Switzerland (CH) · Module Detail

Switzerland: Lawful Processing & Special Data

← Full Switzerland overview Build report with Switzerland Request deeper dive

#

Structurally different from GDPR's Art 6 lawful-basis model; sensitive-data protections exist but the consent architecture is comparatively lighter.

Primary frameworkFederal Act on Data Protection (FADP), revised version
Supervisory authorityFederal Data Protection and Information Commissioner (FDPIC / EDÖB)
Traffic-light rationale — AmberStructurally different from GDPR's Art 6 lawful-basis model; sensitive-data protections exist but the consent architecture is comparatively lighter.

Sub-modules (4)

Lawful BasesAmber

Swiss law does not treat the absence of a specified legal basis as per se unlawful; unlawfulness is instead assessed against breach of personality rights.

Claims (1):

  • Unlike the EU GDPR, Swiss law does not provide that processing of personal data without a specified legal basis is per se illegitimate; legitimacy instead turns on absence of a breach of personality rights.

Special CategoriesGreen

The revFADP extended the definition of sensitive personal data to explicitly include genetic and biometric data, while retaining a risk-based rather than explicit-consent-centric approach.

Claims (1):

  • The FADP's definition of sensitive personal data was extended in the revision process to cover biometric and genetic data, while maintaining a risk-based approach rather than the EU's explicit-consent concept for such data.

Pseudonymisation And AnonymisationAmber

Anonymised or aggregated data falls outside the FADP's personal-data scope because the person is no longer identifiable; pseudonymised data, by contrast, may still permit re-identification and generally remains in scope.

Claims (1):

  • Anonymised or aggregated data is not personal data under the FADP because the person is not identifiable, whereas pseudonymised data may still permit re-identification and is generally treated as personal data.
Category narrative80 words

Unlike the GDPR's positive lawful-basis requirement, Swiss law does not require a specified legal basis for processing to be lawful per se; processing is only unlawful if it breaches personality rights under the Civil Code/FADP principles. The revFADP nonetheless expanded the definition of sensitive personal data to include genetic and biometric data and retains a risk-based (rather than explicit-consent-centric) approach to sensitive data. Consent functions primarily as a derogation basis for cross-border transfer and is not a universal processing gateway.

no periodic updates on record for this sub-brief

Sources and claims (4)
  1. ProbableOneTrust DataGuidance — Unlike the EU GDPR, Swiss law does not provide that processing of personal data without a specified legal basis is per se illegitimate; legitimacy instead turns on absence of a breach of personality rights.observed
  2. ProbableOneTrust DataGuidance — Under Article 17 of the revised FADP, a cross-border data transfer may be legitimate where the data subject has consented, in addition to contractual necessity, overriding public interest, or the data having been made publicly accessible by the subject.observed
  3. ProbableInternational Association of Privacy Professionals — The FADP's definition of sensitive personal data was extended in the revision process to cover biometric and genetic data, while maintaining a risk-based approach rather than the EU's explicit-consent concept for such data.observed
  4. ProbableOneTrust DataGuidance — Anonymised or aggregated data is not personal data under the FADP because the person is not identifiable, whereas pseudonymised data may still permit re-identification and is generally treated as personal data.observed