---
title: "Switzerland — Lawful Processing & Special Data | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/switzerland/lawful-processing-and-special-data/
source_html: /jurisdictions/switzerland/lawful-processing-and-special-data/index.html
description: "Switzerland — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 4 claims Amber ▾ # Structurally different from GDPR's Art 6 lawful-basis model; sensitive-dat"
generated_at: 2026-10-25T04:46:50Z
content_sha256: f23233c92cad18596ac23d7054389c84837d35aef1c77c7e750f51d9aafc4f91
generator: "fe-fleet/md-twin@1.0"
---
# Switzerland — Lawful Processing & Special Data | Data Protection Monitor

### D2Lawful Processing & Special Data4 sub-modules4 claimsAmber▾#

Structurally different from GDPR's Art 6 lawful-basis model; sensitive-data protections exist but the consent architecture is comparatively lighter.

Primary framework Federal Act on Data Protection (FADP), revised version

Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch)

Traffic-light rationale — Amber Structurally different from GDPR's Art 6 lawful-basis model; sensitive-data protections exist but the consent architecture is comparatively lighter.

#### Sub-modules (4)

#### Lawful BasesAmber

Swiss law does not treat the absence of a specified legal basis as per se unlawful; unlawfulness is instead assessed against breach of personality rights.

Claims (1):

- Unlike the EU GDPR, Swiss law does not provide that processing of personal data without a specified legal basis is per se illegitimate; legitimacy instead turns on absence of a breach of personality rights.

#### Consent ThresholdsGreen

Consent is one of several grounds (alongside contractual necessity, overriding public interest, and public availability of the data) that can legitimize a cross-border transfer under Art 17 revFADP.

Claims (1):

- Under Article 17 of the revised FADP, a cross-border data transfer may be legitimate where the data subject has consented, in addition to contractual necessity, overriding public interest, or the data having been made publicly accessible by the subject.

#### Special CategoriesGreen

The revFADP extended the definition of sensitive personal data to explicitly include genetic and biometric data, while retaining a risk-based rather than explicit-consent-centric approach.

Claims (1):

- The FADP's definition of sensitive personal data was extended in the revision process to cover biometric and genetic data, while maintaining a risk-based approach rather than the EU's explicit-consent concept for such data.

#### Pseudonymisation And AnonymisationAmber

Anonymised or aggregated data falls outside the FADP's personal-data scope because the person is no longer identifiable; pseudonymised data, by contrast, may still permit re-identification and generally remains in scope.

Claims (1):

- Anonymised or aggregated data is not personal data under the FADP because the person is not identifiable, whereas pseudonymised data may still permit re-identification and is generally treated as personal data.

Category narrative 80 words

Unlike the GDPR's positive lawful-basis requirement, Swiss law does not require a specified legal basis for processing to be lawful per se; processing is only unlawful if it breaches personality rights under the Civil Code/FADP principles. The revFADP nonetheless expanded the definition of sensitive personal data to include genetic and biometric data and retains a risk-based (rather than explicit-consent-centric) approach to sensitive data. Consent functions primarily as a derogation basis for cross-border transfer and is not a universal processing gateway.

no periodic updates on record for this sub-brief

Evidence 4

Sources and claims (4)
- Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/switzerland_-_third_country_assessment_guidance_note_dataguidance.pdf) — Unlike the EU GDPR, Swiss law does not provide that processing of personal data without a specified legal basis is per se illegitimate; legitimacy instead turns on absence of a breach of personality rights.observed 2026-08-03
- Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/switzerland_-_third_country_assessment_guidance_note_dataguidance.pdf) — Under Article 17 of the revised FADP, a cross-border data transfer may be legitimate where the data subject has consented, in addition to contractual necessity, overriding public interest, or the data having been made publicly accessible by the subject.observed 2026-08-03
- Probable[International Association of Privacy Professionals](https://iapp.org/news/a/revision-of-the-swiss-data-protection-act-evolution-but-not-revolution) — The FADP's definition of sensitive personal data was extended in the revision process to cover biometric and genetic data, while maintaining a risk-based approach rather than the EU's explicit-consent concept for such data.observed 2026-08-03
- Probable[OneTrust DataGuidance](https://free.dataguidance.com/laws/switzerland-federal-data-protection-act-draft/) — Anonymised or aggregated data is not personal data under the FADP because the person is not identifiable, whereas pseudonymised data may still permit re-identification and is generally treated as personal data.observed 2026-08-03