Swiss Federal Act on Data Protection (FADP / revFADP)
The Swiss Federal Act on Data Protection (FADP; in German DSG, in French LPD) is Switzerland's data protection law. The totally revised version, often called the revFADP or nFADP, entered into force on 1 September 2023 together with the Data Protection Ordinance, replacing the 1992 Act. It aligns Swiss law with the GDPR and Convention 108+ closely enough to preserve the EU adequacy decision for Switzerland (confirmed by the Commission's January 2024 review), while retaining a distinctly Swiss approach.
Key features include: protection of natural persons only; a category of "sensitive personal data" corresponding to special categories and including data on social assistance measures and administrative or criminal proceedings; the concept of "high-risk profiling"; a general permission principle under which processing is lawful unless it violates the principles or the data subject's personality, with justification grounds required only in case of violation (rather than the GDPR's legal-basis model); duties to inform at collection, to keep a register of processing activities (with SME exemptions), to conduct a DPIA where processing may entail a high risk, to notify the Federal Data Protection and Information Commissioner (FDPIC) of breaches likely to result in a high risk "as quickly as possible", and to implement privacy by design and by default; and criminal fines of up to CHF 250,000 imposed on responsible individuals rather than companies, for intentional breaches of specific duties. The FDPIC has investigation and order powers but cannot impose administrative fines.
Art. 14 revFADP requires private controllers domiciled abroad that process data of persons in Switzerland on a large scale, regularly and with high risk, to appoint a representative in Switzerland, mirroring Art. 27 GDPR. Cross-border disclosures require the destination to appear on the Federal Council's adequacy list or appropriate safeguards such as the EU SCCs with Swiss adaptations, or certification under the Swiss-US Data Privacy Framework. Clinical research is additionally governed by the Human Research Act and its ordinances, with swissethics templates for informed consent. iliomad acts as Swiss Data Protection Representative for life sciences companies.
