Switzerland is outside the EU but closely aligned with it: the revised Federal Act on Data Protection (FADP) mirrors much of the GDPR and the EU recognises Switzerland as adequate. One notable difference is that fines are criminal and are imposed on responsible individuals, not companies.
There is no Swiss AI Act; the government has chosen to ratify the Council of Europe AI Convention and adapt existing laws sector by sector.
- Core data law
- Revised Federal Act on Data Protection (revFADP)
- In force
- 1 Sep 2023
- Regulator
- Federal Data Protection and Information Commissioner (FDPIC)
- Penalties
- Criminal fines up to CHF 250,000 on responsible individuals
- US transfers
- Swiss–US Data Privacy Framework (since Sep 2024)
- AI
- No horizontal law; sector-by-sector adaptation
Who needs to comply
Companies processing data with effects in Switzerland
The revFADP applies to processing that has effects in Switzerland, even from abroad.
Foreign controllers processing Swiss residents’ data at scale
A Swiss representative may be required in certain cases.
The laws, in detail
01Revised Federal Act on Data Protection (revFADP)
Transparency, purpose limitation, privacy by design, DPIAs, records, breach notification and transfers.
When it applies
Processing with effects in Switzerland.
What you must do
- Privacy notice with prescribed contents
- Records of processing (with SME relief)
- DPIA for high-risk processing
- Notify the FDPIC of high-risk breaches as soon as possible
- Inform people about automated individual decisions
- Transfers to adequate countries or with safeguards
Regulator
FDPIC
Penalties
Criminal fines up to CHF 250,000 against responsible individuals for intentional violations.
02Telecommunications Act & Unfair Competition Act (cookies and marketing)
Information about cookies and similar tracking, and consent for mass electronic advertising.
When it applies
Websites and apps used in Switzerland; businesses sending marketing emails or SMS.
What you must do
- Inform users about cookies and how to refuse them
- Prior consent for mass electronic advertising, with existing-customer exception
- Sender identification and easy unsubscribe
Regulator
FDPIC; SECO; courts
Penalties
Fines and civil claims under the Unfair Competition Act.
03Information Security Act (cyberattack reporting)
Mandatory reporting of cyberattacks on critical infrastructure.
When it applies
Operators of critical infrastructure, including certain digital and financial providers.
What you must do
- Report cyberattacks to the NCSC within 24 hours of discovery
- Complete the report within 14 days
Regulator
National Cyber Security Centre (NCSC)
Penalties
Fines up to CHF 100,000 for failing to report (from Oct 2025).
04FINMA licensing & DLT Act
Fintech and DLT trading facility licences, and AML rules for crypto businesses.
When it applies
Fintech, crypto and DLT businesses in Switzerland.
What you must do
- Check FINMA licensing (including the fintech licence)
- AML membership or supervision
- DLT securities and trading facility rules
Regulator
FINMA
Penalties
Enforcement and licence action.
Compliance checklist
01 · Before you launch
- Swiss-specific privacy notice
- Check the Swiss representative requirement
- Transfer basis (Swiss–US DPF or SCCs with Swiss addendum)
02 · At launch
- Breach notification process
- Automated decision notices
03 · As you scale
- DPIAs for high-risk processing
- Train responsible managers on personal liability
Key dates
- 1 Sep 2023revFADP in force
- 15 Sep 2024Swiss–US Data Privacy Framework
Common mistakes
- Assuming GDPR compliance covers Switzerland without Swiss notices and transfer adjustments
- Ignoring personal liability for managers
FAQs
Are Swiss fines imposed on companies?
Generally no; criminal fines target the responsible individuals, although companies can be fined in limited cases.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.