Law: Federal Act on Data Protection 2020 (FADP) (only available in German here, in French here, and in Italian here)

Regulator: Federal Data Protection and Information Commissioner (FDPIC)

Summary:  The revised version of the FADP was adopted on September 25, 2020, and broadly seeks alignment with the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR). The FADP entered into force on 1 September 2023, which constituted a one-year transition period for organizations to ensure compliance. Further to the above, the revised version of the Ordinance on the Federal Act on Data Protection (available in French here, in German here, and in Italian here) (FODP) puts certain aspects of the revised FADP into more concrete terms. For example, it sets out the specifics of data security requirements, and the modalities of data breach notices as well as of the right of access and the right to data portability.

The EU has also recognized Switzerland as providing adequate protection of data. With regard to data transfers to the US, the US and Switzerland concluded a new data transfer agreement, referred to as the Swiss-U.S. Data Privacy Framework (Swiss-US DPF) following the FDPIC noting that the Swiss-US Privacy Shield Framework does not guarantee adequate protection for transfers of data to the US. On August 14, 2024, the Swiss Federal Council announced that certified US companies under the new Swiss-US DPF offer an adequate level of protection, allowing for the transfer of personal data between Switzerland and certified US companies without additional guarantees. An amendment to the FODP allowing for data transfers to US organizations under the Swiss-US DPF came into effect on September 15, 2024.

Furthermore, following the adoption of new Standard Contractual Clauses (SCCs) for international data transfers by the European Commission in June 2021, the FDPIC announced, on August 27, 2021, that the EU's SCCs could be used for transfers under Swiss law, subject to certain necessary adaptations and amendments.