Framework · FADP – Swiss Federal Act on Data Protection and its ordinance
nDSG: Swiss data protection without guesswork
Customers, users or employees in Switzerland? Then the revised FADP applies, even if you are based abroad. Complass shows what you can take over from the GDPR and what Switzerland requires on top.
What does the FADP govern?
The Federal Act on Data Protection (FADP, SR 235.1) has applied in its totally revised version since 1 September 2023, together with the Data Protection Ordinance (DPO, SR 235.11). It protects the personality of natural persons when their data is processed and governs, among other things, principles, the duty to inform, data security, cross-border disclosure, impact assessments, reporting of data security breaches and the rights of data subjects.
The German statutory text on fedlex.admin.ch is authoritative. The content explains the Act in our own words and does not replace legal advice.
Content as of:
Does it apply to me?
The FADP applies to every company that processes personal data of natural persons where the processing has an effect in Switzerland. A registered office in Switzerland is not required: an online shop abroad with customers in Switzerland or software with Swiss users is also covered. Companies without a registered office in Switzerland need a representative there under narrow conditions.
If you already implement the GDPR, use the GDPR module for the EU duties and this module for the Swiss specifics: own country list, Swiss adaptation of the standard contractual clauses, logging and processing regulations, access within 30 days and fines against responsible individuals.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
- Art. 2 DSGPersonal and material scope
- Art. 3 DSGTerritorial scope (effects doctrine)
- Art. 5 DSGDefinitions
- Art. 14 DSGRepresentative of foreign controllers
- Art. 60 bis 66 DSGCriminal provisions
Key dates
-
Parliament adopts the totally revised FADP
Art. 72 FADP
-
Federal Council adopts the Data Protection Ordinance (DPO)
DPO
-
FADP and DPO enter into force without a transitional period
Art. 69 to 72 FADP
-
USA added to Annex 1 DPO for companies certified under the Swiss-US Data Privacy Framework
Annex 1 DPO
-
As soon as possible
Report of a data security breach likely to result in a high risk to the FDPIC, without a fixed deadline in hours
Art. 24 DSG
-
30 days
Reply to access requests normally within 30 days, in principle free of charge
Art. 25 DSG
How Complass helps
- 9phases
- 22guided steps
- 14document templates
- 76requirements in the catalogue
Guided in nine phases
Applicability and roles, records, principles, information, data security, processors and cross-border disclosure, impact assessment, reports and data subject rights, and governance and sanction risk.
76 duties from the FADP and DPO
Every duty with its provision, an explanation in our own words, a note on differences from the GDPR and an implementation guide with minimum scope and evidence.
14 templates with completion guidance
Including records, privacy notice, processing regulations, data security and logging concept, country list, impact assessment, report to the FDPIC and access process.
Together with the GDPR
Complass suggests adopting evidence from GDPR and ISO 27001 projects through the shared controls.
The phases in the module
- Applicability and roles
- Inventory and record
- Principles and lawful processing
- Information and transparency
- Data security, logging and processing regulations
- Processors and cross-border disclosure
- Impact assessment and data protection by design
- Data security breaches and data subject rights
- Governance, sanction risk and review
Catalogue: FADP – duties under the FADP and DPO
Frequently asked questions
Does the FADP also apply to companies without a registered office in Switzerland?
Yes, as soon as the processing has an effect in Switzerland, for example through customers, users or employees there. Whether a representative in Switzerland is also needed is checked in the first step of the project.
Is our GDPR compliance enough?
To a large extent. Above all you need to add the Swiss country list and clause adaptation, logging and processing regulations in certain cases, the 30-day access deadline and responsibilities for the duties backed by criminal penalties.
Who do the fines apply to?
Fines of up to CHF 250,000 target the responsible natural person who acts intentionally, not automatically the company. Clear responsibilities and documented checks are therefore important.
Does Complass report breaches to the FDPIC?
No. Complass helps with assessment, content and documentation; you submit the report via the FDPIC reporting form.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.