Switzerland

Article 3 paragraph 1 of the Data Protection Act sets the effects test. The Act applies to situations that have an effect in Switzerland, even if they start abroad. Article 14 sets four conditions for appointing a Swiss representative, and all four must be met. You offer goods or services here, or you monitor behaviour here. You do it on a large scale. You do it regularly. And what you do carries a high risk to the personality of the people involved. The representative is a contact point for those people and for the Federal Data Protection and Information Commissioner. Their name and address must be published. Watch the split in Article 2 paragraph 1. The federal Act covers private persons and FEDERAL bodies only. Cantonal and communal authorities, cantonal public hospitals and cantonal schools fall under 26 separate cantonal data protection laws, each with its own commissioner. There is also relief by size in Article 24 of the Data Protection Ordinance. Private organisations with fewer than 250 employees need not keep a record of what they do with personal data. The headcount is taken on 1 January of the year. That relief is lost if you handle a large volume of sensitive personal data, or carry out high-risk profiling.

Your industry decides the answer. On its own, the national rule would be 'conditional'. Checked industry by industry on 18 August 2026: HEALTH, electronic patient record: CLOSED. Article 12 paragraph 5 of the Electronic Patient Record Ordinance says the data stores must be in Switzerland and governed by Swiss law. Article 25 paragraph 6 says the same for the issuers of the login credentials. This is the only outright storage-location ban we found in Swiss federal law. HEALTH, everything else: CONDITIONAL, and you can be prosecuted. Ordinary medical records outside the electronic patient record system have no storage-location rule. But doctors, nurses, pharmacists and psychologists are bound by the criminal secrecy rule in Article 321 of the Criminal Code. BANKING: CONDITIONAL, backed by criminal law. No rule says bank data must stay in Switzerland. Article 47 of the Banking Act makes deliberately revealing a banking secret a crime. It carries up to three years in prison, rising to five where the person makes money from it. Careless disclosure carries a fine of up to 250,000 francs. Separately, the regulator's outsourcing circular allows offshoring on two conditions. The bank must guarantee that it, its auditor and the regulator can enforce inspection and audit rights. And the information needed to restructure or wind up the bank must stay reachable in Switzerland at all times. That second condition means keeping some data here. INSURANCE: the same outsourcing rules as banking. The regulator's outsourcing circular covers insurance companies as well as banks and certain investment firms. Insurers have no equivalent criminal secrecy article. SECURITIES AND MARKET INFRASTRUCTURE: CONDITIONAL, case by case. Article 11 of the Financial Market Infrastructure Act covers stock exchanges, central counterparties, central securities depositories, trade repositories and payment systems. They need the regulator's approval before outsourcing a material service such as risk management. Article 104 paragraph 4 covers reporting a derivative trade to a recognised FOREIGN trade repository. If the extra fields include personal data, you need the individual's consent. TELECOMS: CONDITIONAL. We found no storage-location rule. Providers must keep connection metadata for six months. They must also give the surveillance service immediate access to their facilities. That ties the kept data to systems the Swiss authorities can reach. GOVERNMENT AND PUBLIC SECTOR: CONDITIONAL through purchasing rules, not through law. The Swiss Government Cloud programme has a budget of 246.9 million francs and runs from 2025 to 2032. It has three tiers. One, 'Public Cloud Schweiz', is defined by data being held and handled in Switzerland. Another, 'Private Cloud Bund', keeps data in federal data centres. This is a purchasing policy, so it binds suppliers through contracts rather than through law. PROFESSIONS UNDER LEGAL SECRECY: CONDITIONAL, backed by criminal law. Article 321 of the Criminal Code covers a long list of jobs. Clergy, lawyers, defence counsel, notaries, patent attorneys and auditors. Doctors, dentists, chiropractors, pharmacists and midwives. Psychologists, nurses, physiotherapists, occupational therapists, dieticians, optometrists and osteopaths. It also covers their assistants. MAPPING AND GEOSPATIAL: we found no location rule, checked 18 August 2026, confidence medium. The Geoinformation Ordinance sorts official geodata into three access levels, publicly accessible, restricted, and not public. It says nothing about where the data may be stored. EDUCATION, GAMING, E-COMMERCE, DEFENCE: we found no industry storage-location rule in federal law, checked 18 August 2026, confidence medium. Cantonal law governs state schools and cantonal universities.

You can send data only to approved countries, and the list is filled in. Annex 1 of the Data Protection Ordinance lists 44 numbered entries. Entry 44 is the United States, and it is narrow. Only organisations certified under the Swiss-United States Data Privacy Framework count as safe. That rests on four things. Executive Order 14086. The Data Protection Review Court rule. Intelligence Community Directive 126. And the designation of Switzerland on 7 June 2024 as a country covered by the two-layer complaints mechanism. That entry was added by the ordinance of 14 August 2024, in force since 15 September 2024. It was still there in the consolidated text dated 1 December 2025. Canada is qualified. It counts as safe where the federal private-sector privacy law applies, or a substantially similar provincial law does. Where the destination is not on the list, Article 16 paragraph 2 gives five routes. A treaty under international law. Data protection clauses in a specific agreement, notified to the Commissioner beforehand. Specific guarantees drawn up by a federal body, notified beforehand. Standard data protection clauses the Commissioner has approved, issued or recognised. Or binding corporate rules approved by the Commissioner, or by an authority in a country on the list. A Commissioner document dated 12 February 2025 recognises two sets of clauses. The European Union's 2021 standard contractual clauses, and the Council of Europe's model contractual clauses. Using recognised standard clauses needs no notification. One-off clauses written for a single contract must be notified first. The Commissioner must respond within 90 days on standard clauses and on binding corporate rules. Article 17 adds six narrow one-off exceptions. They include explicit consent, necessity for a contract, overriding public interest, legal claims, protecting life, and data the person has made public. They are for isolated cases, not for routine bulk transfers. One difference is worth knowing. Switzerland's list is not a copy of the European Union's. Japan and South Korea are treated as safe by the European Union and do NOT appear in the Swiss annex. If you assume that safe for Europe means safe for Switzerland, you will be running an unlawful transfer, and one that is a crime. The Commissioner's guidance adds a step that catches people out. Contract clauses only bind the parties to the contract. So where the destination country's law allows disproportionate access by the authorities, you may need technical measures on top of the contract. The Commissioner also states plainly that a transfer failing Articles 16 and 17 may carry criminal consequences under Article 61 letter a.

We rate enforcement active. Commissioner: Adrian Lobsiger. Deputy Commissioner: Florence Henguely. Reported workload for 1 April 2025 to 31 March 2026. It ran 156 low-threshold interventions and 22 preliminary enquiries. It ran 9 investigations under Article 49 of the Data Protection Act. It had 2 matters pending before the Federal Administrative Court. Roughly half the office's effort goes on advice rather than supervision. Decisions you can see. A ruling of 29 January 2025 against Cembra Money Bank, on the deadlines for handling access requests. A ruling of 28 April 2025 against Inkasso-Team AG, on publishing debtors' names online. That one was later tested in Federal Administrative Court judgment A-3891/2025 of 22 June 2026. An instruction of 16 May 2025 to PostFinance on the use of voice biometrics. And a ruling of 17 April 2026 against Cream della Cream Switzerland and Philipp Plein International, published on 4 August 2026. In February and March 2026 the Commissioner ran a preliminary investigation into Meta Platforms Ireland over an artificial intelligence feature. On 3 March 2026 it opened a formal investigation into an artificial-intelligence age-verification provider. The Federal Administrative Court judgment of 6 October 2025 upheld the ruling against Buergerforum Schweiz. The Commissioner calls it the first legally binding validation of its new way of making decisions. Other regulators that matter more than the privacy one in their own areas: - FINMA, the financial market supervisor. It authorises outsourcing by market infrastructures, enforces the outsourcing circular and takes cyber-attack reports. - The Federal Office for Cyber Security. It receives the 24-hour critical-infrastructure incident reports and can issue enforceable orders. - The Post and Telecommunications Surveillance Service, part of the Federal Department of Justice and Police. It is plainly operational. In 2025 it handled 1,878 real-time interceptions, 6,531 retroactive surveillance measures and 650,034 simple information requests. Total measures were up about 40 per cent on 2024. - The Federal Office of Public Health, which supervises the electronic patient record system. - 26 cantonal data protection authorities, for cantonal and communal bodies. Why we do not rate it aggressive. The Commissioner has no power to impose administrative fines at all. Criminal fines under Articles 60 to 63 are capped at 250,000 francs. They apply only to individual people who act deliberately, and in most cases only where someone files a complaint. We found no evidence of a criminal privacy conviction in Switzerland during the review period.

MINIMUMS, verified: - Code of Duties Article 958f: keep business books, accounting vouchers, the annual report and the audit report for ten years. The clock runs from the end of the financial year. You may store them electronically if you can make them readable again at any time. - Financial Market Infrastructure Act Article 19: financial market infrastructures record and keep all records of services, procedures and activities for ten years. - Financial Market Infrastructure Act Article 75: a trade repository keeps reported data for at least ten years after the derivative contract matures. - Financial Market Infrastructure Act Article 106: counterparties keep derivative trade vouchers under the ten-year rule in the Code of Duties. - Electronic Patient Record Act Article 10 paragraph 3: access log data must be kept for ten years. - Telecommunications Surveillance Act Article 26 paragraph 5: telecommunications providers must keep connection metadata for six months. MAXIMUMS, verified: - Data Protection Act Article 6 paragraph 4: personal data must be destroyed or anonymised as soon as you no longer need it for your purpose. No number is given. The period is tied to the purpose, so it is whatever you can justify. - Article 6 paragraph 3 limits further use to purposes compatible with the one the person could recognise when the data was collected. HOW THE CLASH RESOLVES. A specific legal duty to keep records is still a legal duty. Article 31 of the Data Protection Act lets the law justify something that would otherwise break the principles. So Swiss companies usually keep the ten-year accounting set and delete the rest on a purpose-based schedule. The trap runs the other way. Take an internal 'keep everything for ten years' policy, applied to marketing data, browsing logs or job applicant files. It has no legal basis and breaks Article 6 paragraph 4. We found no legal maximum keeping period for any general category of personal data, checked 18 August 2026.

CLOCK 1: the privacy regulator. Data Protection Act Article 24. The company that decides how the data is used must tell the Commissioner about a data security breach. That applies where the breach is likely to lead to a HIGH risk to the person's personality or fundamental rights. The deadline is 'as quickly as possible'. Swiss law deliberately sets no hour count, which differs from the 72-hour rule people expect from the European Union. The notice must at least state the nature of the breach, its consequences, and the measures taken or planned. A supplier tells its customer, not the regulator. You tell the affected people only where they need to know to protect themselves, or where the Commissioner asks. Article 24 paragraph 6 gives real protection. A notice made under this article may be used against you in criminal proceedings only with your consent. Since 1 April 2025 the Commissioner may pass the notice to the national cyber security body, but only with your consent. CLOCK 2: national cyber security, 24 hours, firm. Information Security Act Article 74e paragraph 1. You must report within 24 hours of discovering the cyberattack. The duty applies to a long list of critical operators set out in Article 74b. It includes all banks, insurers and financial market infrastructures. It includes hospitals on a cantonal hospital list, licensed medical laboratories, and medicines manufacturers and importers. It includes energy companies, and water and waste utilities. It includes registered postal operators, railways, cable cars, buses and shipping under concession. It includes licensed civil aviation businesses and national airports. It includes national news agencies, the Swiss broadcaster and universities. And it includes federal, cantonal and communal authorities. Article 74d sets the trigger. The attack endangers the operation of the critical infrastructure. Or it has led to information being changed or leaked. Or it went undetected for a long period. Or it involves blackmail, threats or coercion. You report through a secure system run by the cyber security office. The duty has applied since 1 April 2025. CLOCK 3: financial regulator, 24 hours then 72 hours. FINMA Guidance 05/2020 covers the duty to report cyber attacks under Article 29 paragraph 2 of the Financial Market Supervision Act. Immediate reporting means this. The supervised firm informs FINMA through its responsible account manager within 24 hours. That runs from detecting the attack and making a first assessment of how critical it is. The actual report should follow within 72 hours through FINMA's web-based survey and application platform. A supervised firm is also responsible for reporting cyber incidents at its service providers, where they connect to the supervised business. CLOCK 4: health. Electronic Patient Record Ordinance Article 12 paragraph 3. Communities must report incidents their own data protection and security system classes as security-relevant to the Federal Office of Public Health. No deadline in hours is set. THE PENALTIES ARE THE SURPRISE. Missing the 24-hour cyber report carries no direct fine. Article 74g says the cyber security office first tells you and sets a reasonable new deadline. Only if you still fail does it issue a formal order. Article 74h then makes deliberately ignoring that order punishable by a fine of up to 100,000 francs, about 125,000 dollars. So what is punished is disobedience, not lateness.

TRAP 1: the fine lands on a person, not the company. Articles 60 to 63 of the Data Protection Act impose fines of up to 250,000 francs, about 310,000 dollars, on 'private persons' who act deliberately. Article 64 lets the authority fine the business instead. That only works where the fine is up to 50,000 francs, about 62,000 dollars. It also only works where identifying the individual would take disproportionate effort. So the default is prosecuting a human being. Most of the offences run only where someone files a complaint. Prosecution is a cantonal matter, and the time limit is five years. The Commissioner can file a complaint itself and take part as a private claimant. One practical result: directors and officers insurance, and who you formally put in charge internally, matter more here than the size of the cap. TRAP 2: a bad transfer is a crime, not a paperwork failure. Article 61 letter a covers deliberately disclosing personal data abroad in breach of Article 16 paragraphs 1 and 2 without meeting Article 17. The fine is up to 250,000 francs. The same article makes it a crime to use a supplier without meeting the Article 9 conditions, and to fail the minimum security requirements. The Commissioner states this on its own cross-border transfer page. TRAP 3: two criminal secrecy laws sit on top of privacy law. Article 47 of the Banking Act punishes deliberately revealing a secret entrusted to you as an officer, employee, agent or liquidator of a bank. It carries up to three years in prison or a money penalty. That rises to five years where the person, or someone else, gains financially. Careless disclosure carries a fine of up to 250,000 francs. It still applies after you leave the job. Article 321 of the Criminal Code does the same for a long list of jobs. Clergy, lawyers, defence counsel, notaries, patent attorneys and auditors bound to secrecy. Doctors, dentists, chiropractors, pharmacists and midwives. Psychologists, nurses, physiotherapists, occupational therapists, dieticians, optometrists and osteopaths. It also covers their assistants. The ceiling there is three years. Under Article 321 paragraph 2 there are only two clean ways out. The consent of the person the secret belongs to, or a written authorisation from the supervisory authority. Signing a data protection contract with a cloud provider gives you neither. This is the single biggest reason Swiss law firms, hospitals and private banks buy Swiss-hosted cloud services. TRAP 4: the federal law does not cover cantonal bodies. Article 2 paragraph 1 applies the Act to private persons and federal bodies. Cantonal and communal authorities, cantonal public hospitals, cantonal police and state schools sit under 26 separate cantonal data protection laws. Each has its own commissioner, its own deadlines and its own rules on cloud use. If you sell into the Swiss public sector, you will answer to a cantonal regulator you have never heard of, not to the federal Commissioner. TRAP 5: the 24-hour cyber clock has a soft penalty and a hard public edge. Article 74g of the Information Security Act sets out what happens if you miss the deadline. The cyber security office first tells you and sets a new one. Only deliberately disobeying the formal order that follows is punishable, under Article 74h, with a fine of up to 100,000 francs. Teams read this as 'no real deadline'. Then they discover that the office's order, once issued, is public-facing and enforceable. ONE MORE: no data protection officer is required. Swiss law offers an optional data protection adviser for private companies, not a required officer. Organisations with fewer than 250 employees need not keep a record of what they do with personal data. That relief is lost if you handle a large volume of sensitive data, or do high-risk profiling. Companies that copy their European Union compliance programme wholesale usually over-build here. They then under-build on the criminal secrecy side, which is where the real Swiss risk sits.

LANDING IN THE NEXT TWELVE MONTHS, with dates: - 1 October 2026: the Banking Act is amended. The amending law is the Federal Act of 26 September 2025 on the transparency of legal entities and the identification of beneficial owners. It creates new identification and record duties for financial institutions. It is in the official consolidated text with that start date. - Fourth quarter of 2026, planned: the financial regulator intends to revise its circular on video and online identification, so the new electronic identity credential can be used to identify customers. The regulator says in writing that this depends on the Federal Act on Electronic Identity Credentials and Other Electronic Credentials coming into force. As at 18 August 2026 that Act does not appear in the consolidated federal law collection, so it is not yet in force. - First quarter of 2027, planned: revision of the regulator's anti-money laundering ordinance, following the partial revision of the Anti-Money Laundering Act. - Second quarter of 2027, planned: revision of Article 42c of the Financial Market Supervision Act, and of the circular on direct transmission. That governs when a supervised firm may send information straight to a FOREIGN authority. This is the one to watch for cross-border data flows. - Ongoing, no date: a full revision of the electronic patient record law, which the Commissioner has been commenting on. If it changes the requirement that data stores sit in Switzerland, it changes the strictest storage rule in Swiss law. - Ongoing, no date: revision of the Ordinance on the Surveillance of Post and Telecommunications. The surveillance service's 2025 annual report lists it as a focus area. We checked the consolidated federal law collection on 18 August 2026. The ordinance has not been amended since 26 March 2024, so nothing has started. POWERS ALREADY HELD THAT COULD CHANGE THE ANSWER WITHOUT WARNING: 1. The approved-destinations list. Annex 1 to the Data Protection Ordinance is amended by the Federal Council alone, by ordinance. Article 8 paragraph 6 of the Ordinance says that if a review shows protection is no longer good enough, Annex 1 SHALL be amended. Removing the United States entry would instantly force every Swiss company using American cloud services back onto contract clauses. That entry rests on a United States executive order and a complaints mechanism outside Swiss control. No parliamentary vote is needed. 2. Extending telecoms surveillance to messaging apps. Article 27 paragraph 3 of the Telecommunications Surveillance Act gives the Federal Council a power. It can apply all or some of the telecoms operators' duties to providers of DERIVED communications services. That category covers messaging and email services. It includes the six-month metadata keeping duty. It applies where the provider is of major economic importance or serves a large number of users. This is done by ordinance. 3. Other transfer safeguards. Article 16 paragraph 3 of the Data Protection Act lets the Federal Council create extra appropriate guarantees by ordinance. 4. Recognition of standard clauses. The Commissioner recognised the European Union's standard contractual clauses in a document, not a statute, and can revisit that recognition. 5. Cyber reporting scope. The list of critical operators that must report within 24 hours sits in Article 74b of the Information Security Act. The Federal Council holds delegated powers to change who is on it.