Switzerland

Article 3 paragraph 1 of the Data Protection Act codifies the effects doctrine: the Act applies to circumstances that have an effect in Switzerland even if initiated abroad. Article 14 sets the four cumulative conditions for appointing a Swiss representative (offer of goods or services or behaviour monitoring, large scale, regular, and high risk to the personality of data subjects). The representative is a contact point for data subjects and for the Federal Data Protection and Information Commissioner, and the name and address must be published. Note the scope split in Article 2 paragraph 1: the federal Act covers private persons and FEDERAL bodies only. Cantonal and communal authorities, cantonal public hospitals and cantonal schools are governed by 26 separate cantonal data protection laws with their own cantonal commissioners. There is also a size-based relief in Article 24 of the Data Protection Ordinance: private organisations with fewer than 250 employees on 1 January of a given year are exempt from keeping a record of processing activities, unless they process a large volume of sensitive personal data or carry out high-risk profiling.

Headline rating: sectoral. The national baseline on its own would be 'conditional'. Sector by sector, as verified on 18 August 2026: HEALTH - electronic patient record: CLOSED. Article 12 paragraph 5 of the Electronic Patient Record Ordinance states that the data stores must be located in Switzerland and subject to Swiss law. The same applies under Article 25 paragraph 6 to issuers of the identification means used to log in. This is the only flat storage-location ban we found in Swiss federal law. HEALTH - everything else: CONDITIONAL, but with criminal exposure. Ordinary medical records outside the electronic patient record system are not location-restricted, but doctors, nurses, pharmacists and psychologists are bound by the criminal professional secrecy rule in Article 321 of the Criminal Code. BANKING: CONDITIONAL with a criminal wall. There is no rule saying bank data must stay in Switzerland. Article 47 of the Banking Act makes deliberately revealing a banking secret a criminal offence punishable by up to three years in prison, rising to five where the person makes money out of it, and up to 250,000 francs for doing it carelessly. Separately, the regulator's outsourcing circular allows offshoring only if the bank can guarantee that it, its auditor and the regulator can enforce inspection and audit rights, and only if the information needed to restructure or wind up the bank remains accessible in Switzerland at all times. That last sentence is a partial mirroring requirement. INSURANCE: same as banking on outsourcing. The regulator's outsourcing circular covers insurance companies as well as banks and certain investment firms. Insurers have no equivalent criminal secrecy article. SECURITIES AND MARKET INFRASTRUCTURE: CONDITIONAL, case by case. Under Article 11 of the Financial Market Infrastructure Act a stock exchange, central counterparty, central securities depository, trade repository or payment system must obtain the regulator's prior approval before outsourcing a material service such as risk management. Under Article 104 paragraph 4, where a derivative trade is reported to a recognised FOREIGN trade repository and the extra fields include personal data, the individual's consent must be obtained. TELECOMS: CONDITIONAL. No storage-location rule was found. Providers must retain connection metadata for six months and must grant the surveillance service immediate access to their facilities, which in practice pins the retained data to systems the Swiss authorities can reach. GOVERNMENT AND PUBLIC SECTOR: CONDITIONAL by procurement, not by statute. The Swiss Government Cloud programme, budgeted at 246.9 million francs and running from 2025 to 2032, is built in three tiers, of which one, 'Public Cloud Schweiz', is defined by data being held and processed in Switzerland, and another, 'Private Cloud Bund', keeps data in federal data centres. This is a purchasing policy, so it binds suppliers through contracts rather than through law. PROFESSIONS UNDER LEGAL SECRECY: CONDITIONAL with a criminal wall. Article 321 of the Criminal Code covers clergy, lawyers, defence counsel, notaries, patent attorneys, auditors, doctors, dentists, chiropractors, pharmacists, midwives, psychologists, nurses, physiotherapists, occupational therapists, dieticians, optometrists and osteopaths, and their auxiliaries. MAPPING AND GEOSPATIAL: no location rule found, checked 18 August 2026, confidence medium. The Geoinformation Ordinance sorts official geodata into three access tiers, publicly accessible, restricted, and not public, but says nothing about where the data may be stored. EDUCATION, GAMING, E-COMMERCE, DEFENCE: no sector-specific storage-location rule found in federal law, checked 18 August 2026, confidence medium. Cantonal law governs state schools and cantonal universities.

Model: allowlist, currently populated. Annex 1 of the Data Protection Ordinance lists 44 numbered entries. Entry 44 is the United States, and it is narrow: adequacy is recognised only for organisations certified under the Swiss-United States Data Privacy Framework, resting on Executive Order 14086, the Data Protection Review Court rule, Intelligence Community Directive 126, and the designation of Switzerland on 7 June 2024 as a country covered by the two-layer redress mechanism. That entry was inserted by the ordinance of 14 August 2024, in force since 15 September 2024, and was still in place in the consolidation dated 1 December 2025. Canada is qualified: adequacy applies where the federal private-sector privacy law, or a substantially similar provincial law, applies. Where the destination is not listed, Article 16 paragraph 2 gives five routes: a treaty under international law; data protection clauses in a specific agreement, notified to the Commissioner beforehand; specific guarantees drawn up by a federal body, notified beforehand; standard data protection clauses the Commissioner has approved, issued or recognised; or binding corporate rules approved by the Commissioner or by an authority in an adequate country. In a document dated 12 February 2025 the Commissioner recognised both the European Union's 2021 standard contractual clauses and the Council of Europe's model contractual clauses. Using recognised standard clauses does not have to be notified. Ad-hoc clauses in a single contract do have to be notified first. The Commissioner must respond within 90 days on standard clauses and on binding corporate rules. Article 17 adds six narrow one-off exceptions, including explicit consent, contract necessity, overriding public interest, legal claims, protecting life, and data the person has made public. These are for isolated cases, not for routine bulk flows. A divergence worth knowing: Switzerland's list is not a copy of the European Union's. Japan and South Korea have European Union adequacy decisions and do NOT appear in the Swiss annex. A company that assumes 'adequate for Europe means adequate for Switzerland' will be running an unlawful, and criminally punishable, transfer. The Commissioner's guidance adds a step that catches people out: contractual clauses only bind the parties to the contract, so where the destination country's law permits disproportionate authority access, technical measures on top of the contract may be required. And the Commissioner states plainly that a transfer failing Articles 16 and 17 may carry criminal consequences under Article 61 letter a.

Rating: active. Commissioner: Adrian Lobsiger. Deputy Commissioner: Florence Henguely. Reported workload for 1 April 2025 to 31 March 2026: 156 low-threshold interventions, 22 preliminary enquiries, 9 investigations under Article 49 of the Data Protection Act, 2 matters pending before the Federal Administrative Court. Roughly half the office's effort goes on advisory work rather than supervision. Observable decisions: a ruling of 29 January 2025 against Cembra Money Bank on the legal deadlines for handling access requests; a ruling of 28 April 2025 against Inkasso-Team AG on publishing debtors' names online, later tested in Federal Administrative Court judgment A-3891/2025 of 22 June 2026; an instruction of 16 May 2025 to PostFinance on the use of voice biometrics; a ruling of 17 April 2026 against Cream della Cream Switzerland and Philipp Plein International, published on 4 August 2026. In February and March 2026 the Commissioner ran a preliminary investigation into Meta Platforms Ireland over an artificial intelligence feature, and on 3 March 2026 opened a formal investigation into an artificial-intelligence age-verification provider. The Federal Administrative Court judgment of 6 October 2025 upholding the ruling against Buergerforum Schweiz is described by the Commissioner as the first legally binding validation of its new decision-making practice. Other regulators that matter more than the privacy one in their own lanes: - FINMA, the financial market supervisor, which authorises outsourcing by market infrastructures, enforces the outsourcing circular and takes cyber-attack reports. - The Federal Office for Cyber Security, which receives the 24-hour critical-infrastructure incident reports and can issue enforceable orders. - The Post and Telecommunications Surveillance Service, part of the Federal Department of Justice and Police, which is plainly operational: in 2025 it handled 1,878 real-time interceptions, 6,531 retroactive surveillance measures and 650,034 simple information requests, with total measures up about 40 per cent on 2024. - The Federal Office of Public Health, which supervises the electronic patient record system. - 26 cantonal data protection authorities for cantonal and communal bodies. Why not 'aggressive': the Commissioner has no power to impose administrative fines at all. Criminal fines under Articles 60 to 63 are capped at 250,000 francs, apply only to natural persons who act wilfully, and in most cases only on complaint. We found no evidence of a criminal privacy conviction in Switzerland during the review period.

FLOOR, verified: - Code of Obligations Article 958f: business books, accounting vouchers, the annual report and the audit report must be kept for ten years, counted from the end of the financial year. Electronic storage is allowed provided the records can be made readable again at any time. - Financial Market Infrastructure Act Article 19: financial market infrastructures record and keep all records of services, procedures and activities for ten years. - Financial Market Infrastructure Act Article 75: a trade repository keeps reported data for at least ten years after the derivative contract matures. - Financial Market Infrastructure Act Article 106: counterparties keep derivative trade vouchers under the ten-year rule in the Code of Obligations. - Electronic Patient Record Act Article 10 paragraph 3: access log data must be kept for ten years. - Telecommunications Surveillance Act Article 26 paragraph 5: providers of telecommunications services must keep connection metadata for six months. CEILING, verified: - Data Protection Act Article 6 paragraph 4: personal data shall be destroyed or anonymised as soon as it is no longer required for the purpose of processing. No number is given. The duty is tied to purpose, so the retention period is whatever you can justify. - Article 6 paragraph 3 limits further use to purposes compatible with the one the person could recognise at collection. HOW THE CONFLICT RESOLVES: a specific statutory duty to retain is a legal obligation, and under Article 31 of the Data Protection Act a processing that would otherwise breach the principles can be justified by law. In practice Swiss controllers keep the ten-year accounting set and delete the rest on a purpose-based schedule. The trap is the reverse direction: an internal 'keep everything for ten years' policy applied to marketing data, browsing logs or job applicant files has no legal basis and breaches Article 6 paragraph 4. No statutory maximum retention period was found for any general category of personal data, checked 18 August 2026.

CLOCK 1 - privacy regulator. Data Protection Act Article 24: the controller notifies the Commissioner of any data security breach likely to lead to a HIGH risk to the data subject's personality or fundamental rights, 'as quickly as possible'. There is deliberately no fixed hour count in Swiss law, which differs from the 72-hour rule people arriving from the European Union expect. The notification must at minimum state the nature of the breach, its consequences and the measures taken or planned. Processors notify their controller, not the regulator. Data subjects are informed only where needed for their protection or where the Commissioner asks. Article 24 paragraph 6 gives a genuine protection: a notification made under this article may be used against the notifier in criminal proceedings only with that person's consent. Since 1 April 2025 the Commissioner may, with the controller's consent, forward the notification to the national cyber security body. CLOCK 2 - national cyber security, 24 hours, hard. Information Security Act Article 74e paragraph 1: the report must be made within 24 hours of discovering the cyberattack. The duty applies to a long list of critical operators set out in Article 74b, including all banks, insurers and financial market infrastructures, hospitals on a cantonal hospital list, licensed medical laboratories, medicines manufacturers and importers, energy companies, water and waste utilities, registered postal operators, railways, cable cars, buses and shipping under concession, licensed civil aviation businesses and national airports, national news agencies, the Swiss broadcaster, universities, and federal, cantonal and communal authorities. Article 74d sets the trigger: the attack endangers the operation of the critical infrastructure, or has led to information being manipulated or leaked, or went undetected for a long period, or involves blackmail, threats or coercion. Reporting is via a secure system run by the cyber security office. Reportable in force since 1 April 2025. CLOCK 3 - financial regulator, 24 hours then 72 hours. FINMA Guidance 05/2020 on the duty to report cyber attacks under Article 29 paragraph 2 of the Financial Market Supervision Act: 'Immediate reporting to FINMA means that the affected supervised institution informs FINMA through the responsible (Key) Account Manager within 24 hours of detecting such a cyber attack and conducting an initial assessment of its criticality. The actual report should be submitted within 72 hours via the FINMA web-based survey and application platform.' A supervised firm is also responsible for reporting cyber incidents at its service providers where there is a link to the supervised business. CLOCK 4 - health. Electronic Patient Record Ordinance Article 12 paragraph 3: communities must report incidents classified as security-relevant in their data protection and data security management system to the Federal Office of Public Health. No deadline in hours is specified. PENALTY SHAPE, and this is the surprise: missing the 24-hour cyber report carries no direct fine. Article 74g says the cyber security office first tells you and sets a reasonable deadline; only if you still fail does it issue a formal order. Article 74h then makes wilfully ignoring that final order punishable by a fine of up to 100,000 francs, about 125,000 dollars. So the enforceable act is disobedience, not lateness.

TRAP 1 - the fine lands on a person, not the company. Articles 60 to 63 of the Data Protection Act impose fines of up to 250,000 francs, about 310,000 dollars, on 'private persons' who act wilfully. Article 64 lets the authority fine the business instead only where a fine of up to 50,000 francs, about 62,000 dollars, is in play AND identifying the individual would take disproportionate effort. So the default is prosecution of a human being. Most of the offences run 'on complaint', meaning somebody has to file. Prosecution is a cantonal matter, and the limitation period is five years. The Commissioner itself may file a complaint and take part as a private claimant. A practical consequence: directors and officers insurance and internal delegation of responsibility matter more here than the size of the cap. TRAP 2 - a bad transfer is a crime, not a paperwork failure. Article 61 letter a: wilfully disclosing personal data abroad in breach of Article 16 paragraphs 1 and 2 without meeting Article 17 attracts a fine of up to 250,000 francs. The same article criminalises using a processor without meeting the Article 9 conditions, and failing to meet the minimum security requirements. The Commissioner states this explicitly on its own cross-border transfer page. TRAP 3 - two criminal secrecy regimes sit on top of privacy law. Article 47 of the Banking Act: wilfully revealing a secret entrusted to you as an officer, employee, agent or liquidator of a bank is punishable by up to three years' imprisonment or a monetary penalty, rising to five years where the person or a third party obtains a financial advantage, with a fine of up to 250,000 francs for doing it negligently, and it stays punishable after you leave the job. Article 321 of the Criminal Code does the same for clergy, lawyers, defence counsel, notaries, patent attorneys, auditors bound to secrecy, doctors, dentists, chiropractors, pharmacists, midwives, psychologists, nurses, physiotherapists, occupational therapists, dieticians, optometrists and osteopaths, AND their auxiliaries, with a three-year ceiling. Under Article 321 paragraph 2 the only clean escapes are the consent of the person entitled to the secret, or a written authorisation from the supervisory authority. Signing a data processing agreement with a cloud provider does not by itself create either. This is the single biggest reason Swiss law firms, hospitals and private banks buy Swiss-hosted cloud services. TRAP 4 - the federal law does not cover cantonal bodies. Article 2 paragraph 1 applies the Act to private persons and federal bodies. Cantonal and communal authorities, cantonal public hospitals, cantonal police and state schools sit under 26 separate cantonal data protection statutes with their own commissioners, their own deadlines and their own rules on cloud use. A company selling into the Swiss public sector will be answering to a cantonal regulator it has never heard of, not to the federal Commissioner. TRAP 5 - the 24-hour cyber clock has a soft penalty and a hard reputational edge. Under Article 74g of the Information Security Act, if the cyber security office suspects you missed the deadline it first notifies you and sets a new one. Only wilful disobedience of the resulting formal order is punishable, under Article 74h, with a fine of up to 100,000 francs. Teams read this as 'no real deadline' and then discover that the office's order, once issued, is public-facing and enforceable. BONUS - no data protection officer is required. Swiss law offers an optional data protection adviser for private controllers, not a mandatory officer, and organisations with fewer than 250 employees are excused from keeping a record of processing activities unless they handle a large volume of sensitive data or do high-risk profiling. Companies that copy their European Union compliance programme wholesale routinely over-build here, while under-building on the criminal secrecy side, which is where the actual Swiss risk lives.

LANDING IN THE NEXT TWELVE MONTHS, with dates: - 1 October 2026: the Federal Act of 26 September 2025 on the transparency of legal entities and the identification of beneficial owners amends the Banking Act. This creates new identification and record duties for financial institutions. It is in the official consolidated text with that commencement date. - Q4 2026 planned: the financial regulator intends to revise its circular on video and online identification so that the new electronic identity credential can be used to identify customers. The regulator states in writing that the revision depends on the entry into force of the Federal Act on Electronic Identity Credentials and Other Electronic Credentials. As at 18 August 2026 that Act does not appear in the consolidated federal law collection, so it is not yet in force. - Q1 2027 planned: revision of the regulator's anti-money laundering ordinance following the partial revision of the Anti-Money Laundering Act. - Q2 2027 planned: revision of Article 42c of the Financial Market Supervision Act and of the circular on direct transmission, which governs when a supervised firm may send information directly to a FOREIGN authority. This is the one to watch for cross-border data flow purposes. - Ongoing, no date: a comprehensive revision of the electronic patient record law, which the Commissioner has been commenting on. If it changes the requirement that data stores sit in Switzerland, it changes the single hardest localisation rule in Swiss law. - Ongoing, no date: revision of the Ordinance on the Surveillance of Post and Telecommunications. The surveillance service's 2025 annual report lists it as a focus area. We checked the consolidated federal law collection on 18 August 2026: the ordinance has not been amended since 26 March 2024, so nothing has commenced. DORMANT SWITCHES - powers already held that could change the picture without warning: 1. The approved-destinations list. Annex 1 to the Data Protection Ordinance is amended by the Federal Council alone, by ordinance. Article 8 paragraph 6 of the Ordinance says that if a reassessment shows adequate protection is no longer guaranteed, Annex 1 SHALL be amended. Removing the United States entry, which rests on a United States executive order and a redress mechanism outside Swiss control, would instantly require every Swiss company using American cloud services to fall back to contractual clauses. No parliamentary vote is needed. 2. Extending telecoms surveillance to messaging apps. Article 27 paragraph 3 of the Telecommunications Surveillance Act empowers the Federal Council to make providers of DERIVED communications services - the category that covers messaging and email services - subject to all or some of the full obligations that apply to telecoms operators, including the six-month metadata retention duty, where they are of major economic importance or serve a large number of users. This is done by ordinance. 3. Other transfer safeguards. Article 16 paragraph 3 of the Data Protection Act lets the Federal Council create additional appropriate guarantees by ordinance. 4. Recognition of standard clauses. The Commissioner recognised the European Union's standard contractual clauses in a document, not a statute, and can revisit that recognition. 5. Cyber reporting scope. The list of critical operators subject to the 24-hour report sits in Article 74b of the Information Security Act, and the Federal Council holds delegated powers to adjust the perimeter.