Data Protection Act (FADP)
English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.
Section 1 Definitions and Principles
Art. 5 Definitions
In this Act: a. personal data means any information relating to an identified or identifiable natural person; b. data subject means a natural person whose personal data is processed; c. sensitive personal data means: 1. data relating to religious, philosophical, political or trade union-related views or activities, 2. data relating to health, the private sphere or affiliation to a race or ethnicity, 3. genetic data, 4. biometric data that uniquely identifies a natural person, 5. data relating to administrative and criminal proceedings or sanctions, 6. data relating to social assistance measures; d. processing means any handling of personal data, irrespective of the means and procedures used, in particular the collection, storage, keeping, use, modification, disclosure, archiving, deletion or destruction of data; e. disclosure means transmitting personal data or making such data accessible; f. profiling means any form of automated processing of personal data consisting of the use of per
Art. 6 Principles
1 Personal data must be processed lawfully. 2 The processing must be carried out in good faith and be proportionate. 3 Personal data may only be collected for a specific purpose that the data subject can recognise; personal data may only be further processed in a manner that is compatible with this purpose. 4 They shall be destroyed or anonymised as soon as they are no longer required for the purpose of processing. 5 Any person who processes personal data must satisfy themselves that the data are accurate. They must take all appropriate measures to correct, delete or destroy data that are incorrect or incomplete insofar as the purpose for which they are collected or processed is concerned. The appropriateness of the measures depends in particular on the form and the extent of the processing and on the risk that the processing poses to the data subject's personality or fundamental rights. 6 If the consent of the data subject is required, such consent is only valid if given voluntarily f
Art. 7 Data protection by design and data protection by default
1 The controller is obliged to arrange the data processing in technical and organisational terms so that the data protection regulations, and in particular the principles under Article 6, are respected. It shall take account of this from the planning stage. 2 The technical and organisational measures must in particular be appropriate with regard to the state of the art, the nature and the extent of the data processing and the risk that the processing poses to the data subject's personality or fundamental rights. 3 The controller is obliged to ensure by means of suitable default settings that the processing of personal data is limited to the minimum required for the purpose intended, unless the data subject specifies otherwise.
Art. 8 Data security
1 The controller and the processor shall guarantee a level of data security appropriate to the risk by taking suitable technical and organisational measures. 2 The measures must make it possible to avoid breaches of data security. 3 The Federal Council shall issue provisions on the minimum requirements for data security.
Art. 9 Processing by processors
1 The processing of personal data may be assigned by contract or by the legislation to a processor if: a. the data is processed only in the manner in which the controller itself is permitted to do it; and b. no statutory or contractual duty of confidentiality prohibits assignment. 2 The controller must satisfy itself in particular that the processor is able to guarantee data security. 3 The processor may only assign processing to a third party with prior approval from the controller. 4 It may claim the same grounds for justification as the controller.
Art. 10 Data protection officer
1 Private controllers may appoint a data protection officer. 2 The data protection officer is the contact point for the data subjects and for the authorities responsible for data protection in Switzerland. He or she has the following tasks in particular: a. training and advising the private controller in matters of data protection; b. providing support on applying the data protection regulations. 3 Private controllers may invoke the exception in Article 23 paragraph 4 if the following requirements are satisfied: a. The data protection officer exercises his or her function towards the controller in a professionally independent manner and is not bound by any instructions. b. He or she does not carry out any activities that are incompatible with his or her tasks as a data protection officer. c. He or she has the required expertise. d. The controller publishes the contact details of the data protection officer and notifies the FDPIC thereof. 4 The Federal Council shall regulate the appoint
Art. 11 Code of conduct
1 Professional, industry and trade associations that are authorised to safeguard the economic interests of their members in their articles of association and federal bodies may submit codes of conduct to the FDPIC. 2 The FDPIC shall state and publish his or her opinions on the codes of conduct.
Art. 12 Record of processing activities
1 The controller and the processor shall each maintain a record of their processing activities. 2 The controller's record shall as a minimum contain: a. the identity of the controller; b. the purpose of processing; c. a description of the categories of data subjects and the categories of processed personal data; d. the categories of recipients; e. if possible, the retention period for the personal data or the criteria for determining this period; f. if possible, a general description of the measures taken to guarantee data security under Article 8; g. if the data are disclosed abroad, details of the State concerned and the guarantees under Article 16 paragraph 2. 3 The processor's record shall contain information on identity of the processor and of the controller, the categories of processing carried out on behalf of the controller, and the information mentioned in paragraph 2 letters f and g. 4 The federal bodies shall notify the FDPIC of their records of processing activities. 5 The
Art. 13 Certification
1 The manufacturers of data processing systems or programs and controllers and processors may have their systems, products and services evaluated by recognised independent certification bodies. 2 The Federal Council shall issue regulations on the recognition of certification procedures and the introduction of a data protection quality mark. In doing so, it shall take account of international law and the internationally recognised technical standards.
Section 2 Data Processing by Private Controllers w
Art. 14 Representative
1 Private controllers with registered office or domicile abroad shall appoint a representative in Switzerland if they process the personal data of persons in Switzerland and the data processing meets the following requirements: a. The processing is connected with the offer of goods or services or the monitoring of the behaviour of persons in Switzerland. b. The processing is on a large scale. c. The processing is carried out regularly. d. The processing poses a high risk to the personality of the data subjects. 2 The representative shall serve as the contact point for the data subjects and the FDPIC. 3 The controller shall publish the name and the address of the representative.
Art. 15 Duties of the representative
1 The representative shall maintain a record of controller's processing activities that contains the information set out in Article 12 paragraph 2. 2 On request, he or she shall provide the FDPIC with the information contained in the record. 3 On request, the representative shall provide data subjects with information on how they can exercise their rights.
Section 3 Cross-Border Disclosure of Personal Data
Art. 16 Principles
1 Personal data may be disclosed abroad if the Federal Council has decided that the legislation of the State concerned or the international body guarantees an adequate level of protection. 2 In the absence of a decision by the Federal Council under paragraph 1, personal data may be disclosed abroad only if an appropriate level of data protection is guaranteed by: a. a treaty under international law; b. data protection clauses in an agreement between the controller or the processor and its contractual partner, notice of which has been given to the FDPIC beforehand; c. specific guarantees drawn up by the competent federal body, notice of which has been given to the FDPIC beforehand; d. standard data protection clauses that the FDPIC has approved, issued or recognised beforehand; or e. binding corporate rules that have been approved in advance by the FDPIC or by the authority responsible for data protection in a State that guarantees an adequate level of protection. 3 The Federal Council
Art. 17 Exceptions
1 In derogation from Article 16 paragraphs 1 and 2, personal data may be disclosed abroad in the following cases: a. The data subject has explicitly consented to disclosure. b. Disclosure is directly connected with the conclusion or performance of a contract: 1. between the controller and the data subject; or 2. between the controller and its contractual partner in the interests the data subject. c. Disclosure is necessary in order to: 1. safeguard an overriding public interest; or 2. establish, exercise or enforce legal rights before a court or another competent foreign authority. d. Disclosure is necessary to protect the life or the physical integrity of the data subject or a third party, and it is not possible to obtain the consent of the data subject within a reasonable time. e. The data subject has made the data generally accessible and has not explicitly prohibited processing. f. The data originate from a statutory register that is public or accessible to persons with a legitimat
Art. 18 Publication of personal data in electronic form
If personal data are made generally accessible by means of automated information and communications services in order to provide information to the general public, this is not deemed to be disclosure abroad, even if the data are accessible from abroad.