The total revision of Swiss data protection legislation, which entered into force on 1 September 2023, has thoroughly modernised the processing of personal information.
This major reform is intended to adapt Swiss law to technological and digital developments, while aligning it with European standards in order to guarantee the free movement of data and to strengthen the informational sovereignty of individuals.
Refocusing the scope and the new governance requirements
The new legal framework changes the foundations of data protection law and imposes new organisational duties on businesses:
- Protection focused on natural persons alone: The revised legislation has expressly excluded legal entities from its scope, so as to protect only the data of living natural persons, aligning Switzerland with international standards and facilitating cross-border data flows. Company data remains governed by civil law or by the law on unfair competition.
- Stronger governance and technical accountability: Entities that process data must now build protection into the technical design of software and apply it by default, appoint a data protection officer where appropriate, carry out a prior impact assessment where there are high risks (in particular in the large-scale processing of sensitive data) and notify security incidents promptly.
Stronger individual rights and the powers of the supervisory authority
The reform gives individuals more clearly stated rights and modernises state supervision:
- Broader rights for data subjects: Transparency is increased by a wider duty to provide information at the time of collection, a strengthened right of access that makes it possible to know all the data held and their purpose, and a right to rectification, erasure or the digital portability of the data.
- A stronger role for the Federal Commissioner and sanctions: The Federal Data Protection and Information Commissioner may now open administrative investigations of his own motion, order binding corrective measures and require unlawful processing to be suspended or stopped. Federal law also provides for direct criminal penalties against the natural persons responsible where they intentionally breach their statutory duties.
This Swiss framework is the counterpart of the discussion conducted, for law firms, in the use of legal AI and the GDPR.
Legal sources
Federal legislation:
- Art. 4 FADPandArt. 58 FADP (supervision, powers and duties of the Federal Data Protection and Information Commissioner)
- Art. 7 FADP (data protection by design and data protection by default)
- Art. 10 FADPandArt. 23 FADP (status, powers and appointment of the data protection officer)
- Art. 22 FADP (obligation to carry out a data protection impact assessment in cases of high risk)
Federal case law:
- Federal Administrative Court judgment A-5608/2023 (entry into force of the total revision of the FADP on 1 September 2023, express exclusion of legal entities from the scope, and alignment with European law)
- Federal Administrative Court judgment A-8391/2025 (investigative powers and margin of appreciation of the Federal Data Protection and Information Commissioner under the revised FADP)