As soon as a provider abroad stores or accesses data, there is a disclosure abroad. This applies to cloud services as well as support from another country or a group company abroad.
Adequate protection
The Federal Council determines which states guarantee adequate data protection; the list is in the annex to the Data Protection Ordinance. It includes the EEA states and other countries. For the US, adequacy applies only to companies certified under the Swiss-U.S. Data Privacy Framework.
Appropriate safeguards
Without an adequacy decision, disclosure is permitted with appropriate safeguards, in particular standard data protection clauses approved, issued or recognised by the FDPIC, binding corporate rules approved by the FDPIC, or specific safeguards notified to the FDPIC in advance. Whether the recipient can actually comply in the destination country is examined in a transfer impact assessment.
Exceptions
Art. 17 FADP allows disclosure without adequate protection or safeguards in certain cases, for example with the data subject’s explicit consent, where disclosure is directly connected with concluding or performing a contract with them, to enforce legal claims before a court, or for data the person has made generally accessible. Exceptions suit individual cases, not regular transfers.
Duty to inform
Anyone disclosing personal data abroad names the countries and, where applicable, the safeguards or exception used in the privacy notice. The current situation for transfers to the US is described in our article on transferring data to the US.