Hardly any Swiss company processes personal data exclusively within Switzerland. Cloud services, email delivery, analytics, support tools and AI providers have servers, staff or sub-processors abroad. Each of these constellations can be a disclosure abroad. This article describes the rules under the Swiss Federal Act on Data Protection and the GDPR and how to document them pragmatically.
The Swiss framework
Under Article 16 of the revised FADP, personal data may be disclosed abroad if the Federal Council has determined that the state concerned ensures adequate protection. The list is in Annex 1 of the Data Protection Ordinance; it includes the EU and EEA states and other states such as the United Kingdom. Without such a determination, appropriate safeguards are needed, typically standard contractual clauses, or one of the exceptions under Article 17 FADP, such as explicit consent or the performance of a contract with the data subject.
Switzerland from the EU’s perspective
The EU has long regarded Switzerland as a state with an adequate level of data protection. The Commission confirmed this in its review in January 2024. Data from the EU may therefore be transferred to Swiss companies without additional safeguards. For Swiss providers with EU customers that is a genuine location advantage, as long as they do not pass the data on to third countries without securing it.
The United States
Since 15 September 2024, personal data from Switzerland may be disclosed without additional safeguards to US companies certified under the Swiss-US Data Privacy Framework. For the EU, the EU-US framework has applied since July 2023. What matters is the certification of the specific recipient, for data from Switzerland explicitly for the Swiss-US part too. For non-certified US providers, standard contractual clauses and an assessment of whether they are effective in the specific case are needed.
Using standard contractual clauses properly
The FDPIC has recognised the European Commission’s 2021 standard contractual clauses, with adaptations for Swiss law: the FADP must be taken into account as applicable law, and the FDPIC must be named as supervisory authority. Anyone using the clauses should also check whether the law of the recipient state prevents compliance with them, for example through far-reaching government access, and provide additional measures such as encryption where needed. That check must be documented.
Do not forget sub-processors
A Swiss or European contractual partner may itself use sub-processors in third countries, for example for support, hosting components or AI features. That too is a disclosure abroad, for which the controller must know the basis. The sub-processor list therefore belongs in every vendor review, and changes should be announced contractually.
What the privacy notice must contain
Where personal data is disclosed abroad, the privacy notice must name the states and, where no adequacy decision exists, the safeguards or the exception relied on (Art. 19(4) FADP). Phrases such as “worldwide” are not enough. A well-kept record of processing activities supplies this information directly.
A pragmatic process
1. Record all service providers and tools with access to personal data, including their sub-processors.
2. For each provider, record the states in which data is stored or accessed.
3. For each state, determine the basis: adequacy, Data Privacy Framework with proof of certification, standard contractual clauses with assessment, or an exception.
4. File contracts and evidence, and update the privacy notice.
5. Repeat the process when changing providers or adding tools.
Data residency as relief
The more data sits in Switzerland or the EU with providers without third-country links, the shorter this list becomes. For sensitive data and customers with high requirements that is often the simplest route. The trade-off is covered in our decision guide Swiss hosting or EU hosting; a practical example is our Supabase data residency playbook. The differences between the FADP and the GDPR overall are described in GDPR vs revised FADP.