Almost every Swiss company transfers personal data to the US: through email and collaboration services, CRM, analytics tools, support platforms or AI services. The FADP allows this, but only under conditions. Since June 2026 it has also become less certain how long the most important of these conditions will hold. This article sets out what applies and how to protect yourself. It does not replace legal assessment of individual cases.
The basic rule
Under Art. 16 FADP personal data may be disclosed abroad if the Federal Council has determined that the state’s legislation guarantees adequate protection. These states are listed in the annex to the Data Protection Ordinance. Without such a decision, appropriate safeguards are needed, such as standard contractual clauses recognised by the FDPIC, or one of the statutory exceptions.
The US and the Swiss-U.S. Data Privacy Framework
The US is not generally considered to provide adequate protection. Since 15 September 2024, however, the Swiss-U.S. Data Privacy Framework has applied: for US companies certified under the Swiss provisions of the framework, the Federal Council has determined adequacy. Whether a provider is certified is shown on the public Data Privacy Framework List; what matters is that the certification expressly covers the Swiss-U.S. part and the data concerned.
What changed in 2026
The Swiss framework closely follows the EU-U.S. Data Privacy Framework, and both rely on the same US mechanisms, in particular oversight by the Federal Trade Commission and the Data Protection Review Court. The EU General Court upheld the EU framework in September 2025; an appeal against that judgment is pending before the Court of Justice. On 29 June 2026 the US Supreme Court ruled in Trump v. Slaughter that the President may dismiss FTC members without cause. Privacy organisations see a key pillar of the framework weakened and have asked the European Commission to withdraw it. The framework still applies, but the likelihood of it falling in court or politically has risen.
What this means for Swiss companies
Transfers to certified providers remain permitted as long as the Federal Council decision applies. But anyone relying solely on the framework is left without a basis if it falls, as happened with the Privacy Shield in 2020. Preparation is therefore sensible and usually involves little effort.
Preparation in five steps
- Inventory: which services transfer which personal data to the US? Ideally the answer is already in the record of processing.
- Check certification: is every US provider certified under the Swiss-U.S. part, and does the certification cover the data concerned?
- Agree a fallback: include standard contractual clauses as an alternative in processing agreements, so a basis exists immediately if the framework falls.
- Reduce risk: encryption with self-managed keys, data minimisation and checking which data needs to go to the US at all. Access via the CLOUD Act remains an issue regardless of the framework.
- Monitor: follow the EU proceedings and any Federal Council adjustments and update the inventory annually.
Standard clauses and risk assessment
Anyone relying on standard contractual clauses instead of the framework must check whether the recipient can actually comply with them in the destination country. This assessment, often called a transfer impact assessment, looks among other things at authorities’ access options and the safeguards in place. It is more work than checking a certification list, but it makes the transfer independent of the political fate of an agreement.
Context
For most companies the situation is no reason for hasty changes, but a good occasion to know and secure their US transfers. We support inventory, contracts and processes as part of FADP implementation for SMEs; key dates of other regulations are on our regulatory deadlines page.