Since its total revision in September 2023, the Swiss Federal Act on Data Protection (FADP) has been closely aligned with the GDPR, but it is not identical. For companies active in both jurisdictions, the differences decide whether one implementation covers both or whether gaps remain. This comparison shows the most important differences from practice.
Scope
Both laws protect the data of natural persons; the revised FADP dropped the former protection of legal entities. The GDPR applies to Swiss companies that target goods or services at people in the EU or monitor their behaviour. Conversely, the FADP applies to matters that have an effect in Switzerland, even if initiated abroad.
Legal basis
This is a fundamental difference. The GDPR requires a legal basis from an exhaustive list for every processing operation. The FADP takes another approach: processing is permitted as long as it complies with the processing principles and does not unlawfully infringe personality; a justification such as consent or overriding interest is needed only where there is an infringement. Implementing the GDPR generally also satisfies this point for Switzerland.
Sanctions
The GDPR provides for administrative fines against companies of up to EUR 20 million or four percent of worldwide annual turnover. The FADP provides for criminal penalties against responsible individuals, with fines of up to CHF 250,000 for intentional violations of certain duties. In Switzerland this shifts risk to the people acting, for example in management.
Organisation and documentation
- Data protection officer: mandatory under conditions under the GDPR and German law, voluntary in Switzerland as a data protection advisor.
- Record of processing activities: not required in Switzerland for companies with fewer than 250 employees and low risk, under the GDPR only in narrow exceptions.
- Data protection impact assessment: required in both jurisdictions where risk is high.
- EU or Swiss representative: required under conditions in both directions for companies without an establishment.
Breach notification and data subject rights
Breaches likely to result in a high risk must be reported in Switzerland to the Federal Data Protection and Information Commissioner as soon as possible, under the GDPR generally within 72 hours to the competent supervisory authority. Information duties are similar and the right of access is comprehensive in both; the deadline is generally 30 days in Switzerland and one month under the GDPR.
Data transfers
The EU recognises Switzerland as providing adequate protection, and Switzerland recognises the EU states. For third countries, Switzerland keeps its own list; for the US, the Swiss-U.S. Data Privacy Framework has applied to certified companies since September 2024.
What this means for implementation
For companies in both jurisdictions, a joint implementation at GDPR level is usually most efficient, supplemented by the Swiss specifics on notification, criminal liability and representation. Which duties apply in your case is shown by a compliance assessment; the terms are explained in the glossary entries on the GDPR and the revised FADP.