The revised Swiss Federal Act on Data Protection (revFADP, in German «revDSG») has applied since 1 September 2023 and has moved closer to the GDPR in many respects. Companies active in both Switzerland and the EU can therefore implement much of it in one go. The differences are not mere details, though: on legal basis, sanctions and some deadlines the two regimes diverge clearly. This overview shows where.
Legal basis: permission or justification
The most fundamental difference lies in the approach. The GDPR requires a legal basis for every processing activity, such as contract, consent or legitimate interest. The revFADP starts from the opposite end: private parties may process personal data as long as they respect the processing principles and do not unlawfully infringe the data subject's personality. A justification is only needed where such an infringement exists. In practice the results are often similar, but Swiss privacy policies do not have to state a legal basis for every processing activity.
Sanctions: companies or individuals
The GDPR provides for administrative fines against companies of up to EUR 20 million or four percent of worldwide annual turnover. The revFADP has no corporate fines of that kind. Its criminal provisions allow fines of up to CHF 250,000, directed at the responsible individuals and requiring intent. They are prosecuted by cantonal authorities; the Federal Data Protection and Information Commissioner (FDPIC) can investigate and issue orders but cannot impose fines.
Breach notification
Under the GDPR a breach must be notified to the supervisory authority within 72 hours unless it is unlikely to result in a risk. The revFADP requires notification to the FDPIC «as soon as possible», but only if the breach is likely to result in a high risk. The threshold is higher and the deadline less rigid. Companies subject to both should design their process around the stricter 72-hour rule.
Records of processing
Both require records of processing, and both exempt companies with fewer than 250 employees under conditions. Under the revFADP the exemption applies if no sensitive personal data is processed on a large scale and no high-risk profiling takes place. The GDPR's exemption is narrower — it does not apply where processing is more than occasional, which is the case for most SaaS providers.
Data protection advisor and officer
The GDPR requires a data protection officer in certain cases, such as large-scale regular monitoring or large-scale processing of special categories of data. The revFADP only knows a voluntary data protection advisor. Appointing one has a practical benefit: after a data protection impact assessment with high residual risk, consulting the advisor can replace consulting the FDPIC.
Information duties
Both require data subjects to be informed at collection. The GDPR requires more mandatory items, such as the legal basis and retention period. The revFADP, for its part, explicitly requires naming the countries to which data is transferred and, where applicable, the safeguards used. A privacy policy covering both regimes therefore includes the mandatory items of each.
Representatives for foreign companies
The GDPR may require companies without an EU establishment that target people in the EU to appoint an EU representative. The revFADP mirrors this: foreign controllers that process data of people in Switzerland on a large and regular scale must, under certain conditions, designate a representative in Switzerland.
What is the same
In many areas the regimes are now close: privacy by design and by default, impact assessments for high-risk processing, the right of access with a deadline of generally 30 days or one month, data portability, information about automated individual decisions, and protection limited to natural persons. The EU recognises Switzerland as providing an adequate level of protection, so data can flow between the two without additional safeguards.
Practical consequence
For companies subject to both regimes, the pragmatic route is to align processes with the stricter standard in each area and to write documentation that meets the mandatory items of both: a breach process built on the 72-hour logic, records kept to GDPR standard, a privacy policy with legal bases and recipient countries. Innopulse implements it this way in its own products and supports companies with technical and organisational implementation; for individual legal questions we recommend specialised counsel.