Swiss FADP · Federal Act on Data Protection
Swiss FADP compliance and requirements, made workable for the way you handle personal data.
The revised Swiss Federal Act on Data Protection applies to any processing that has an effect in Switzerland, wherever the organisation sits. Sterling's expert and experienced consultants turn its duties into a working compliance programme with your legal, technology and operations teams, assemble the evidence and stay with you once it runs, in 60+ countries. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data protection consultants, building privacy and management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. The law issues no certificate and Sterling does not certify; the FDPIC supervises compliance
8,100+ client engagements in 60+ countries.
Why organisations choose Sterling
What it is
What is the Swiss FADP and what is it used for?
The Federal Act on Data Protection, known in English as the FADP, is Switzerland's general data protection law. It governs how private persons and federal bodies process personal data about natural persons, and it names the Federal Data Protection and Information Commissioner, the FDPIC, as the federal supervisory authority. Detailed rules on data security, processors, disclosure abroad and data subject rights sit in the Data Protection Ordinance (DPO), which the Federal Council adopted alongside it.
In practice the Act requires a controller to know what personal data it holds, why, where it goes and how it is protected, and to show it on request. This page covers the Swiss law on its own terms; organisations also subject to the EU regulation will find that programme on our GDPR page, and the two can be run as one.
Current text. The entirely revised Federal Act on Data Protection of 25 September 2020 entered into force on 1 September 2023, replacing the earlier Act, together with the Data Protection Ordinance and the Ordinance on Data Protection Certification, both of 31 August 2022. Always work from the current consolidated version on the federal legislation portal; English versions there are provided for information, and the binding texts are the German, French and Italian ones.
Who it is for
Who needs Swiss FADP compliance?
Every controller and processor whose handling of personal data has an effect in Switzerland is inside the Act, whether it employs Swiss staff, serves Swiss customers or runs systems that hold their data. Organisations usually reach Sterling through one of four doors:
- A Swiss customer sends a data protection questionnaire. Large Swiss buyers ask suppliers for records, security measures and processor terms before they sign; a programme with evidence answers once.
- A tender or framework contract names the FADP. Procurement teams want to see who is accountable, how breaches reach the FDPIC and how cross-border disclosure is covered.
- You operate from abroad and target the Swiss market. The territorial rule catches foreign companies, and some must appoint a representative in Switzerland. Clarify your position before launch, not after the first complaint.
- Your group runs a GDPR programme and assumed it was enough. A Swiss subsidiary, a Swiss client base or a shared service centre means the Swiss text, ordinance and regulator need a documented review of their own.
Requirements
What are the main Swiss FADP requirements?
The Act is organised in chapters, from scope and general provisions through controller duties and data subject rights to the FDPIC's powers and criminal provisions; the DPO adds the operational detail. The areas below follow the headings of the Act as published and are a plain-language orientation only. Your legal advisers interpret the text for your situation; Sterling works alongside them to build the processes and evidence.
- Scope and supervision: personal data of natural persons, the territorial effect rule and the role of the FDPIC.
- Principles: the general principles that every processing activity must respect, from purpose to accuracy and retention.
- Data protection by design and by default: privacy built into systems and settings from the start.
- Data security: measures that protect personal data against the risks it faces, detailed further in the DPO.
- Processing by processors: contracts and controls that keep outsourced processing within your instructions.
- Governance tools: the data protection officer, codes of conduct, the record of processing activities (with exceptions for smaller companies) and voluntary certification.
- Controllers abroad and cross-border disclosure: the Swiss representative where required, and the conditions for disclosing personal data outside Switzerland.
- Controller duties: information when collecting data and for automated individual decisions, data protection impact assessments, consultation of the FDPIC and notification of data security breaches.
- Data subject rights: the right to information and the right to data portability, with their limitations.
- Enforcement: investigations by the FDPIC and the criminal provisions of the Act.
What does useful FADP evidence look like?
A maintained record of processing activities, privacy notices that match what actually happens, signed processor agreements, a risk-based security baseline, completed impact assessments for high-risk processing, a transfer register, a tested breach procedure and a log of information requests answered. We keep that evidence in Effivity so it stays current rather than being rebuilt whenever a customer or the FDPIC asks.
Compliance route
How do you become Swiss FADP compliant?
There is no FADP certificate to apply for. Compliance is a state you maintain and demonstrate, supervised by the FDPIC. The route is a programme: understand your processing, close the gaps, embed the controls and review them. Where a customer wants independent assurance, voluntary certification under the Swiss certification ordinance can follow.
- 01Map your processing.Identify the personal data you hold, the purposes, systems, processors and destinations abroad, and confirm your role as controller or processor.
- 02Gap analysis: compare current practice with the Act and the ordinance.Measure notices, records, security, contracts, rights handling and breach response against the requirements; agree actions, owners and dates.
- 03Implement the controls and the documentation.Records of processing, notices, processor terms, security measures, impact assessments and procedures put into daily use and understood by staff.
- 04Test and review the programme.An internal review samples real requests, incidents and transfers; findings are closed with evidence and reported to management.
- 05Maintain, and certify if you choose.Keep records current as systems change; where assurance is wanted, an SAS-accredited body can certify a management system, product, service or process for three years, with annual checks.
Check the route before you sign. Voluntary data protection certification in Switzerland is carried out by certification bodies accredited by the Swiss Accreditation Service, which consults the FDPIC; ask any body for its accreditation and verify it with SAS directly. Be wary of anyone offering an "FADP certificate" without a programme behind it: the law itself issues none.
Cost
What does Swiss FADP compliance cost?
The effort follows your data, not your turnover: one product and a few processors need far less than several subsidiaries with data flowing to many countries. A Sterling proposal breaks the work into visible components under one all-inclusive proposal.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | The number of processing activities, systems and processors, existing privacy work and how much your team carries itself (Design™ or Drive™) |
| Legal advice | Engaged by you separately where interpretation of the law is needed; Sterling works alongside your advisers |
| Internal resources | Time from system owners, HR, marketing and IT, plus any technical changes to security or retention |
| Software and learning | Included in a Sterling engagement: Effivity for records and registers, and Sterling Academy access for your people, confirmed in the proposal |
| Optional certification and continued support | Any voluntary certification fees charged by an accredited body, and periodic reviews under Sustain™ |
What drives the effort
- How many processing activities and systems handle personal data
- The volume of disclosures outside Switzerland and to processors
- Whether high-risk processing calls for impact assessments
- How much a GDPR or ISO/IEC 27701 programme already covers
- Languages, entities and the deadline set by a customer or tender
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Third-party fees such as legal advice or certification kept separate
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables
- One all-inclusive proposal, with nothing added later
Timeline
How long does Swiss FADP compliance take?
Most of the calendar goes on discovery and on changing live systems. As a working estimate, a first programme takes three to six months, shorter where a GDPR programme already exists and longer where records, contracts and security measures start from nothing. The programme then continues, because processing changes every time a system or supplier does.
| Phase | What determines the pace |
|---|---|
| Mapping and gap analysis | Access to system owners and the completeness of existing inventories |
| Implementation | Contract renegotiation with processors, technical security changes and approvals |
| Review | Enough live requests, incidents and changes to test the procedures on |
| Optional certification | The accredited body's scheduling and the time to address its findings |
If a customer contract or launch date is driving the work, tell us on day one. We will say plainly what can be ready by then and which decisions have to be made early.
Your engagement
What your Swiss FADP engagement includes
Sterling OS™ sets the engagement. Choose Design™, where our consultants guide and your team builds, or Drive™, where we manage the work with your people; either level delivers the same programme. Sustain™ keeps it current afterwards, and Automate™ runs it in Effivity. Sterling does not certify, validate or attest compliance with the FADP; we build and support the programme, while supervision rests with the FDPIC and any voluntary certification with an accredited body.
Processing map, gap analysis and plan
Owners, dates and decisions agreed before any document is drafted.
Records, notices and processor terms
Built from Sterling's template sets and adapted to your processing with your teams.
Effivity ISO & GRC software
Registers and records run in Effivity from the start, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your reviewers, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Impact assessments and breach readiness
Assessments for high-risk processing and a breach procedure rehearsed before it is needed.
Internal review and Sustain™
A documented review with findings closed, then periodic checks as your processing changes.
Legal interpretation remains with your legal advisers, and supervision with the FDPIC.
Often combined with
Standards organisations pair with Swiss FADP
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · data protection software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the Swiss FADP.
Each Sterling FADP engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so the record of processing activities, processor register, impact assessments, breach log, information requests, training records and reviews sit in one place and stay current as the business changes. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Entities, roles and Swiss exposure
Which entities act as controller or processor, where the Swiss effect arises and whether a representative is needed, held in one place and revisited when the business changes.
Purposes, retention and accuracy
Each processing activity carries its purpose, retention rule and owner, so proportionality is visible and deletion happens on schedule.
The processing register
Activities, data categories, recipients and destinations abroad kept as a live register that owners update, rather than a spreadsheet rebuilt each year.
Security measures and risks
Technical and organisational measures linked to the systems they protect, with risks, treatments and review dates tracked to closure.
Processor and transfer register
Contracts, assessments and destination countries for every processor and recipient, with renewal and review reminders.
Impact assessments and breach notification
Assessment workflows for high-risk processing and a breach log that records the facts, the decision on notifying the FDPIC and the timing.
Information and portability requests
Requests logged on arrival, assigned, answered and evidenced, with limitations recorded where they are applied.
Your own forms, workflows and reports
Fields, approvals and dashboards shaped to how your teams work, without code, and legal requirements linked to the processes they touch.
What this means when someone asks
A Swiss customer's questionnaire, an individual's information request or an FDPIC enquiry asks for the same things: the processing record, the processor contracts, the security measures and what happened in the last incident. In Effivity each of those is already a screen with owners, dates and attachments. Sustain™ runs in the same workspace, so the answer next year is as current as the answer this year.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your existing inventories and registers migrated, not retyped
- Admin and user training for your team
- Modules for EMS, OHSMS, ISMS, FSMS and more when you integrate other standards
Sterling Academy · data protection e-learning
Make data protection part of every role, not only the privacy team's.
Sterling Academy provides e-learning for all staff and for those who run the programme: video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients receive preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness for every employee who touches personal data
- Practitioner learning for system owners, HR, marketing and IT
- Internal auditor training for your reviewers, as applicable to your standard, as part of the engagement
- Completion records by department, ready for a customer's questionnaire
- New joiners trained as they start, so records stay current
- A Sterling consultant on hand when a learner has a question
Where we work
Where Sterling delivers Swiss FADP
Keep exploring
Explore more about Swiss FADP
Swiss FADP resources
Services for Swiss FADP
Why Sterling
Why choose Sterling for Swiss FADP compliance?
Swiss data protection rarely stands alone. It sits next to the GDPR, an information security system and customer contracts written in several languages. Sterling builds one programme that answers all of them, with local owners for each entity and a single consultant accountable for the whole.
Programmes in 60+ countries since 2003
Privacy, security and management systems delivered for organisations across every region we serve, so cross-border processing is familiar ground.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with legal and certification fees shown separately.
Controls your people will use
Procedures sized to your processing and wired into the tools teams already work in, so the programme survives beyond the project.
Expert and experienced consultants
Consultants who have built data protection and security programmes across sectors and jurisdictions, and who work side by side with your legal advisers.
The Sterling Promise
What the Sterling Promise means for your Swiss FADP programme
We stay with you until the agreed Swiss FADP programme outcome is reached, supporting implementation, review and the closure of findings. Plain explanations, practical delivery, included software and staff learning leave your organisation with lasting capability, not a folder of policies.
The engagement sets out the scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. Compliance with the law remains your organisation's responsibility under the supervision of the FDPIC, and any voluntary certification decision rests with the accredited body. Our commitment concerns the agreed programme support, not the outcome of any regulatory proceeding.
FAQs
Frequently asked questions about the Swiss FADP
Does the Swiss FADP apply to companies outside Switzerland?
Yes, where the processing has an effect in Switzerland, even if it starts abroad. Serving Swiss customers or processing data about people in Switzerland is the usual trigger; your legal advisers confirm the position for your activities.
If we comply with the GDPR, are we compliant with the FADP?
Not automatically. The two laws share much of their logic, but the FADP has its own text, ordinance and regulator, so a GDPR programme needs a documented review against the Swiss information duties, cross-border rules and FDPIC notification requirements. Most of the existing work can usually be reused.
Does the revised FADP still protect data about companies?
No. The revised Act applies to personal data of natural persons. Information about legal entities may still be protected by contracts, confidentiality duties or other laws, which sit outside a data protection programme.
How quickly must a data breach be reported to the FDPIC?
As quickly as possible, where the breach is likely to lead to a high risk to the personality or fundamental rights of the people concerned. That makes a rehearsed internal procedure essential, so the decision on whether to notify is taken on facts rather than in a rush.
Do foreign companies need a Swiss representative under the FADP?
Some do. The Act requires certain private controllers based abroad to appoint a representative in Switzerland, depending on how their processing relates to people in Switzerland and on its scale, regularity and risk. We help you document the assessment; the legal conclusion is for your advisers.
Keep exploring
More on Swiss FADP and related standards
Talk to a consultant
Plan your Swiss FADP compliance programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice