What a Swiss server settles under the FADP
The FADP counts making data accessible as disclosure, so a Swiss data center settles where the data sits and leaves open who can be made to hand it over.
The FADP counts making data accessible as disclosure, so a Swiss data center settles where the data sits and leaves open who can be made to hand it over.
The FADP counts making data accessible as disclosure, so a Swiss data center settles where the data sits and leaves open who can be made to hand it over.
"Hosted in Switzerland" answers a question about geography. The Swiss Federal Act on Data Protection asks two questions, and geography is only one of them.
The second comes from a definition. Art. 5(e) of the revised FADP reads: "disclosure means transmitting personal data or making such data accessible." Access counts. A file that never leaves a server in Zurich is still disclosed abroad if someone abroad can open it.
Art. 16(1) then sets the rule for disclosure abroad: "Personal data may be disclosed abroad if the Federal Council has decided that the legislation of the State concerned or the international body guarantees an adequate level of protection."
Put the two together and a processor raises two questions. Where does the data sit? And who can be made to open it, under which country's law? A Swiss server settles the first. The second is where the work is, and the Act also says where both answers get written down.
One note on the texts. The quotes here come from the official English translations on fedlex. English is not an official language of the Confederation, and both fedlex texts say so: the translation "has no legal force." The German, French and Italian texts are the authoritative ones. Nothing below is legal advice.
The cross-border rules run in a fixed order. You reach the next step only when the one before it doesn't apply.
Step 1: the country list. Art. 16(1) defers to the Federal Council. Under Art. 8(1) of the Data Protection Ordinance (DPO), the states that qualify "are listed in Annex 1." The current Annex has 44 entries. According to the FDPIC's note on standard clauses, "All the countries in the European Union (EU) and the European Economic Area (EEA) are on the list."
Step 2: guarantees. Without a listing, Art. 16(2) allows disclosure "only if an appropriate level of data protection is guaranteed by" one of five instruments:
For a private company the practical route is usually the fourth, because it needs no prior notice to the FDPIC and no approval. The FDPIC recognizes the EU's 2021 Standard Contractual Clauses "including all modules, with the reservation that they will have to be adapted and/or supplemented as necessary in specific cases." The same note lists the adaptations. The FDPIC "must be designated as the supervisory authority" in Annex I.C. References to the GDPR "must be understood as references to the FADP" where Swiss law governs the transfer. An annex has to name the Swiss courts as an alternative forum for data subjects who live in Switzerland. The paperwork got lighter in one respect. Since 1 September 2023, "the obligation to report the use of recognised standard data protection clauses ceased to apply."
Signing is not the end of it. DPO Art. 10(1) requires "appropriate measures to ensure that the recipient complies therewith," and the FDPIC's cross-border page adds a harder condition: "The controller must ensure that the recipient complies with the agreed clauses and that the legislation of the third country allows the recipient to meet their obligations." That last clause is the second question again, the one about foreign law.
Step 3: exceptions. Art. 17(1) lists derogations: explicit consent, disclosure "directly connected with the conclusion or performance of a contract" with the data subject, legal claims, protection of life, data the person made public, and public registers. They are exceptions, and I would not plan a SaaS stack around them. A contract-performance exception covers the booking a customer asked for. It does not stretch to every tool a company runs.
On 14 August 2024 the Federal Council added the USA to the list "to this extent." The release says certification "will allow personal data to be transferred from Switzerland to certified companies in the USA without any additional guarantees." The amendment took effect on 15 September 2024.
The phrase "to this extent" matters, and Annex 1 spells it out. Entry 44 reads: "For personal data processed by organisations certified under the Principles of the Swiss-US Privacy Framework, an adequate level of protection is deemed to be guaranteed." The listing covers certified organizations, not the United States as a whole. The FDPIC points to the list of certified companies at dataprivacyframework.gov/list.
Two more DPO sentences are worth keeping in mind. Art. 8(4): "The adequacy of the data protection shall be reassessed periodically." Art. 8(6): if a reassessment removes a country, "this shall have no effect on disclosures of data already carried out." A listing can end. Your fallback, usually standard clauses, only protects data you haven't sent yet, so have it drafted before you need it.
In June 2021 the FDPIC published a [guide to checking transfer admissibility](https://www.edoeb.admin.ch/dam/en/sd-web/Y-cdGL-4RD0i/Guide%20to%20checking%20the%20admissibility%20of%20direct%20or%20indirect%20data%20transfers%20to%20foreign%20countries%20(Art.%206%20para.%202%20letter%20a%20FADP).pdf). Its first note describes our exact case. A processor "in a country with an adequate level of data protection may, under certain circumstances, be subject to a law or other mandatory requirements of a third country which requires that person to disclose the data to the authorities of a third country." In that case the guide sends you to the same assessment as a transfer to a country without adequate protection (note N03), and gives an example: "server in Switzerland, the EU or the EEA of a company that is directly or indirectly subject to the legal system of a country that does not have an adequate level of data protection." The checklist in note N04 makes it concrete: "US cloud providers with servers in CH/EU/EEA."
The US statute behind this is short. 18 U.S.C. § 2713 was added by Division V of Public Law 115-141, the Clarifying Lawful Overseas Use of Data (CLOUD) Act, on 23 March 2018. It reads in full:
A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.
The operative words are "possession, custody, or control" and "regardless of whether ... located within or outside of the United States." The statute turns on control, and location plays no part in it.
Swiss data protection authorities have said the same thing more recently. On 18 November 2025, privatim, the conference of Swiss data protection commissioners, adopted a resolution on cloud outsourcing. Its fifth reason reads, in my translation: US providers "can be obliged under the CLOUD Act, enacted in 2018, to hand over their customers' data to US authorities without following the rules of international mutual legal assistance, even when the data is stored in Swiss data centres." The resolution's conclusion is that public bodies may use international SaaS for sensitive or legally secret data only if they encrypt it themselves and "der Cloud-Anbieter keinen Zugang zum Schlüssel hat," meaning the provider has no access to the key.
Scope matters here. The resolution addresses public bodies, and the canton of Glarus opted out of it. It says nothing about private companies. I cite it because it is the most recent Swiss regulator-side text I found that names Swiss data centers and the CLOUD Act in the same sentence.
One thing I can't resolve from the sources. The FDPIC guide dates from June 2021, more than three years before the US listing. The English edition still cites the former Art. 6 FADP; the German original was adapted to the revised Act in May 2023, also before the US listing. The FDPIC still links it from its current cross-border page as the guide for transfer risk assessments. I found no FDPIC publication explaining how its "US cloud providers with servers in CH/EU/EEA" example applies now that certified US organizations are on Annex 1. The honest position is that the question is open. The guide also says the exporter "may not rely solely on the statements of the data importer," so a provider's marketing page doesn't close it either. This is a point to take to counsel, with your provider's corporate structure in hand.
The FADP says where the answers go, in three places.
Smaller companies should check DPO Art. 24 before building anything. Undertakings "employing fewer than 250 employees on 1 January of any year" are exempt from keeping the record, unless "a large volume of sensitive personal data is being processed" or "high-risk profiling is being carried out." The exemption covers the register only. Art. 16 and the Art. 19(4) notice still apply at any size.
The sanction sits in Art. 61 and has three conditions: a complaint, wilful conduct, and a cap. "On complaint, a fine not exceeding 250,000 francs shall be imposed on private persons who wilfully" disclose abroad in breach of Art. 16 without an Art. 17 exception, or hand processing to a processor without meeting Art. 9(1) and (2).
Here is the entry I would keep per processor. It is a plain-text template. The field names are mine, not the Act's, and the left-hand column shows which provision each line serves.
processor: <legal entity that signed the DPA>purpose: <what it processes for us> # Art. 12(2)(b)data_location: <country / region of storage> # Art. 16, question 1operator_law: <jurisdictions the operator and its # FDPIC guide N01, N04 parent answer to> # question 2disclosed_abroad: <yes / no, and to which State> # Art. 12(2)(g), 19(4)basis: <Annex 1 listing | Swiss-US DPF cert # Art. 16(1), 16(2)(d), checked on <date> | SCC + Swiss # 17 annex | Art. 17 exception>sub_processors: <approved list, date of approval> # Art. 9(3)technical_measures: <e.g. customer-held keys: yes / no> # FDPIC guide N08next_review: <date> # DPO Art. 8(4)
The operator_law line is the one most registers lack. A Swiss hosting provider with no foreign parent and a Swiss subsidiary of a US group can both write "Switzerland" in data_location. They differ only on that line.
The guide is blunt about contracts. "Additional contractual measures (between the data exporter and the data importer) are rarely possible because they cannot bind third-country authorities." A clause promising to resist an order doesn't bind the authority issuing it.
Technical measures fare better, within limits. For "a simple cloud operation," the guide calls encryption "conceivable" if it follows both BYOK (bring your own key) and BYOE (bring your own encryption), "so that no clear data is available in the cloud." It then adds: "In the case of services in the target country that go beyond simple data storage, however, the use of such technical measures is challenging."
That sentence describes most SaaS. A ticketing tool or an HR system has to read your data to do its job. Customer-held keys are a realistic option for a backup bucket and a hard one for a product that searches, renders, and emails what it stores. So the technical_measures line will say "no" for most of your stack, and the register should say so.
Pick the three processors that hold the most personal data and fill in data_location and operator_law for each. The first line takes a minute. The second can take an afternoon with the provider's corporate filings. Bring those rows to counsel.
Each vendor in devguard carries its data-protection role (processor, sub-processor, or controller) and a location, so the first of those two lines already has a home: devguard.ch.
Vadim leads engineering, the architecture, automation, and integrations that let compliance live. He's set on making a serious, audit-grade system genuinely easy to run.
Start free, bring your frameworks, and keep the evidence attached as the work ships. No setup friction, no audit-week fire drill.
Start free, bring your frameworks, and keep the evidence attached as the work ships. No setup friction, no audit-week fire drill.