The Swiss nFADP,
explained plainly

The nFADP is the revised Swiss Federal Act on Data Protection — often written as the revFADP, and in German the revised DSG (nDSG). It came into force on 1 September 2023, replacing a law that dated back to the early 1990s and bringing Swiss data protection up to date with how organizations actually handle personal data today.

It is a federal law, not a standard you certify against. There is no "nFADP certificate" to hang on the wall and no accredited body that audits you against it. You comply with it the way you comply with any law: by meeting its duties in how you actually process personal data, and by being able to show that you do if the regulator or an affected person asks.

A large part of the revision was deliberately aimed at staying close to the EU GDPR. Switzerland is not an EU member, but keeping Swiss law broadly equivalent helps preserve the EU’s recognition that Switzerland offers an adequate level of protection — which is what lets personal data flow freely between the EU and Switzerland without extra safeguards.

The most consequential change is also the easiest to miss: the nFADP protects only the personal data of natural persons. The previous law also covered the data of legal entities, companies and other organizations, and that protection is gone. If your old documentation treated supplier or corporate records as in scope on that basis, the picture has narrowed.

The revision also sharpened the duties around transparency and information. Information obligations toward the people whose data you process are broader than before, so individuals know what is collected, why, and where it may go. Two new categories, genetic data and biometric data that uniquely identifies a person, were added to the list of "sensitive" personal data, which carries stricter handling requirements.

Finally, the revision introduced privacy by design and privacy by default as explicit obligations, rather than good practice you might adopt voluntarily. Together these changes move Swiss law from a lighter, principles-only regime toward something a GDPR-trained team will recognize.

The nFADP applies to private persons and federal bodies that process the personal data of natural persons. For most companies that means almost any handling of customer, employee, prospect or user data falls within scope — collecting it, storing it, using it, sharing it or deleting it.

Crucially, it can reach beyond Switzerland’s borders. The law applies to processing that has an effect in Switzerland, even when the organization doing it sits abroad. So a non-Swiss company serving Swiss residents can find itself subject to the nFADP much the way a non-EU company can find itself subject to the GDPR.

The practical consequence for Swiss-based teams is that the nFADP is rarely the only law in play. Many Swiss companies also serve customers in the EU, which brings the GDPR alongside it. That overlap, two closely related but distinct regimes, is the single biggest reason Swiss teams want to map their obligations once and reuse the work, rather than run two separate programmes.

At the centre of the nFADP is a small set of principles that every processing activity has to respect. Personal data must be processed lawfully and in good faith; collection and use must be proportionate and tied to a specified, recognizable purpose; data must be accurate and kept current; and it must be protected by appropriate security measures against loss and unauthorized access.

These principles are not a checklist you complete once. They are conditions that have to hold continuously across everything you do with personal data, which is why "are we still proportionate, still on-purpose, still secure?" is a question a programme keeps asking rather than answers and files away.

The nFADP expects controllers and processors to keep a record of their processing activities — an inventory of what personal data they handle, for what purposes, who it is shared with, and how long it is retained. It is the document that lets you, and the regulator, see the shape of your data processing at a glance, and it is usually the first thing you reach for when any other obligation comes up.

There is a meaningful carve-out for smaller organizations. Companies with fewer than 250 employees are exempt from the record-keeping duty, provided their processing is low-risk — in practice, where it does not involve large-scale processing of sensitive data or high-risk profiling. The exemption is real, but it is conditional: a small company doing genuinely sensitive or high-risk processing does not get to skip the record.

In practice many SMEs keep a record anyway, because the conditions that lift the exemption are exactly the cases where you most want one, and because the record is the backbone the rest of the programme hangs off. Letting it drift out of date is how a small team ends up reconstructing its data flows from memory the moment a question arrives.

Where a planned processing activity is likely to result in a high risk to the personality or fundamental rights of the people affected, the nFADP requires a data protection impact assessment (DPIA) before you start. Large-scale processing of sensitive data, or systematic large-scale monitoring, are the kinds of activity that typically trigger one.

A DPIA is a structured look-before-you-leap: you describe the planned processing, assess the risks it poses to the individuals involved, and set out the measures that bring those risks down to an acceptable level. If a high risk remains even after your measures, the law expects you to consult the Federal Data Protection and Information Commissioner before going ahead.

Because the trigger is the riskiness of a specific activity, DPIAs are not a one-off. New products, new data sources and new uses of existing data each raise the question again, which is why teams that treat the DPIA as a living, reusable assessment fare better than those that write one and forget it.

When a data security breach is likely to lead to a high risk to the personality or fundamental rights of the people affected, the nFADP requires you to notify the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible. Where it is necessary for their protection, or where the FDPIC requires it, you must also inform the affected individuals.

The phrase that matters is "as soon as possible". Unlike the GDPR’s fixed 72-hour clock, the nFADP sets a less rigid timeline — but the practical demand is the same: when a breach happens, you need to assess it and report it quickly, which is only realistic if you already know what data you hold and where it lives. A breach is the worst moment to discover your record of processing is out of date.

The nFADP and the GDPR are close relatives, by design, and a team that understands one will recognize most of the other: the same principles, the same emphasis on transparency, similar records, DPIAs and breach duties. But they are not identical, and the differences are exactly where a careless "we already do GDPR" assumption goes wrong.

The notable divergences: the nFADP’s record-keeping exemption for companies under 250 employees has no clean GDPR equivalent; breach notification is "as soon as possible" rather than a fixed 72-hour deadline; the nFADP has no general mandate to appoint a data protection officer the way the GDPR does in defined cases; and, most strikingly, the enforcement model is different — the nFADP’s fines fall on responsible individuals, not primarily on the company. Scope differs too: the nFADP no longer covers the data of legal entities, where the GDPR never did.

For a Swiss company that also serves EU customers, both laws apply at once — and that is the common case, not the edge case. The efficient way to handle it is to treat the overlapping obligations as one body of work: map a control or a record once, then satisfy whichever law it answers to, instead of maintaining two parallel binders that drift apart.

The FDPIC supervises compliance with the nFADP. It can investigate, issue rulings and order processing to be changed, suspended or stopped — the supervisory backbone of the law. But the part that surprises people is how the financial penalties work.

For certain breaches, the nFADP allows criminal fines of up to CHF 250,000. The striking detail is who pays: the fine is imposed on the responsible private individual (the person who breached a specific duty), not, as a first resort, on the company. That is a deliberate departure from the GDPR’s corporate-percentage fines, and it changes the internal conversation: data-protection duties are something specific people can be held personally accountable for, which raises the stakes for getting roles, decisions and records clear.

For a compliance programme, the implication is practical. The defence against a penalty is the same as the work of running the programme well: knowing what you process, why it is lawful and proportionate, that it is documented and secured, and that you can show all of it. A programme kept current is the evidence that the duties were met — and the thing you least want to be assembling from memory after the fact.