Two laws, one group

The revised Swiss Federal Act on Data Protection (FADP) has been in force since 1 September 2023. It was written with the GDPR in view, and the European Commission continues to treat Switzerland as providing adequate protection, so personal data moves between the EU and Switzerland without additional transfer contracts.

The similarity leads many groups to extend their GDPR documents to the Swiss entity and stop there. The six points below are where that falls short.

Six differences

PointGDPRSwiss FADP
Who is finedThe company. Up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.The responsible individual. Up to CHF 250,000, for intentional breaches of specified duties.
Breach notificationTo the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk.To the FDPIC as soon as possible, where the breach is likely to lead to a high risk.
Legal basisEvery processing operation needs one of the bases in Article 6.Private companies need no basis by default. A justification is needed where processing would infringe personality rights.
Privacy noticeMust state that data is transferred to third countries and on what safeguard.Must name each country to which data is disclosed.
Privacy officerA data protection officer is mandatory in defined cases.A data protection adviser is optional.
RepresentativeCompanies outside the EU that target people in it appoint an EU representative.Companies outside Switzerland appoint a Swiss representative in defined cases.

What this means in practice

The personal fine changes who needs to care. Under the FADP the exposure sits with the people who decide how data is handled, so the Swiss entity should know by name who that is.

A breach playbook has to run both clocks. The GDPR counts 72 hours from the moment you become aware. The FADP sets no number of hours, and its threshold is higher. One incident can require a notice in one country and none in the other.

A single privacy notice can serve both laws if it lists recipient countries, which the FADP requires and the GDPR permits.

One thing to watch

In November 2025 the European Commission proposed amendments to the GDPR as part of its Digital Omnibus package. As at the review date they have not been adopted, and talks between the Council and the Parliament on a final text have not started. Until a final text is adopted, the GDPR applies unchanged.

What to do now

  1. Check that your privacy notice and records of processing mention Swiss law and name recipient countries.
  2. Write one breach procedure with two decision points: the 72-hour GDPR notice and the FADP high-risk test.
  3. Name the person responsible for data protection in the Swiss entity and tell them what the role carries.
  4. Check whether either entity needs a representative in the other jurisdiction.

Sources

General information as at the review date. It is not legal advice on your situation.