PrivacyTerrain

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Good core structure, but public/private split and enforcement nuances should be refined.

Breach

Breach deadline (hours): 0
Breach notification required: Yes

Marketing

Cookie consent rule: Cookie consent analysis relies on telecom and unfair competition rules alongside privacy expectations.

Transfers

Cross-border transfer restricted: Yes
Data localization required: No

Governance

DPO required: No
Impact assessment required: Yes
Records of processing required: Yes

Identity

Effective date: 2023-09-01
Effective status: in-force
Last amended: 2023-09-01
Law status: active

Scope

Extraterritorial application: Yes
Private sector coverage: Private controllers and processors processing personal data in Switzerland.
Public sector coverage: Federal public bodies under the federal act; cantonal public bodies may be subject to cantonal rules.
Territorial scope: Applies to processing with effects in Switzerland and to federal private-sector processing covered by the Act.

Legal Basis

Legal bases: consent, overriding private interest, legal obligation
Requires legal basis: No

Enforcement

Maximum fine: Criminal fines can reach CHF 250,000 for certain intentional violations.
Private right of action: Yes

Definitions

Personal data definition: Personal data means any information relating to an identified or identifiable natural person.
Sensitive data recognized: Yes

Rights

Right of access: Yes
Right to appeal: Yes
Right to deletion: Yes
Right to object: Yes
Right to portability: Yes

Official sources

Federal Act on Data Protection textPrimary official law • en • html
FDPIC guidanceSecondary official material • en • html

Switzerland