Short answer
The revised Swiss FADP, effective from 1 September 2023, is closely aligned with the EU GDPR but differs in territorial scope, private-sector legal bases, automated decision safeguards and penalties. For AI services, both require transparent, proportionate processing and risk assessments where high risk is likely. GDPR compliance alone does not establish Swiss compliance.
FADP vs GDPR at a glance
| Key provision | Swiss FADP | EU GDPR |
|---|---|---|
| Territorial scope | Processing with effects in Switzerland (Art. 3) | EU establishment, or qualifying offers to or monitoring of people in the EU (Art. 3) |
| Private-sector legal basis | Processing must respect personality protection and statutory principles; justification for infringements (Arts. 6, 30–31) | An Article 6 lawful basis is required; extra conditions for special-category data |
| Automated decisions | Information and human review rights for exclusively automated significant decisions, with exceptions (Art. 21) | Right not to be subject to solely automated significant decisions, with exceptions and safeguards (Art. 22) |
| DPIAs | High risk to personality or fundamental rights (Art. 22) | High risk to rights and freedoms (Art. 35) |
| Representative | Foreign private controllers meeting all Article 14 conditions | Non-EU controllers and processors within Article 3(2), unless an Article 27 exception applies |
| Breach reporting | To FDPIC as soon as possible when high risk is likely (Art. 24) | To the authority within 72 hours where feasible, unless risk is unlikely (Art. 33) |
| Penalties | Up to CHF 250,000 for specified intentional offences, generally targeting responsible individuals | Up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements |
This comparison concerns personal data processed by AI services, not every AI system regardless of its data. Assess each law separately. If your organisation operates abroad, Formiti’s Swiss FADP representative service can help assess Article 14 appointment requirements and provide local regulatory and data-subject contact.
Key provisions affecting AI services
Territorial scope and adequacy
The FADP applies to circumstances with effects in Switzerland, even when initiated abroad. The GDPR applies to processing in the context of an EU establishment and, in defined circumstances, to non-EU organisations offering goods or services to people in the EU or monitoring their behaviour there. A person merely visiting a website from the EU does not automatically prove that the offering criterion is met.
The revised FADP entered into force on 1 September 2023. The European Commission’s review published on 15 January 2024 confirmed Switzerland’s continuing adequacy status. Adequacy supports EU-to-Switzerland transfers without an additional Chapter V transfer safeguard; it does not waive other GDPR duties or make the two laws identical. See the FDPIC announcement of the EU adequacy review (15 January 2024).
Legal bases, sensitive data and transparency
The GDPR approach
The GDPR starts from a prohibition. You may not process personal data unless a listed lawful basis applies. For AI services, that means naming a basis before training begins. The GDPR text sets out the six lawful bases.
In December 2024, the European Data Protection Board (EDPB) issued an opinion on AI models. It confirmed that legitimate interest can support model development. However, it requires a careful three-step test. Read the EDPB Opinion 28/2024 on AI models.
The EDPB also warned that model anonymity is not automatic. Moreover, unlawful development can affect later deployment. Therefore, training data provenance deserves real documentation.
The FADP approach
The FADP starts from personality protection. Private-sector processing is broadly allowed if it respects the core principles. These include lawfulness, good faith, proportionality, purpose limitation and accuracy. The full text is the Federal Act on Data Protection (SR 235.1).
A justification becomes necessary when processing breaches someone's personality. For example, this happens when processing goes against a person's express objection. It also happens when sensitive data is disclosed to third parties. Justification can rest on consent, law, or an overriding private or public interest.
Where consent is required, it must be explicit for sensitive data and high-risk profiling.
What this means in practice
A Swiss analysis may pass where an EU analysis fails. Nevertheless, the FADP is not a free pass. Proportionality and purpose limitation still constrain scraped or repurposed datasets.
The FDPIC also expects transparency about the purpose, functionality and data sources of AI-based processing. Consequently, the safest approach is to build to the stricter standard.
Sensitive data and biometric systems
Both laws protect sensitive data more strictly. However, the lists differ.
Under the FADP, sensitive data includes health data and genetic data. It also covers biometric data that uniquely identifies a person. In addition, it includes data on criminal and administrative proceedings and social assistance measures.
The GDPR lists special categories separately. These include data on sex life, sexual orientation and trade union membership. Criminal data receives its own treatment.
For AI, these differences matter most in three areas:
- Face and voice recognition
- Health-related inference models
- Systems that score people using behavioural data
The FADP also defines high-risk profiling. This means profiling that combines data to assess essential aspects of a person's personality, with high risk. The GDPR has no separate category. Instead, it triggers a DPIA for systematic and extensive evaluation of individuals.
Transparency duties
Both laws require clear information at the point of collection. The FADP requires you to disclose the countries where data is sent. The GDPR requires details on recipients and transfers.
Moreover, the FDPIC expects users to know when they interact with a machine. It also expects clarity on whether inputs may be reused, for example for training.
Many providers copy EU privacy notices into Swiss markets. As a result, Swiss references are often missing. This is a visible documentation gap on inspection.
Representatives, records and cross-border operations
Foreign organisations may need a local representative in each jurisdiction. The rules differ.
Article 14 of the FADP sets strict conditions. A foreign private controller needs a Swiss representative only if all are met. It must offer services to or monitor people in Switzerland. The processing must also be extensive, regular and high risk.
Article 27 of the GDPR applies to non-EU controllers offering services to or monitoring people in the EU. It contains limited exceptions.
Importantly, an EU representative does not cover Switzerland. The two appointments are separate. Formiti provides both a Swiss FADP representative service and an EU GDPR representative service.
A Swiss data protection adviser is optional for private controllers under FADP Article 10; a GDPR DPO is mandatory only where Article 37 criteria are met. Representatives and DPOs have different functions. Formiti’s outsourced DPO service supports ongoing governance, while its EU GDPR representative service covers a separate representative appointment where required.
Breach notification and international transfers
AI services face unusual incident types. Examples include prompt injection, training data leakage and exposed model logs.
Under the GDPR, you notify the authority within 72 hours unless a risk is unlikely. Under the FADP, you notify the FDPIC promptly if the breach is likely to cause high risk.
Consequently, your incident playbook needs a single triage step with two notification tracks. Assess the risk once. Then apply each law's threshold and timing.
AI services rarely keep data in one place. Model providers, cloud hosts and logging tools often sit abroad.
Under the FADP, transfers can rely on the Federal Council's list of adequate countries. Otherwise, you need safeguards such as standard contractual clauses recognised by the FDPIC. Since 15 September 2024, transfers to certified US companies can also use the Swiss-US Data Privacy Framework.
The GDPR follows a parallel structure. It uses Commission adequacy decisions, standard contractual clauses and the EU-US Data Privacy Framework.
However, adequacy is not a shortcut. You still need to know where data rests, where inference runs and who can access logs. Therefore, map every flow before you rely on any transfer mechanism.
Automated decisions and profiling
Not all profiling is an automated individual decision. Identify whether the output determines a decision without meaningful human involvement and whether that decision has legal or similarly significant effects. Credit decisions, hiring rejections and access to essential services can raise these issues; a recommendation with genuine human assessment may require a different analysis.
GDPR Article 22 gives individuals a right not to be subject to solely automated significant decisions. The exceptions are contractual necessity, authorisation by law with safeguards, or explicit consent. For the contract and consent routes, safeguards include human intervention, expressing a view and contesting the decision; special-category data adds further restrictions.
FADP Article 21 requires information about an exclusively automated decision with legal or similarly significant effects and, on request, an opportunity to express a view and have a natural person review it. Its information and review duties have exceptions, including a decision directly connected with concluding or performing a contract where the person’s request is satisfied, or explicit consent to the automated decision. These are not identical to the GDPR exceptions.
High-risk profiling is a separate FADP concept. Where private-sector processing relies on consent for high-risk profiling, that consent must be explicit. Do not treat every profiling activity as requiring consent automatically; assess the data, personality infringement and available justification.
- Record whether each decision is solely automated and how significant its effects are.
- Document the applicable exception or lawful route separately for Switzerland and the EU.
- Provide clear information, meaningful review and a route to challenge the result where required.
- Retain evidence that human reviewers can genuinely change the outcome.
DPIAs and AI risk assessments
FADP Article 22 and GDPR Article 35 require a DPIA when processing is likely to result in high risk. AI is not an automatic trigger solely because it is AI: evaluate the nature, scope, context and purpose, the technology, sensitive data, scale, profiling and effects on individuals. Large-scale sensitive-data processing and systematic significant automated evaluations deserve particular scrutiny.
A joint assessment can share the data-flow map, purpose, necessity, proportionality, risks and safeguards, but it must address each jurisdiction’s requirements explicitly. Review it when models, data sources, vendors, uses or decision effects change. A broader AI risk assessment does not replace a legally required DPIA.
If high risk remains despite safeguards, FADP Article 23 requires prior consultation with the FDPIC. A private controller may use the statutory data-protection-adviser consultation route instead where its conditions are met. GDPR Article 36 requires supervisory-authority consultation where the DPIA indicates unmitigated high risk. Do not assume that consulting any adviser satisfies the Swiss exception.
Use Formiti’s DPIA workflow toolkit to structure the assessment and AI vendor risk management service to evaluate suppliers, training use and deployment controls.
FDPIC guidance on AI
The FDPIC’s statement of 9 November 2023 confirms that existing data protection legislation is directly applicable to AI-supported processing. The FADP is technology neutral: there is no general AI exemption from transparency, purpose limitation, proportionality, security or individual rights.
Its official AI and data protection guidance stresses understandable information about AI-based processing, including its purpose, functionality and data sources. Explain whether inputs are retained or used for training, who receives them and how people can exercise their rights. Complete a DPIA where high risk is likely.
For EU model development, the EDPB Opinion 28/2024, adopted 17 December 2024 addresses model anonymity, legitimate interests and the effects of unlawfully processed development data. A legitimate-interest assessment is case specific, not a blanket authorisation for training.
The EU AI Act (Regulation 2024/1689) is a separate layer, not a substitute for either privacy law. Check its applicable provisions, implementation dates and amendments directly before deployment rather than treating an AI classification as proof of data-protection compliance.
Penalties compared: personal fines vs company fines
Under FADP Articles 60–63, specified intentional offences can attract fines of up to CHF 250,000, generally directed at responsible natural persons. They are not a blanket penalty for every compliance failure. Cantonal criminal authorities prosecute these offences; the FDPIC investigates compliance and can order measures but does not itself impose these criminal fines.
Under FADP Article 64, a business can instead face a fine of up to CHF 50,000 in the limited circumstances where that maximum is applicable and identifying the responsible individual would require disproportionate investigative effort. See the FDPIC explanation of criminal-law provisions and the Act itself.
GDPR Article 83 has two principal administrative-fine bands. The higher band is up to EUR 20 million or 4% of total worldwide annual turnover in the preceding financial year, whichever is higher; the lower band is up to EUR 10 million or 2%. The applicable band and actual penalty depend on the infringement and statutory factors. For undertakings, the turnover calculation can extend beyond the immediate legal entity.
For AI providers, the implication is clear: document who approved the data use, risk assessment and safeguards. Swiss personal liability and EU undertaking-level exposure require careful governance, not just a comparison of the headline currency amounts.
What AI providers should do next
- Map the service. Record training, inference, prompts, logs, sensitive data, vendors and all processing locations.
- Confirm the legal scope. Test FADP Article 3 and GDPR Article 3 independently; document legal bases and Swiss personality-protection analysis.
- Assess AI risks. Complete a DPIA where the statutory high-risk threshold is met and record any prior consultation.
- Review automated decisions. Identify significant effects, applicable exceptions, notices and meaningful human review.
- Check representation. Apply all Swiss Article 14 conditions and GDPR Article 27 separately; an EU representative does not cover Switzerland.
- Update notices and contracts. Explain data sources, training reuse, transfers, retention, processor safeguards and rights.
- Keep incident and review evidence. Apply each breach threshold and timeframe; reassess after significant model or vendor changes.
Keep the shared programme in one place with jurisdiction-specific controls. The Privacy360 platform can organise processing records, assessments and compliance evidence. The Swiss nFADP compliance checklist and AI deployment comparison provide related guidance.
For a Swiss market launch or an existing cross-border AI service, explore Formiti’s Swiss FADP representative service and discuss a Swiss/EU compliance gap assessment.
Official sources and dates
- Federal Act on Data Protection (SR 235.1) — Act of 25 September 2020; revised law effective 1 September 2023. The English translation is informational; consult an authoritative language version for legal interpretation.
- GDPR, Regulation (EU) 2016/679 — adopted 27 April 2016; applicable from 25 May 2018.
- FDPIC: current data protection legislation is directly applicable to AI — 9 November 2023.
- FDPIC: EU adequacy decision regarding Switzerland — 15 January 2024 review confirmation.
- FDPIC: AI and data protection and FDPIC: criminal-law provisions — regulator guidance.
Frequently asked questions
Does the Swiss FADP apply to AI providers outside Switzerland?
Yes, it can. The FADP applies whenever processing has effects in Switzerland, even if it starts abroad. Therefore, a non-Swiss AI provider serving Swiss users may fall under it. In some cases, you must also appoint a Swiss representative. See our representative services for details.
Is the FADP stricter than the GDPR for AI services?
Not overall. The GDPR is stricter on fines and legal bases. However, the FADP has its own demands, such as consent for high-risk profiling. In addition, Swiss fines can target responsible individuals personally. Consequently, you should treat the GDPR as your baseline and add the Swiss points.
Do I need a DPIA for an AI system under the FADP and GDPR?
Usually, yes. Both laws require a data protection impact assessment when processing is likely to create high risk. AI systems that profile people or make automated decisions often meet that threshold. Furthermore, a DPIA records your reasoning if a regulator asks. Our DPO services can support this.
Has the FDPIC issued guidance on AI?
Yes. The FDPIC has stated that the FADP applies directly to AI-supported data processing. Moreover, it expects transparency about how AI uses personal data. Always check the FDPIC website for the latest position, since this area changes quickly.
Do I need separate compliance programmes for Swiss and EU rules?
Not necessarily. The two laws overlap heavily, so one aligned programme usually works. Nevertheless, you must track the differences, such as breach timelines, representatives and international transfers. A global DPO service can manage this in one place.