SwitzerlandFederal Act on Data Protection (nFADP), General Processing Principles
Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 1-4, 6, 30-31
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Audit expectation
- none
What it requires
- Have a justification, consent, an overriding private or public interest, or a legal basis, before processing personal data of a person in Switzerland in a way that would otherwise violate their personality rights.NIST Privacy FrameworkCT.PO-P1
- Distinguish your role as controller ("responsible person") or processor under FADP Article 5 lit. j-k, and allocate duties accordingly.NIST Privacy FrameworkID.BE-P1
These lines are LexLint's reading of the law's text. Also read by: Federal Data Protection and Information Commissioner (FDPIC) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.BE-P1The organization’s role(s) in the data processing ecosystem are identified and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Commissioner's published guideline applies the Article 6 processing principles and the Article 31 grounds to cookies and similar technologies.
- As of
- Guidance link
- https://www.edoeb.admin.ch/dam/en/sd-web/brLL9rM3ny9d/Leitfaden%20des%20ED%C3%96B%20betreffend%20Datenbearbeitungen%20mittels%20Cookies%20und%20%C3%A4hnlichen%20Technologien%20V.%201.1%20vom%2006.10.2025_EN.pdf
- Guidance body
- Federal Data Protection and Information Commissioner (FDPIC)
- Open questions
- When does an interest count as an "overriding private or public interest" under Article 31 paragraph 1 of the Federal Act on Data Protection, so that it justifies processing that breaches the principles of Article 6?
What it makes you log
Logging duty
Articles 1 to 4, 6 and 30 to 31 state the Act's purpose and scope, the FDPIC's supervision, the processing principles and the rules on breaches of personality rights and their justification. None of them requires a log, register or record to be kept. The record of processing activities is Article 12 of the Act, and the logging duty for automated processing of sensitive data is Article 4 of the Ordinance on Data Protection (SR 235.11); neither is cited by this row.
- Kind
- None
- As of
What this law does
Switzerland's comprehensive private-sector data protection law is the revised Federal Act on Data Protection (nFADP in English, revDSG in German, nLPD in French), SR 235.1, in force since . It replaces the 1992 FADP and is Switzerland's own statute, aligned with but distinct from General Data Protection Regulation (GDPR).
Processing personal data is not consent-gated by default the way GDPR is opt-in for many bases; the FADP instead prohibits processing that violates a data subject's personality rights unless justified, by consent, an overriding private or public interest, or law.
Controllers ("responsible persons") and processors are distinguished in Article 5 lit. j-k, with duty allocation similar in shape to GDPR's controller and processor split but not identical in mechanics; the Ordinance on Data Protection (ODP) adds implementing detail rather than a separate top-level instrument.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .