SwitzerlandFADP Article 24, Breach Notification in Switzerland
Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 24
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Notify the FDPIC as soon as possible once you become aware of a data security breach likely to result in a high risk to a Swiss data subject's personality or fundamental rights.
- Notify the affected individual only where necessary to protect them or where the FDPIC orders it; there is no fixed statutory hour count as there is under General Data Protection Regulation (GDPR).
These lines are LexLint's reading of the law's text. Also read by: Federal Data Protection and Information Commissioner (FDPIC) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.edoeb.admin.ch/dam/en/sd-web/T64CAUyvAMcF/1_2%20Leitfaden%20des%20ED%C3%96B%20betreffend%20die%20Meldung%20von%20Datensicherheitsverletzungen%20und%20Information%20der%20Betroffenen%20nach%20Art.%2024%20DSG_EN.pdf
- Guidance body
- Federal Data Protection and Information Commissioner (FDPIC)
What it makes you log
Logging duty
Article 24 requires the controller to notify the FDPIC of a data security breach likely to lead to a high risk, with the nature of the breach, its consequences and the measures taken or planned, to have a processor notify the controller, and to inform the data subject where needed. It states no duty to document breaches or keep a record. The documentation duty with a two-year retention is Article 15 paragraph 4 of the Ordinance on Data Protection (SR 235.11), which this row does not cite.
- Kind
- None
- As of
What this law does
A controller must notify the FDPIC as soon as possible once aware of a data security breach likely to result in a high risk to the data subject's personality or fundamental rights. Unlike General Data Protection Regulation (GDPR) there is no fixed statutory clock: commentary treats 72 hours as a practical benchmark drawn from the Federal Council's explanatory message, not a binding deadline.
Notification to the data subject is required only where necessary to protect them, or if the FDPIC orders it; the controller may limit, defer, or omit subject notification if it is impossible, disproportionate, or superseded by a public communication of comparable effect.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .