SwitzerlandFADP Articles 43, 60-65, FDPIC Supervision and Criminal Sanctions in Switzerland
Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 43, 60-65
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 September 2023.
An enforcement supervision rule binding public and private bodies.
As of 2 September 2026.
What it requires
- Expect the FDPIC to be able to order you to start, change, suspend, or stop processing, or to delete or destroy data, on complaint or its own initiative, rather than to fine you directly.
- Expect the individual responsible for a willful FADP violation to face criminal liability up to CHF 250,000, and expect a Swiss data subject to be able to sue you directly in civil court for a quantifiable loss under FADP Article 32 and the Code of Obligations.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
FADP Chapter 8 (Articles 60 to 64) creates four intentional-offence-only criminal provisions, each carrying a fine not exceeding CHF 250,000 imposed on the private individual responsible: Article 60 (violating the duties to provide access, information, or cooperation with an FDPIC investigation), Article 61 (violating the duty of care, meaning unlawful cross-border disclosure, assigning processing to a processor without meeting the requirements, or failing the Federal Council's minimum data security requirements), Article 62 (violating the professional duty of confidentiality), and Article 63 (disregarding an FDPIC ruling or appeal court decision). There is no criminal liability for negligent conduct. Corporate criminal liability runs through Articles 6 and 7 of the Federal Act on Administrative Criminal Law; where the fine under consideration does not exceed CHF 50,000 and identifying the responsible individual would require disproportionate measures, Article 64 lets the prosecuting authority fine the business itself instead, up to that CHF 50,000 threshold. Cantonal prosecution authorities, not the FDPIC, prosecute these offences on complaint.
Who enforces it
Enforcement body
Federal Data Protection and Information Commissioner (FDPIC), Switzerland's independent federal supervisory authority. Under FADP Article 51 the FDPIC's own powers are corrective, not financial: it may order that processing be modified, suspended, or terminated and that data be deleted or destroyed, but it holds no GDPR-style power to impose an administrative fine itself. The Article 60 to 64 criminal offences are prosecuted separately by the cantonal prosecution authorities on complaint, and a private civil claim under Article 32 and the Civil Code is brought in the ordinary civil courts, independent of the FDPIC.
What it reaches
Obligation class
Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The FDPIC (Federal Data Protection and Information Commissioner) is the supervisory authority: it investigates on complaint or ex officio and can order a controller to start, change, suspend, or stop processing, or to delete or destroy data, and can compel appointment of a Swiss representative. It does not hold General Data Protection Regulation (GDPR)-style direct administrative fining power.
Criminal sanctions sit in Articles 60 to 65 FADP instead: up to CHF 250,000 against the individual responsible for a willful violation, prosecuted as an offense, with a CHF 50,000 fallback fine on the company itself only when the responsible individual cannot reasonably be identified within the business.
Private civil actions run in parallel and separately, through Article 32 FADP's direct civil-court route and the general Swiss Code of Obligations and Civil Code personality-rights provisions; a claimant must plead and prove quantifiable loss, there is no Biometric Information Privacy Act (BIPA)-style statutory per-violation damages figure.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
Read the law
Fedlex, the Swiss Federal Council's official legislation portal
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.