SwitzerlandFADP Articles 43, 60-65, FDPIC Supervision and Criminal Sanctions in Switzerland
Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 43, 60-65
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the FDPIC to be able to order you to start, change, suspend, or stop processing, or to delete or destroy data, on complaint or its own initiative, rather than to fine you directly.
- Expect the individual responsible for a willful FADP violation to face criminal liability up to CHF 250,000, and expect a Swiss data subject to be able to sue you directly in civil court for a quantifiable loss under FADP Article 32 and the Code of Obligations.
These lines are LexLint's reading of the law's text. Also read by: Federal Data Protection and Information Commissioner (FDPIC) (guidance, recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
FADP Chapter 8 (Articles 60 to 64) creates four intentional-offence-only criminal provisions, each carrying a fine not exceeding CHF 250,000 imposed on the private individual responsible: Article 60 (violating the duties to provide access, information, or cooperation with an FDPIC investigation), Article 61 (violating the duty of care, meaning unlawful cross-border disclosure, assigning processing to a processor without meeting the requirements, or failing the Federal Council's minimum data security requirements), Article 62 (violating the professional duty of confidentiality), and Article 63 (disregarding an FDPIC ruling or appeal court decision). There is no criminal liability for negligent conduct. Corporate criminal liability runs through Articles 6 and 7 of the Federal Act on Administrative Criminal Law; where the fine under consideration does not exceed CHF 50,000 and identifying the responsible individual would require disproportionate measures, Article 64 lets the prosecuting authority fine the business itself instead, up to that CHF 50,000 threshold. Cantonal prosecution authorities, not the FDPIC, prosecute these offences on complaint.
Penalty structure
Each offence in Articles 60 to 63 carries a fine not exceeding CHF 250,000 on the private person responsible, and only for wilful conduct. Article 64 paragraph 2 lets the authority fine the business itself, up to CHF 50,000, where identifying the responsible individuals would take disproportionate measures. The FDPIC imposes no fine itself.
- Rule
- Fixed only
- As of
- Currency
- CHF
- Fixed cap
- 250,000
Who enforces it
Enforcement body
Federal Data Protection and Information Commissioner (FDPIC), Switzerland's independent federal supervisory authority. Under FADP Article 51 the FDPIC's own powers are corrective, not financial: it may order that processing be modified, suspended, or terminated and that data be deleted or destroyed, but it holds no GDPR-style power to impose an administrative fine itself. The Article 60 to 64 criminal offences are prosecuted separately by the cantonal prosecution authorities on complaint, and a private civil claim under Article 32 and the Civil Code is brought in the ordinary civil courts, independent of the FDPIC.
Settledness
- As of
- Guidance link
- https://www.edoeb.admin.ch/dam/en/sd-web/ekJsT3lqvU35/Merkblatt%20Untersuchung%20von%20Verst%C3%B6ssen%20gegen%20Datenschutzvorschriften_Oktober%202024_EN.pdf
- Guidance body
- Federal Data Protection and Information Commissioner (FDPIC)
- Open questions
- When is a violation of data protection regulations "of minor importance" so that the Commissioner may refrain from opening an investigation under Article 49 paragraph 2 of the Federal Act on Data Protection?
What it makes you log
Logging duty
Articles 43 and 60 to 65 govern the Commissioner's election and status and the fines for false or incomplete information, breach of the duty to cooperate with an FDPIC investigation, breach of duties of care, breach of confidentiality and disregard of decisions. No article cited here requires a log or record. Article 60 paragraph 2 fines a private person who wilfully gives the FDPIC false information or fails to cooperate in an investigation under Article 49 paragraph 3, so a regulator's request for information is the one check the row's text carries; the power itself is in Article 49, which this row does not cite.
- Kind
- None
- As of
What this law does
The FDPIC (Federal Data Protection and Information Commissioner) is the supervisory authority: it investigates on complaint or ex officio and can order a controller to start, change, suspend, or stop processing, or to delete or destroy data, and can compel appointment of a Swiss representative. It does not hold General Data Protection Regulation (GDPR)-style direct administrative fining power.
Criminal sanctions sit in Articles 60 to 65 FADP instead: up to CHF 250,000 against the individual responsible for a willful violation, prosecuted as an offense, with a CHF 50,000 fallback fine on the company itself only when the responsible individual cannot reasonably be identified within the business.
Private civil actions run in parallel and separately, through Article 32 FADP's direct civil-court route and the general Swiss Code of Obligations and Civil Code personality-rights provisions; a claimant must plead and prove quantifiable loss, there is no Biometric Information Privacy Act (BIPA)-style statutory per-violation damages figure.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .