Switzerland

Article 197 paragraph 4 penalises, with a custodial sentence not exceeding three years or a monetary penalty, any person who produces, imports, stores, markets, advertises, exhibits, offers, shows, passes on or makes accessible to others, acquires, or procures or possesses via electronic media or otherwise, items or recordings that contain sexual acts involving animals or non-genuine sexual acts with minors; where the items or recordings instead contain genuine sexual acts with minors, the penalty rises to a custodial sentence not exceeding five years, in the wording in force since 1 July 2024.

Paragraph 5 separately penalises, with a custodial sentence not exceeding one year or a monetary penalty, consuming or producing for one's own consumption the same non-genuine content. Paragraph 9 excludes an item from being regarded as pornographic where it has a cultural or scientific value that justifies its protection by law.

A controller must notify the FDPIC as soon as possible once aware of a data security breach likely to result in a high risk to the data subject's personality or fundamental rights. Unlike General Data Protection Regulation (GDPR) there is no fixed statutory clock: commentary treats 72 hours as a practical benchmark drawn from the Federal Council's explanatory message, not a binding deadline.

Notification to the data subject is required only where necessary to protect them, or if the FDPIC orders it; the controller may limit, defer, or omit subject notification if it is impossible, disproportionate, or superseded by a public communication of comparable effect.

Switzerland's comprehensive private-sector data protection law is the revised Federal Act on Data Protection (nFADP in English, revDSG in German, nLPD in French), SR 235.1, in force since 1 September 2023. It replaces the 1992 FADP and is Switzerland's own statute, aligned with but distinct from General Data Protection Regulation (GDPR).

Processing personal data is not consent-gated by default the way GDPR is opt-in for many bases; the FADP instead prohibits processing that violates a data subject's personality rights unless justified, by consent, an overriding private or public interest, or law.

Controllers ("responsible persons") and processors are distinguished in Article 5 lit. j-k, with duty allocation similar in shape to GDPR's controller and processor split but not identical in mechanics; the Ordinance on Data Protection (ODP) adds implementing detail rather than a separate top-level instrument.

Transfer abroad is permitted without extra safeguards to a state or international body the Federal Council has found provides an adequate level of protection, a maintained list that includes the EU and EEA states.

Absent adequacy, a transfer needs a safeguard: standard contractual clauses, the EU SCCs work with a Swiss-law addendum, binding corporate rules, or one of the narrower Article 17 derogations, explicit consent, contract necessity, overriding public interest, life or safety, or transfer of data from a public register. This is structurally the General Data Protection Regulation (GDPR) Chapter V mechanism, adequacy or safeguards or a derogation, not a hard localization duty.

The European Commission's own adequacy decision for Switzerland was reconfirmed 15 January 2024, covering the post-revision regime, and Switzerland's own Federal Council lists the EU and EEA as adequate for outbound transfers, so the relationship is adequate in both directions.

Articles 25 to 32 FADP give a person in Switzerland rights of access, rectification, deletion or destruction, objection to ongoing processing at any time, and a narrower portability right under Article 28 limited to data the subject provided and that is processed by automated means, in a standard electronic format, on request. Article 32 additionally lets a person go straight to a civil court to compel correction or have disputed data flagged, independent of the FDPIC complaint route.

The FDPIC (Federal Data Protection and Information Commissioner) is the supervisory authority: it investigates on complaint or ex officio and can order a controller to start, change, suspend, or stop processing, or to delete or destroy data, and can compel appointment of a Swiss representative. It does not hold General Data Protection Regulation (GDPR)-style direct administrative fining power.

Criminal sanctions sit in Articles 60 to 65 FADP instead: up to CHF 250,000 against the individual responsible for a willful violation, prosecuted as an offense, with a CHF 50,000 fallback fine on the company itself only when the responsible individual cannot reasonably be identified within the business.

Private civil actions run in parallel and separately, through Article 32 FADP's direct civil-court route and the general Swiss Code of Obligations and Civil Code personality-rights provisions; a claimant must plead and prove quantifiable loss, there is no Biometric Information Privacy Act (BIPA)-style statutory per-violation damages figure.

Article 5 lit. c FADP defines sensitive personal data as a closed list: data on religious, philosophical, political or trade union views and activities; health data; data on the intimate sphere or racial or ethnic origin; genetic data; biometric data that uniquely identifies a natural person; and data on administrative or criminal proceedings and sanctions. Genetic and biometric data are the two categories the 2023 revision added.

A controller relying on consent for sensitive personal data needs express consent under Article 6 para. 7, and large-scale processing of sensitive personal data or systematic large-scale public-space monitoring triggers a mandatory Data Protection Impact Assessment under Article 22.

There is no dedicated Swiss biometric statute and no statutory biometric-specific retention or destruction schedule; retention is governed by the FADP's general proportionality and storage-limitation principle, Article 6 para. 3-4: keep only as long as the purpose requires, then delete or anonymize.

The controlling recent authority is a live FDPIC enforcement action rather than a statute amendment: on 16 May 2025 the FDPIC concluded its investigation into PostFinance's voice-recognition system and found the processing violated the proportionality principle because voiceprints were being created on an opt-out basis rather than opt-in.

The FDPIC ordered PostFinance to obtain explicit, affirmative consent before creating a voiceprint and to delete every voiceprint created without it, with a compliance deadline of 1 October 2025. PostFinance has appealed to the Federal Administrative Court, and the outcome of that appeal is not established; the FDPIC's order is treated as its currently stated position, not as final.

Article 143bis penalises, on complaint, any person who obtains unauthorised access by means of data transmission equipment to a data processing system that has been specially secured to prevent access, by a custodial sentence not exceeding three years or a monetary penalty; its current wording dates from the Federal Decree of 18 March 2011 implementing the Council of Europe Convention on Cybercrime, in force since 1 January 2012.

Article 143 punishes, with a custodial sentence not exceeding five years or a monetary penalty, obtaining specially secured data not intended for the offender for the offender's own or another's unlawful gain, a narrower, gain-motivated offence whose current terminology dates from 1 January 2007.

Article 144bis punishes, on complaint, altering, deleting or rendering unusable data stored or transmitted electronically without authority, escalating to a custodial sentence not exceeding five years and prosecution ex officio where major damage results; its current wording dates from the sentencing-policy harmonisation act in force since 1 July 2023.

Article 24d permits reproducing a work for the purposes of scientific research where the copying is due to the use of a technical process and the works to be copied can be lawfully accessed, with copies made under the article retainable for archiving and backup purposes once the research concludes; the article does not apply to copying computer programs.

Separately, Article 25 permits quoting a published work where the quotation serves as an explanation, reference or illustration and its extent is justified for that purpose, with the source and, where given, the author's name cited.

Article 2's general clause treats as unfair and unlawful any deceptive conduct, or conduct otherwise contrary to good faith, that affects the relationship between competitors or between suppliers and customers.

Article 5 lit. c specifically treats as unfair taking over and exploiting, as such, another's market-ready work product through a technical reproduction process without a reasonable own effort, a misappropriation-style doctrine capable of reaching the wholesale technical copying of a competitor's compiled output, including scraped data, though no reported Swiss case applies it specifically to web scraping.

Intentional unfair competition under Articles 3 to 6 is a criminal offence on complaint, carrying a custodial sentence not exceeding three years or a monetary penalty (Art. 23 para. 1), in its current form since 1 July 2016.

The JSFVG applies to film and video game industry actors and to providers of platform services, in each case within their economic activity, and covers the requirements for age labelling, content descriptors and age verification (Art. 4 lit. a), measures applying to platform services on which users upload and retrieve films or video games (Art. 4 lit. b), and the process for declaring an industry branch's own age-classification code binding on actors who are not members of the branch organisation that wrote it (Art. 4 lit. c, 9-19).

A binding code must set at least five age tiers, with the highest reserved for adults, and must cover age-labelling and age-verification rules. The Federal Assembly passed the Act on 30 September 2022.

Only Articles 1-5, 9-13, 15-19, 29, 32, 37-39 and 41, covering the definitions, scope, and the branch-code binding-declaration mechanism, entered into force on 1 January 2025; the Federal Council has not brought the remaining provisions into force, including Articles 6-8, which set out the age-labelling, content-descriptor and age-verification requirements directly, and no commencement date for them has been announced.