Switzerland

Article 197 paragraph 4 penalises, with a custodial sentence not exceeding three years or a monetary penalty, any person who produces, imports, stores, markets, advertises, exhibits, offers, shows, passes on or makes accessible to others, acquires, or procures or possesses via electronic media or otherwise, items or recordings that contain sexual acts involving animals or non-genuine sexual acts with minors; where the items or recordings instead contain genuine sexual acts with minors, the penalty rises to a custodial sentence not exceeding five years, in the wording in force since 1 July 2024.

Paragraph 5 separately penalises, with a custodial sentence not exceeding one year or a monetary penalty, consuming or producing for one's own consumption the same non-genuine content. Paragraph 9 excludes an item from being regarded as pornographic where it has a cultural or scientific value that justifies its protection by law.

A controller must notify the FDPIC as soon as possible once aware of a data security breach likely to result in a high risk to the data subject's personality or fundamental rights. Unlike General Data Protection Regulation (GDPR) there is no fixed statutory clock: commentary treats 72 hours as a practical benchmark drawn from the Federal Council's explanatory message, not a binding deadline.

Notification to the data subject is required only where necessary to protect them, or if the FDPIC orders it; the controller may limit, defer, or omit subject notification if it is impossible, disproportionate, or superseded by a public communication of comparable effect.

Where a large volume of sensitive personal data is processed by automated means, or high-risk profiling is carried out, and preventive measures cannot guarantee data protection, a private controller and its private processor must at least log the storage, alteration, disclosure, deletion and destruction of the data and any access to it. The log file shows who carried out the processing, the form, date and time of processing and, where relevant, the recipient.

It is retained for at least one year, kept separate from the system that processes the data, and made accessible only to the bodies and persons required to review the application of the data protection regulations or to safeguard or restore the confidentiality, integrity, availability and traceability of the data.

A federal body logs its automated processing of sensitive personal data, its profiling and its processing within Directive (EU) 2016/680, and decides after a written risk assessment whether to log other automated processing.

The controller must retain a data protection impact assessment for a minimum of two years after concluding the data processing. The controller must also document every breach of data security: the documentation contains a summary of the circumstances of the incidents, their effects and the measures taken, and is retained for a minimum of two years from the time of the report to the FDPIC.

Switzerland's comprehensive private-sector data protection law is the revised Federal Act on Data Protection (nFADP in English, revDSG in German, nLPD in French), SR 235.1, in force since 1 September 2023. It replaces the 1992 FADP and is Switzerland's own statute, aligned with but distinct from General Data Protection Regulation (GDPR).

Processing personal data is not consent-gated by default the way GDPR is opt-in for many bases; the FADP instead prohibits processing that violates a data subject's personality rights unless justified, by consent, an overriding private or public interest, or law.

Controllers ("responsible persons") and processors are distinguished in Article 5 lit. j-k, with duty allocation similar in shape to GDPR's controller and processor split but not identical in mechanics; the Ordinance on Data Protection (ODP) adds implementing detail rather than a separate top-level instrument.

The controller and the processor must each maintain a record of their processing activities.

The controller's record contains at least its identity, the purpose of processing, a description of the categories of data subjects and of processed personal data, the categories of recipients, where possible the retention period for the personal data or the criteria for fixing it and a general description of the data security measures, and, where data are disclosed abroad, the State concerned and the guarantees.

The processor's record names the processor and the controller, the categories of processing carried out for the controller and the same security and foreign-disclosure details. Federal bodies notify the FDPIC of their records, and the Federal Council provides exceptions for legal entities with fewer than 250 employees whose processing poses a negligible risk of harm to the personality of the data subjects.

Transfer abroad is permitted without extra safeguards to a state or international body the Federal Council has found provides an adequate level of protection, a maintained list that includes the EU and EEA states.

Absent adequacy, a transfer needs a safeguard: standard contractual clauses, the EU SCCs work with a Swiss-law addendum, binding corporate rules, or one of the narrower Article 17 derogations, explicit consent, contract necessity, overriding public interest, life or safety, or transfer of data from a public register. This is structurally the General Data Protection Regulation (GDPR) Chapter V mechanism, adequacy or safeguards or a derogation, not a hard localization duty.

The European Commission's own adequacy decision for Switzerland was reconfirmed 15 January 2024, covering the post-revision regime, and Switzerland's own Federal Council lists the EU and EEA as adequate for outbound transfers, so the relationship is adequate in both directions.

Articles 25 to 32 FADP give a person in Switzerland rights of access, rectification, deletion or destruction, objection to ongoing processing at any time, and a narrower portability right under Article 28 limited to data the subject provided and that is processed by automated means, in a standard electronic format, on request. Article 32 additionally lets a person go straight to a civil court to compel correction or have disputed data flagged, independent of the FDPIC complaint route.

The FDPIC (Federal Data Protection and Information Commissioner) is the supervisory authority: it investigates on complaint or ex officio and can order a controller to start, change, suspend, or stop processing, or to delete or destroy data, and can compel appointment of a Swiss representative. It does not hold General Data Protection Regulation (GDPR)-style direct administrative fining power.

Criminal sanctions sit in Articles 60 to 65 FADP instead: up to CHF 250,000 against the individual responsible for a willful violation, prosecuted as an offense, with a CHF 50,000 fallback fine on the company itself only when the responsible individual cannot reasonably be identified within the business.

Private civil actions run in parallel and separately, through Article 32 FADP's direct civil-court route and the general Swiss Code of Obligations and Civil Code personality-rights provisions; a claimant must plead and prove quantifiable loss, there is no Biometric Information Privacy Act (BIPA)-style statutory per-violation damages figure.

Article 5 lit. c FADP defines sensitive personal data as a closed list: data on religious, philosophical, political or trade union views and activities; health data; data on the intimate sphere or racial or ethnic origin; genetic data; biometric data that uniquely identifies a natural person; data on administrative or criminal proceedings and sanctions; and data on social assistance measures. Genetic and biometric data are the two categories the 2023 revision added.

A controller relying on consent for sensitive personal data needs express consent under Article 6 para. 7, and large-scale processing of sensitive personal data or systematic large-scale public-space monitoring triggers a mandatory Data Protection Impact Assessment under Article 22.

There is no dedicated Swiss biometric statute and no statutory biometric-specific retention or destruction schedule; retention is governed by the FADP's general proportionality and storage-limitation principle, Article 6 para. 3-4: keep only as long as the purpose requires, then delete or anonymize.

The controlling recent authority is a live FDPIC enforcement action rather than a statute amendment: on 16 May 2025 the FDPIC concluded its investigation into PostFinance's voice-recognition system and found the processing violated the proportionality principle because voiceprints were being created on an opt-out basis rather than opt-in.

The FDPIC ordered PostFinance to obtain explicit, affirmative consent before creating a voiceprint and to delete every voiceprint created without it, with a compliance deadline of 1 October 2025. PostFinance has appealed to the Federal Administrative Court, and the outcome of that appeal is not established; the FDPIC's order is treated as its currently stated position, not as final.

Article 143bis penalises, on complaint, any person who obtains unauthorised access by means of data transmission equipment to a data processing system that has been specially secured to prevent access, by a custodial sentence not exceeding three years or a monetary penalty; its current wording dates from the Federal Decree of 18 March 2011 implementing the Council of Europe Convention on Cybercrime, in force since 1 January 2012.

Article 143 punishes, with a custodial sentence not exceeding five years or a monetary penalty, obtaining specially secured data not intended for the offender for the offender's own or another's unlawful gain, a narrower, gain-motivated offence.

Article 144bis punishes, on complaint, altering, deleting or rendering unusable data stored or transmitted electronically without authority, escalating to a custodial sentence not exceeding five years and prosecution ex officio where major damage results; its current wording dates from the sentencing-policy harmonisation act in force since 1 July 2023.

Article 24d permits reproducing a work for the purposes of scientific research where the copying is due to the use of a technical process and the works to be copied can be lawfully accessed, with copies made under the article retainable for archiving and backup purposes once the research concludes; the article does not apply to copying computer programs.

Separately, Article 25 permits quoting a published work where the quotation serves as an explanation, reference or illustration and its extent is justified for that purpose, with the source and, where given, the author's name cited.

Article 2's general clause treats as unfair and unlawful any deceptive conduct, or conduct otherwise contrary to good faith, that affects the relationship between competitors or between suppliers and customers.

Article 5 lit. c specifically treats as unfair taking over and exploiting, as such, another's market-ready work product through a technical reproduction process without a reasonable own effort, a misappropriation-style doctrine capable of reaching the wholesale technical copying of a competitor's compiled output, including scraped data.

Intentional unfair competition under Articles 3 to 6 is a criminal offence on complaint, carrying a custodial sentence not exceeding three years or a monetary penalty (Art. 23 para. 1), in its current form since 1 July 2016.

Article 8a(1) StromVG requires network operators, producers and storage operators to take measures for an adequate protection of their installations against cyber threats. Article 8a(2) StromVG allows the Federal Council to provide exceptions and, where necessary to secure supply, to extend the duty to other service providers in electricity supply. Article 8a StromVG was inserted by the Federal Act of 29 September 2023 and took effect on 1 July 2024.

Articles 96e to 96g FDV apply to mobile networks that meet the international technical specifications for fifth-generation networks or later. Article 96e(1) FDV requires mobile concession holders to develop, implement and continuously review an information security management system based on a risk analysis and the security objectives resulting from it.

Article 96e(2) FDV requires mobile concession holders to implement, within that system, a business continuity plan and a security incident management plan. Article 96f(1) FDV requires mobile concession holders to ensure that the state of the art is met by the security-critical installations they operate.

Article 96f(2) FDV requires mobile concession holders to operate their network operations centres and security operations centres only in Switzerland or in states whose legislation ensures adequate data protection. Article 96g(2) FDV allows the Federal Office of Communications, on a well-founded suspicion of a breach, to require a mobile concession holder to undergo an audit by a qualified body at its own cost or to have its installations tested.

The section containing Articles 96d to 96g was inserted with effect from 1 January 2023. Article 60 of the Telecommunications Act allows an undertaking that breaches applicable law to be charged an amount of up to 10 percent of the turnover achieved in Switzerland, averaged over the last three financial years.

Article 96a(2) FDV requires internet access providers to prevent outgoing connections with forged addressing elements by suitable technical means, in order to counter distributed denial-of-service attacks. Article 96a(3) FDV requires an internet access provider that supplies telecommunications installations to customers to configure their security properties according to the recognised rules of technology.

Article 96a(3) FDV requires the provider, while it keeps technical control over those installations, to update their security properties without delay and to replace installations that can no longer be updated where a security risk results. Article 96b FDV requires internet access providers to operate a reporting point that receives reports of unauthorised manipulation of telecommunications installations and to initiate suitable countermeasures within a reasonable time.

The Federal Office of Communications enforces these provisions in cooperation with the Federal Office for Cybersecurity. The section containing Articles 96a to 96c was inserted with effect from 1 January 2023. Article 60 of the Telecommunications Act allows an undertaking that breaches applicable law to be charged an amount of up to 10 percent of the turnover achieved in Switzerland, averaged over the last three financial years.

Article 29(2) FINMASA requires supervised persons to report to FINMA without delay events that are of substantial importance for supervision. Article 3 FINMASA places under financial market supervision the persons who need an authorisation, recognition, admission or registration from the supervisory authority under the financial market acts. FINMA states in its guidance of 7 May 2020 that the duty covers material events arising from successful or partially successful cyber attacks.

Article 48 FINMASA punishes with a fine of up to CHF 100,000 anyone who intentionally fails to comply with a final order of FINMA that refers to the penalty threat of that article.

Article 96 FDV requires providers of telecommunications services to report to the National Alarm Centre without delay disruptions in the operation of their installations and services that can affect at least 10,000 customers. Article 96 FDV also requires the provider to inform the public about such a disruption on a freely accessible website. The current wording of the section containing Article 96 took effect on 1 January 2023.

Article 60 of the Telecommunications Act allows an undertaking that breaches applicable law to be charged an amount of up to 10 percent of the turnover achieved in Switzerland, averaged over the last three financial years.

Article 74a ISG requires the authorities and organisations listed in Article 74b to ensure that cyberattacks on their information technology are reported to the Federal Office for Cybersecurity (BACS). A bound body must make the report within 24 hours of discovering the attack.

A cyberattack must be reported if it endangers the functioning of the critical infrastructure, led to manipulation or exfiltration of information, remained undetected for a long period, or is combined with extortion, threat or coercion. If not all required information is known within the 24 hours, BACS grants a period of 14 days to complete the report.

Article 74h ISG punishes the intentional failure to follow a final BACS order, issued with reference to that provision, with a fine of up to CHF 100,000. The reporting duty took effect on 1 April 2025 and Articles 74g and 74h on 1 October 2025.

The ordinance is issued under Article 8 of the Ordinance on the accessible design of public transport. It sets the technical requirements for the accessible design of the facilities and vehicles of public transport in general, of public bus and trolleybus transport, and of public cable-car transport with more than eight places per vehicle. The undertakings that Ordinance addresses, the public transport undertakings, are the concessioned transport companies.

Audible customer information must be easily understandable for hearing-impaired persons, with suitable sound reproduction in passenger compartments, and where necessary repeated or repeatable on request. Systems for customer information and communication and emergency call systems must be findable, recognisable and usable for hearing-impaired or visually impaired persons.

The material requirements for customer information and communication and for emergency call systems follow the standard SN EN 16584-2:2017. Article 5(2) reads as amended by the ordinance of the Federal Department of the Environment, Transport, Energy and Communications of 20 July 2020, in force since 1 November 2020.

Substitute solutions for customer information and communication and for emergency call systems must be usable in particular through commercially available small devices such as mobile phones. Monitors at the locations of a stop that matter for orientation are as a rule mounted with the top line of content at most 160 cm high, and where several monitors there show the same information at least one of them must meet that condition.

General displays must allow the information to be retrieved acoustically. Ticket machines and validators must in principle be operable by persons with disabilities, and where that is not ensured for particular kinds of disability appropriate substitute solutions must be offered to the groups affected. The operating elements of ticket machines may be at most 130 cm high, and the coin slot may be higher where a cashless payment device sits below that height.

The validator slot of ticket machines and validators may be at most 110 cm high, and a vehicle with ticket machines or validators must have at least one of these devices installed in the wheelchair area. The provisions of the Ordinance apply only to the extent that applying them does not conflict with the proportionality provisions of the Disability Equality Act.

The Act applies to publicly accessible facilities of public transport, including communication systems and ticket purchase, and to vehicles subject to the transport acts the provision lists, except ski lifts and aerial cableways with fewer than nine places per transport unit.

It also applies to services that anyone may in principle use, of private parties, of enterprises holding a railway infrastructure concession or a passenger transport concession, of other concessioned enterprises and of public bodies. Article 3(e) reads as amended by the Federal Act of 28 September 2018 on the Organisation of Rail Infrastructure, in force since 1 July 2020.

A person disadvantaged by a concessioned enterprise or a public body in using a service may demand from the court or the administrative authority that the provider of the service remove or stop the disadvantage. A person whose access to a facility or vehicle of public transport is, for structural reasons, impossible or possible only under aggravating conditions may demand from the competent authority that the concessioned enterprise remove or stop the disadvantage.

The court or authority does not order removal of a disadvantage where the benefit to be expected for persons with disabilities is out of proportion, in particular, to the economic effort, to environmental, nature and heritage interests, or to traffic and operational safety. Where it declines to order removal on that ground, the court or authority obliges the concessioned enterprise or the public body to offer an appropriate substitute solution.

Communication systems and ticketing must be offered in a form suited to persons with disabilities at the latest ten years after the entry into force of the Act.

Article 9 provides that the federal administrative units, the organisations and undertakings named in the Government and Administration Organisation Act, and the organisations and undertakings operating under a federal concession take the necessary structural and technical measures to make their services accessible to persons with disabilities. They equip their machines in particular so that persons with disabilities can use them.

They ensure that persons who cannot operate technical aids independently because of their disability receive the necessary help. The provisions of the Ordinance on the accessible design of public transport remain reserved. Article 10(1) provides that information, communication and transaction services over the internet must be accessible to persons with speech, hearing and visual impairments and to persons with motor impairments.

For that purpose internet offerings must be set up in accordance with the international IT standards, in particular the guidelines of the World Wide Web Consortium on access to web pages, and, subsidiarily, the national IT standards.

Article 10(2) assigns the issuing of the necessary guidelines to the digital transformation and ICT steering sector of the Federal Chancellery for the federal administrative units and to the responsible organs of the other bodies and of the organisations and undertakings operating under a federal concession, each for its own field.

The Ordinance applies to facilities and vehicles of public transport and to the services of public transport undertakings that anyone may use. Public transport undertakings are the concessioned transport companies. The facilities, vehicles and services of public transport include, in particular, information, communication, ticket-purchase and reservation systems and emergency call systems.

Persons with disabilities who are able to use public space autonomously should also be able to claim public transport services autonomously. Where autonomy cannot be ensured by technical measures, the undertakings provide the necessary assistance by deploying staff. The undertakings dispense where possible with an advance-registration requirement that applies only to persons with disabilities.

Public transport undertakings provide information on the accessibility of their stops on a publicly accessible information platform operated by a body the Federal Office of Transport commissions, and keep it under continuous review; for undertakings other than the infrastructure managers of interoperable lines the information was due by 31 December 2023.

Facilities and vehicles serving passengers that are directly and functionally connected with public transport must be safely findable, accessible and usable for persons with disabilities, and a sufficiently large part of the passenger areas must be accessible to passengers with disabilities. Wheelchair-accessible services and stops should, where possible, be appropriately shown in the network and timetable plans.

Facilities that passengers operate, door-opening and door-closing systems and stop-request systems must be designed to suit persons with disabilities, and operating elements should be standardised. The Federal Department of the Environment, Transport, Energy and Communications issues the provisions on the technical requirements for the design of communication systems and ticket issuing, among other facilities.

Article 6 provides that private parties who offer services to the public must not discriminate against persons with disabilities on the ground of their disability. Article 2(4) states that a disadvantage in using a service exists when using it is impossible for persons with disabilities or possible only under aggravating conditions.

The Ordinance on the Elimination of Disadvantages of Persons with Disabilities provides that, for Article 6 and Article 8(3) of the Act, discriminating means treating persons with disabilities in a particularly blatant way differently and to their disadvantage, with the aim or effect of degrading or excluding them. Article 8(3) provides that a person discriminated against within the meaning of Article 6 may apply to a court for compensation. The compensation is at most CHF 5,000.

In fixing the compensation the court takes account of the circumstances, the seriousness of the discrimination and the value of the service. Proceedings under Articles 7 and 8 are free of charge, except that court costs before the Federal Supreme Court follow the Federal Supreme Court Act, and costs may be imposed on a party who acts recklessly or frivolously.

Disability organisations of nationwide importance that have existed for at least ten years may assert legal claims arising from disadvantages that affect a large number of persons with disabilities. The organisations the Federal Council designates have a right of appeal in civil proceedings to establish discrimination within the meaning of Article 6.

The JSFVG applies to film and video game industry actors and to providers of platform services, in each case within their economic activity, and covers the requirements for age labelling, content descriptors and age verification (Art. 4 lit. a), measures applying to platform services on which users upload and retrieve films or video games (Art. 4 lit. b), and the process for declaring an industry branch's own age-classification code binding on actors who are not members of the branch organisation that wrote it (Art. 4 lit. c, 9-19).

A binding code must set at least five age tiers, with the highest reserved for adults, and must cover age-labelling and age-verification rules. The Federal Assembly passed the Act on 30 September 2022.

Only Articles 1-5, 9-13, 15-19, 29, 32, 37-39 and 41, covering the definitions, scope, and the branch-code binding-declaration mechanism, entered into force on 1 January 2025; the remaining provisions, including Articles 6-8, which set out the age-labelling, content-descriptor and age-verification requirements directly, are left to be brought into force at a later time. The provisions this entry describes come into force on different days, and not all of them have commenced.

Article 2 paragraph 1 of the Federal Act on Copyright and Related Rights defines works as literary and artistic intellectual creations with individual character, irrespective of their value or purpose. Article 2 paragraph 3 provides that computer programs are also works. Article 10 paragraph 1 gives the author the exclusive right to decide whether, when and how his work is used.

Article 10 paragraph 2 lists the author's rights, including to produce copies of the work, to offer, transfer or otherwise distribute copies of it, and to make it available in such a way that persons may access it from a place and at a time individually chosen by them. Under article 10 paragraph 3 the author of a computer program also has the exclusive rental right. The Act came into force on 1 July 1993.

Article 8 paragraph 1 of the Federal Act on the Protection of the Swiss Coat of Arms and Other Public Signs provides that the Swiss coat of arms, the coats of arms of the cantons, the communes and other public authorities recognised under cantonal law, and signs that could be confused with them, may only be used by the public body to which they belong.

Article 9 paragraph 1 provides that official designations, and terms with which they could be confused, may only be used on their own by the public body to which they belong. Under article 6 the official designations include any terms that imply a Swiss authority or an official or semi-official activity.

Article 15 paragraph 1 provides that coats of arms, flags and other foreign state emblems, signs that could be confused with them, and national figurative and word signs of foreign states may only be used by the state to which they belong.

Under article 28 paragraph 1 a person who wilfully and unlawfully affixes protected public signs to items, uses an official designation, or uses a domestic or foreign national figurative or word sign is liable to a custodial sentence not exceeding one year or a monetary penalty. The Act came into force on 1 January 2017.

Article 47 paragraph 1 of the Federal Act on the Protection of Trade Marks and Indications of Source defines indications of source as direct or indirect references to the geographical origin of goods or services, including references to their characteristics or the quality associated with their origin.

Article 47 paragraph 3 prohibits using incorrect indications of source, denominations that may be confused with an incorrect indication of source, and a name, a company name, an address or a trade mark associated with goods or services of a different origin where this could be misleading.

Under article 64 paragraph 1 a person who wilfully uses an incorrect indication of source, uses a denomination that can be confused with one, or creates a risk of deception by using a name, a company name, an address or a trade mark associated with goods or services of a different origin is liable to a custodial sentence not exceeding one year or a monetary penalty. Article 47 paragraph 3 letter c and article 64 were amended by the Federal Act of 21 June 2013, in force since 1 January 2017.

Article 2 paragraph 4 of the Federal Act on Copyright and Related Rights protects drafts, titles and parts of works, insofar as they are intellectual creations with an individual character. Article 25 paragraph 1 allows published works to be quoted if the quotation serves as an explanation, a reference or an illustration and the extent of the quotation is justified for such purpose.

Under article 25 paragraph 2 the quotation must be designated as such and the source given, and where the source indicates the name of the author, the name must also be cited. Article 28 paragraph 2 allows short excerpts from press articles or from radio and television reports to be reproduced, distributed, broadcast or retransmitted for the purposes of information about current affairs, with full reference to the relevant excerpt as well as the source.

Article 24a permits the making of temporary copies of a work if they are transient or incidental, represent an integral and essential part of a technological process, have as their sole purpose to enable a transmission of the work in a network between third parties by an intermediary or a lawful use of the work, and have no independent economic significance. Article 24a was inserted with effect from 1 July 2008. The Act came into force on 1 July 1993.