Data protection and AI: Switzerland’s Federal Act on Data Protection (FADP) and AI: what Swiss companies need to consider.
FADP & AI: principles, processing by processors, disclosure abroad, sensitive personal data, transparency, automated decisions – in practice, not legal advice.
In short: Technical measures can support compliance with the FADP. They do not replace a case-by-case review of purpose, legal basis, contract, data location, transparency and risks.
Data protection is a question of architecture.
When personal data is processed, lawfulness, proportionality, purpose limitation, accuracy and security must be checked, among other things. Depending on the role and data flow, contracts, information for data subjects and the conditions for disclosure abroad may be required.
Technical measures can support data classes, permissions, approval points and traceability. Whether local processing or a Swiss private cloud is sufficient must be assessed for the specific case. This article does not replace legal advice.
What the FADP requires – and how the platform supports it.
| FADP topic | Requirement | Technical measure |
|---|---|---|
| Processing by processors (Art. 9) | Check roles, contract and data security | Document providers, access and data flows |
| Disclosure abroad (Art. 16 et seq.) | Check the country, level of protection and necessary safeguards | Technically limit data location and model access |
| Sensitive personal data (Art. 5) | Assess increased risks case by case | Permissions, encryption and a suitable operating model |
| Automated individual decision (Art. 21) | Check the legal requirements case by case | Provide for an approval point by a person |
| Data security (Art. 8) | Define appropriate measures | Access control, traceability and backup |
| Transparency (Art. 19) | Check duties to inform case by case | Notices for phone, email or chat assistants |
Checklist
- Which personal data is involved, and which data is sensitive personal data?
- Where is it processedCountry, provider, contract?
- Are there automated decisions without a person involved? Then build in approval points.
- Are permissions set in the knowledge system?
- Is the processing documented in a traceable way?
- Legal review by a specialist for sensitive personal data.
What this article is based on.
- Federal Act on Data Protection (FADP) of 25 September 2020
- Federal Data Protection and Information Commissioner (FDPIC), “AI and data protection”: https://www.edoeb.admin.ch/de/ki-und-datenschutz
- FDPIC, “Data processing in the cloud”: https://www.edoeb.admin.ch/de/datenbearbeitungen-in-der-cloud
- FDPIC, “Disclosure of data abroad”: https://www.edoeb.admin.ch/de/bekanntgabe-von-personendaten-ins-ausland
Products, Labs and case studies.
Frequently asked questions: FADP and AI
May we use a public AI service in our company?
That depends on the type of data, purpose, provider, contract, data location, transparency and risks. The specific use must be reviewed from a legal and technical perspective.
Is this legal advice?
No. The article explains how things work in practice; the legal review of an individual case is done by a specialist.
Have a specific process assessed.
The AI potential assessment examines the benefits, prerequisites and risks of the process.