Switzerland and the European Union: when both data protection regimes apply together

A company established in Switzerland that runs a website, sends a newsletter and works with a German service provider will invariably ask the same question at the moment of signing: which law applies to us? The answer most often heard on the market, “the GDPR does not concern you, you are in Switzerland”, is wrong in most cases. The second most common answer, “everything has to be done twice”, is wrong as well.

What triggers Swiss law

The Federal Act on Data Protection (FADP) applies to the processing of personal data relating to natural persons by private persons or federal bodies. Its territorial scope is defined by effects: it applies to situations that have an effect in Switzerland, even if they originated abroad.¹

A Swiss company that processes data from Switzerland is therefore subject to it beyond dispute. So is a foreign provider whose processing produces effects in Switzerland, and the Act requires it, in certain configurations, to appoint a representative in Switzerland.²

What triggers the European Regulation

The Regulation applies first to processing carried out in the context of the activities of an establishment of a controller or processor in the territory of the Union, whether or not the processing takes place in the Union.³

It applies next, and this is the channel that concerns Swiss companies, to the processing of data of persons who are in the territory of the Union by a controller or processor not established there, where the processing activities relate to offering goods or services to those persons, whether or not a payment is required, or to monitoring their behaviour, as far as that behaviour takes place within the Union.⁴

Two expressions deserve careful weighing. “Offering” presupposes an intention to target: recital 23 of the Regulation rules out the mere accessibility of a website from the Union, and retains indicators such as the use of a language or a currency of a Member State together with the possibility of ordering in that language, or the mention of customers established in the Union. “Monitoring of behaviour” covers in particular the tracking of persons on the internet for profiling purposes, which includes everyday uses such as audience measurement and retargeting.

There is finally a third channel, indirect but very common: your service provider. An advertising network, a mailing platform or a hosting company established in the Union is subject to the Regulation in its own right, and it imposes the corresponding obligations on you by contract. You are then not subject to the Regulation by law but by contract, which produces much the same work.

The overlap, and why it does not double the burden

The two texts belong to the same generation and share most of their architecture: lawfulness and proportionality, transparency, security, the rights of individuals, the rules on processors, the regulation of communications abroad. The efficient reflex is to treat the more demanding of the two as the working standard, and to check separately only the points where Swiss law adds something or diverges.

Those points are few, and they are the reason this article exists.

The record of processing activities

Both regimes require one, but the exemption differs. The Regulation exempts organisations with fewer than 250 employees, unless the processing is likely to result in a risk to the rights and freedoms of individuals, is not occasional, or includes special categories of data or data relating to criminal convictions.⁵ This triple exception is so wide that the exemption almost never applies to a regular online activity.

Swiss law also provides an exemption for undertakings with fewer than 250 employees whose processing poses a limited risk of harm to personality, the conditions of which are set by the Federal Council.⁶

Practical conclusion: a small Swiss company may be exempted by Swiss law and bound by European law, for the same processing. The record must therefore be kept, and it is kept once.

Notification of personal data breaches

The Regulation requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to rights and freedoms.⁷

Swiss law requires the controller to report breaches to the Federal Commissioner as soon as possible, where they are likely to result in a high risk to the personality or fundamental rights of the data subject.⁸ No fixed deadline, and not the same trigger threshold either.

A company subject to both regimes therefore aligns on 72 hours and on the European threshold, which is lower. This is the typical case in which the more demanding rule absorbs the other.

Communication of data abroad

Here the two systems work symmetrically. Swiss law makes the communication of data abroad conditional on the recipient State ensuring an adequate level of protection, the list of States concerned appearing in an annex to the Ordinance; failing that, the communication requires appropriate safeguards (standard clauses, binding corporate rules or an international treaty), or one of the exceptions provided by the Act.⁹

The Regulation does the same with its adequacy decisions, its appropriate safeguards and its derogations.¹⁰

In the direction from the Union to Switzerland, the question was settled long ago: the Commission recognised that Switzerland ensures an adequate level of protection in its Decision 2000/518/EC. That decision was not replaced in the review conducted by the Commission; report COM(2024) 7 final of 15 January 2024 confirmed that the level of protection remains adequate and that the decisions concerned remain in place.¹¹ A flow of data from a European provider to a Swiss company therefore requires no additional transfer instrument.

In the opposite direction the same logic applies: the States of the European Economic Area are among those whose legislation ensures adequate protection within the meaning of Swiss law.

There remains a third case, the only one that requires work: the European provider that uses sub-processors outside the European Economic Area. The chain then moves one step further, and it is for the contract to cover it.

Sensitive data

Swiss law defines sensitive data in a way that is close to, but not identical with, the Regulation. It includes in particular data on religious, philosophical, political or trade union views or activities, on health, the intimate sphere or racial or ethnic origin, genetic data, biometric data that uniquely identifies a natural person, data on administrative and criminal proceedings or sanctions, and data on social assistance measures.¹² This last category has no exact equivalent in the list in Article 9 of the Regulation.

For an information or services website, the consequence is limited but real: a form that collects a social assistance situation processes sensitive data under Swiss law, with the consequences that follow, without necessarily processing sensitive data within the meaning of European law.

The penalty, and who bears it

This is the most misunderstood divergence, and the most important to state clearly.

The Regulation provides for administrative fines imposed on the company, of up to twenty million euros or four per cent of total worldwide annual turnover, whichever is higher.¹³

Swiss law does not work that way. It provides for criminal penalties, imposed on complaint, of up to 250,000 francs, and they target the natural person responsible for the offence, not the company.¹⁴ The company itself is fined, at a ceiling set far lower, only where identifying the punishable person would require investigative measures disproportionate to the offence.¹⁵

The Swiss maximum is therefore far lower, and the personal risk far higher. A manager who compares the two ceilings and concludes that Swiss law is gentler is making the wrong comparison: they are looking at the sum and not at the person who pays it.

A method, to finish

Three steps are enough to keep to both regimes without keeping to them twice.

First step: qualify once and for all. Determine, in writing, whether the activity falls under the Regulation by virtue of Article 3(2), and for what reason. This one-page note is what will spare you from reopening the debate with every new provider.

Second step: keep a single set of documents, calibrated on the highest requirement: one record, one privacy policy, one procedure for answering requests, one breach procedure running to 72 hours.

Third step: isolate the four points where Swiss law cannot be absorbed: the definition of sensitive data, the representative in Switzerland for foreign providers, notification to the Federal Commissioner, and the criminal nature of the penalty. These are the only places where European compliance is not enough.

Another instalment concerns cookies, where the two regimes clearly diverge: see Cookie banners in Switzerland. Two other articles in the review extend this method: the first explains who is a controller and who is a processor, the second sets out the eight items of a processor contract.

Notes

1. Federal Act on Data Protection (SR 235.1), Arts. 2 and 3. ↩

2. Federal Act on Data Protection (SR 235.1), Art. 14. ↩

3. Regulation (EU) 2016/679, Art. 3(1). ↩

4. Regulation (EU) 2016/679, Art. 3(2). ↩

5. Regulation (EU) 2016/679, Art. 30(5). ↩

6. Federal Act on Data Protection (SR 235.1), Art. 12(5), and Data Protection Ordinance (SR 235.11). ↩

7. Regulation (EU) 2016/679, Art. 33(1). ↩

8. Federal Act on Data Protection (SR 235.1), Art. 24(1). ↩

9. Federal Act on Data Protection (SR 235.1), Arts. 16 and 17, and Data Protection Ordinance (SR 235.11), Annex 1. ↩

10. Regulation (EU) 2016/679, Arts. 45, 46 and 49. ↩

11. Decision 2000/518/EC, and Commission report COM(2024) 7 final of 15 January 2024. ↩

12. Federal Act on Data Protection (SR 235.1), Art. 5(c). ↩

13. Regulation (EU) 2016/679, Art. 83(5). ↩

14. Federal Act on Data Protection (SR 235.1), Arts. 60 to 63. ↩

15. Federal Act on Data Protection (SR 235.1), Art. 64. ↩