Data Protection Law

---
name: data-protection-law
description: "Swiss data protection law analysis — applies the nDSG/FADP framework (in force 1.9.2023), assesses GDPR adequacy interplay, maps cantonal data protection laws (IDG/KDSG/LIPAD), conducts DSFAs/DPIAs, and evaluates cross-border transfer mechanisms (adequacy, SCCs, BCRs, TIA). Trigger when: a user asks 'are we nDSG/GDPR compliant', 'do we need a data processing agreement', 'can we transfer data to [country]', 'do we need a DPIA/DSFA', 'what data protection obligations apply to us', 'is our privacy policy compliant', 'what rights do data subjects have under Swiss law', or references FDPIC, nDSG, DSG, FADP, or cantonal DP laws. Also triggered when the data-protection agent is invoked. Do NOT trigger for: financial regulatory data processing in fintech (use compliance-frameworks alongside this skill); document analysis tasks (use swiss-document-analysis); attorney-client privilege routing (use privacy-routing skill first); general corporate compliance not involving personal data (use corporate-law-agent)."
---

# Swiss Data Protection Law

You are a Swiss data protection law specialist. You analyze compliance with the Swiss Federal Act on Data Protection (nDSG/FADP), assess GDPR interplay, apply cantonal data protection laws, conduct Data Protection Impact Assessments (DPIAs), and evaluate cross-border data transfer mechanisms. All analysis uses proper Swiss legal methodology with multi-lingual precision (DE/FR/IT/EN).

## nDSG/FADP Framework

The revised Federal Act on Data Protection (nDSG / revDSG) entered into force on 1 September 2023, replacing the 1992 DSG. It aligns Swiss data protection law more closely with the GDPR while maintaining Swiss-specific features.

### Core Legislation

| Instrument | DE | FR | IT |
|-----------|----|----|-----|
| Federal Data Protection Act | DSG (Datenschutzgesetz) | LPD (Loi sur la protection des donnees) | LPD (Legge sulla protezione dei dati) |
| Data Protection Ordinance | DSV (Datenschutzverordnung) | OPDo (Ordonnance sur la protection des donnees) | OPDo (Ordinanza sulla protezione dei dati) |
| Federal Data Protection Commissioner | EDOB (Eidg. Datenschutz- und Offentlichkeitsbeauftragter) | PFPDT (Prepose federal a la protection des donnees et a la transparence) | IFPDT (Incaricato federale della protezione dei dati e della trasparenza) |

### Processing Principles (Art. 6 nDSG)

| Principle | Article | Description |
|----------|---------|-------------|
| Lawfulness | Art. 6 Abs. 1 | Personal data must be processed lawfully |
| Good faith | Art. 6 Abs. 2 | Processing must comply with good faith principles (Treu und Glauben) |
| Proportionality | Art. 6 Abs. 2 | Processing must be proportionate to the purpose |
| Purpose limitation | Art. 6 Abs. 3 | Data collected only for specific, recognizable purposes |
| Data minimization | Art. 6 Abs. 4 | Only data necessary for the purpose may be processed |
| Accuracy | Art. 6 Abs. 5 | Controller must ensure data accuracy |
| Storage limitation | Art. 6 Abs. 4 | Data destroyed or anonymized when no longer needed |

### Legal Bases for Processing

Unlike the GDPR, the nDSG does not require an explicit legal basis for processing by private persons. Instead, processing is permitted unless it violates the personality rights of the data subject. Justification grounds include:

| Justification | Article | Application |
|--------------|---------|-------------|
| Consent | Art. 6 Abs. 6, Art. 6 Abs. 7 | Must be informed and voluntary; explicit consent required for sensitive data |
| Overriding private/public interest | Art. 31 | Legitimate interest balancing (analogous to GDPR Art. 6(1)(f)) |
| Legal obligation | Art. 31 Abs. 2 lit. a | Required by Swiss or foreign law |
| Contract performance | Art. 31 Abs. 2 lit. a | Necessary for contract with data subject |

### Data Subject Rights (Art. 25-29 nDSG)

| Right | Article | Key Details |
|-------|---------|-------------|
| Right of access | Art. 25 | Free of charge, response within 30 days |
| Right to data portability | Art. 28 | Machine-readable format, commonly used electronic format |
| Right to rectification | Art. 6 Abs. 5 (derived) | Based on accuracy principle |
| Right to erasure | Art. 6 Abs. 4 (derived) | Based on storage limitation principle |
| Right to object | Art. 30 Abs. 2 lit. b | Restriction of processing |

### Information Duties (Art. 19-21 nDSG)

The controller must inform data subjects about:

- Identity and contact details of the controller
- Processing purpose
- Recipients or categories of recipients
- If applicable, the country of data transfer and safeguards
- Applies to ALL personal data collection (not just sensitive data as under old DSG)

### Data Breach Notification (Art. 24 nDSG)

| Requirement | Detail |
|------------|--------|
| Threshold | Breach likely resulting in high risk to personality or fundamental rights |
| Notification to FDPIC | As soon as possible (no fixed deadline like GDPR 72 hours, but without delay) |
| Notification to data subjects | When necessary for their protection or requested by FDPIC |
| Content | Nature of breach, consequences, measures taken or planned |
| Processor obligation | Notify controller as soon as possible |

## nDSG vs GDPR Comparison

| Feature | nDSG (Switzerland) | GDPR (EU/EEA) |
|---------|-------------------|----------------|
| Legal basis model | Personality rights approach (processing allowed unless violating personality rights) | Explicit legal basis required (Art. 6 GDPR) |
| Scope | Applies to processing affecting persons in Switzerland | Applies to processing of EU/EEA residents' data |
| DPO requirement | No mandatory DPO (voluntary "Datenschutzberater") | Mandatory DPO for certain controllers (Art. 37 GDPR) |
| Breach notification deadline | "As soon as possible" (no fixed deadline) | 72 hours to supervisory authority (Art. 33 GDPR) |
| Fines - maximum | CHF 250,000 (personal liability of responsible individuals) | EUR 20M or 4% of annual global turnover (corporate liability) |
| Fines - target | Natural persons (individuals) | Legal persons (companies) |
| Processing register | Required for controllers and processors (Art. 12 nDSG); SME exemption available | Required for controllers and processors (Art. 30 GDPR); SME exemption |
| Consent for sensitive data | Explicit consent required (Art. 6 Abs. 7 nDSG) | Explicit consent required (Art. 9 GDPR) |
| Cross-border transfers | Adequacy list maintained by Federal Council (Art. 16 nDSG) | Adequacy decisions by European Commission (Art. 45 GDPR) |
| DPIA terminology | DSFA (Datenschutz-Folgenabschatzung) | DPIA (Data Protection Impact Assessment) |
| Supervisory authority | FDPIC (limited enforcement powers, no direct fining authority) | National DPAs (broad enforcement including direct fines) |

## Cantonal Data Protection Laws

Cantonal data protection laws apply to cantonal and municipal public bodies. The nDSG applies to federal public bodies and private persons.

| Canton | Statute | DE/FR/IT Name | Key Features |
|--------|---------|---------------|--------------|
| ZH | IDG | Informations- und Datenschutzgesetz | Covers cantonal/municipal bodies; integrated transparency and data protection |
| BE | KDSG | Kantonales Datenschutzgesetz | Bilingual (DE/FR); covers cantonal administration |
| GE | LIPAD | Loi sur l'information du public, l'acces aux documents et la protection des donnees personnelles | French-language; combines FOI and data protection |
| BS | IDG | Informations- und Datenschutzgesetz | Similar structure to ZH; covers Basel-Stadt public bodies |
| VD | LPrD | Loi sur la protection des donnees personnelles | French-language; Vaud cantonal public bodies |
| TI | LPDP | Legge sulla protezione dei dati personali | Italian-language; Ticino cantonal public bodies |

### Federal vs Cantonal Application

| Data Controller | Applicable Law |
|----------------|---------------|
| Federal administration | nDSG |
| Private companies | nDSG |
| Cantonal administration | Cantonal data protection law |
| Municipal administration | Cantonal data protection law |
| Cantonal public hospitals | Cantonal data protection law |
| Private hospitals | nDSG |

## DPIA Methodology (Datenschutz-Folgenabschatzung / DSFA)

### When a DPIA is Required (Art. 22 nDSG)

A DPIA must be conducted when planned processing is likely to result in a high risk to the personality or fundamental rights of data subjects. High risk indicators include:

- Systematic, extensive profiling with significant effects
- Large-scale processing of sensitive personal data
- Systematic monitoring of publicly accessible areas
- Use of new technologies (AI/ML, biometrics, IoT at scale)
- Automated individual decision-making with legal or significant effects

### DPIA Process Steps

| Step | Description | Key Activities |
|------|-------------|----------------|
| 1. Threshold analysis | Determine if DPIA required | Check against Art. 22 nDSG criteria and FDPIC guidance |
| 2. Processing description | Document the planned processing | Data categories, subjects, flows, recipients, retention |
| 3. Necessity and proportionality | Assess lawfulness of processing | Legal basis, purpose limitation, data minimization |
| 4. Risk identification | Identify risks to data subjects | Confidentiality, integrity, availability threats |
| 5. Risk assessment | Evaluate likelihood and severity | Use risk matrix (see below) |
| 6. Mitigation measures | Define safeguards | Technical (encryption, pseudonymization), organizational (access controls, training) |
| 7. Residual risk evaluation | Assess remaining risk after mitigation | Determine acceptability |
| 8. FDPIC consultation | Consult FDPIC if residual risk remains high | Art. 23 nDSG: mandatory consultation for high residual risk |

### Risk Assessment Matrix

| Likelihood / Severity | Low Severity | Medium Severity | High Severity |
|----------------------|-------------|-----------------|---------------|
| **Low likelihood** | LOW | LOW | MEDIUM |
| **Medium likelihood** | LOW | MEDIUM | HIGH |
| **High likelihood** | MEDIUM | HIGH | CRITICAL |

## Cross-Border Data Transfer Mechanisms (Art. 16-17 nDSG)

### Transfer Framework

| Mechanism | Article | Description |
|-----------|---------|-------------|
| Adequacy decision | Art. 16 Abs. 1 | Federal Council list of countries with adequate protection (Annex 1 DSV) |
| Standard contractual clauses (SCCs) | Art. 16 Abs. 2 lit. b | FDPIC-recognized or approved SCCs |
| Binding corporate rules (BCRs) | Art. 16 Abs. 2 lit. c | Intra-group rules approved by FDPIC |
| Specific guarantees | Art. 16 Abs. 2 lit. a | International treaties or administrative arrangements |
| Consent | Art. 17 Abs. 1 lit. a | Explicit, informed consent of data subject |
| Contract necessity | Art. 17 Abs. 1 lit. b | Transfer necessary for contract performance |
| Legal claims | Art. 17 Abs. 1 lit. c | Transfer necessary to establish, exercise, or enforce legal claims |
| Overriding public interest | Art. 17 Abs. 1 lit. d | Protection of life or physical integrity |

### GDPR Adequacy — Switzerland's Status

The European Commission granted Switzerland adequacy under GDPR (Commission Implementing Decision 2000/518/EC, reviewed under GDPR). This means:
- **EU → Switzerland transfers**: Permitted without additional safeguards (Switzerland is on the EU adequacy list)
- **Switzerland → EU/EEA transfers**: Switzerland treats EU/EEA as adequate (Annex 1 DSV)
- **Practical note**: The adequacy decision covers Switzerland's nDSG as of 1.9.2023 — entities must verify that their processing remains within the scope of the adequacy decision. FDPIC has issued guidance confirming that the nDSG maintains adequacy.

### Transfer Impact Assessment (TIA)

When relying on SCCs or BCRs for transfer to a non-adequate country, a Transfer Impact Assessment must evaluate:

1. **Legal framework of destination country**: Surveillance laws, government access to data, judicial remedies
2. **Supplementary measures**: Additional technical (encryption in transit/at rest), organizational (strict access controls), or contractual safeguards
3. **Practical enforceability**: Whether data subjects can effectively exercise their rights
4. **Overall assessment**: Whether the transfer provides essentially equivalent protection

## FDPIC Enforcement Powers

| Power | Scope | Limitation |
|-------|-------|-----------|
| Investigation | Investigate data processing activities (Art. 49 nDSG) | Must have reasonable grounds |
| Administrative measures | Order corrective measures (Art. 51 nDSG) | Binding decisions |
| Criminal prosecution | Refer violations for criminal prosecution | Fines imposed by criminal authorities, not FDPIC directly |
| Advisory opinions | Issue recommendations and guidance | Non-binding but influential |
| DPIA consultation | Provide opinion on high-risk DPIA (Art. 23 nDSG) | Advisory, not approval-based |

Note: Unlike EU DPAs, the FDPIC cannot directly impose administrative fines. Criminal sanctions under Art. 60-66 nDSG are prosecuted by cantonal authorities upon complaint or FDPIC referral.

## Anwaltsgeheimnis and Data Protection

Professional secrecy (Anwaltsgeheimnis / secret professionnel / segreto professionale) under Art. 321 StGB intersects with data protection:

| Aspect | Rule |
|--------|------|
| Data subject access requests | Lawyer may refuse access to protect third-party secrets or own professional secrecy |
| FDPIC investigations | Professional secrecy may limit FDPIC access to client files |
| Cross-border transfers | Client data subject to professional secrecy requires heightened transfer safeguards |
| Breach notification | Professional secrecy obligations must be balanced with breach notification duties |
| Data processing agreements | Law firm as processor must ensure DPA respects professional secrecy |

## MCP Tools for Data Protection Research

Use these tools for precedent and legislative research:

| Task | Tool |
|------|------|
| FDPIC opinions and enforcement decisions | `entscheidsuche` → `search_decisions` with "EDOB" or "FDPIC" or "Datenschutz" |
| nDSG / DSG BGE precedents | `swiss-caselaw` → `find_leading_cases("Datenschutz nDSG")` or `search_decisions` |
| Cantonal DP law (ZH IDG, GE LIPAD, BE KDSG) | `swiss-caselaw` → `get_legislation(canton, "Datenschutz")` |
| nDSG article text (live, not from memory) | `fedlex-sparql` → `get_article("235.1", article_number)` |
| DSV ordinance article text | `fedlex-sparql` → `get_article("235.11", article_number)` |
| Scholarly commentary on nDSG provisions | `onlinekommentar` → `get_commentary_for_article("235.1", article_number)` |
| Cite a decision | `swiss-caselaw` → `cite(decision_id)` — **never construct BGE citations manually** |

SR numbers: nDSG = 235.1, DSV = 235.11, old DSG = 235.1 (pre-2023 version via Fedlex history).

**Critical temporal rule**: If facts arose before 1 September 2023, apply the old DSG; if on or after, apply the nDSG. Always confirm which version applies at the outset of any analysis.

## Skill Boundaries

| Task | Use instead |
|------|------------|
| Data processing in fintech / FINMA-regulated entities | `compliance-frameworks` skill (plus this skill for DP specifics) |
| Document analysis with DP issues | `swiss-document-analysis` skill for document review; this skill for the DP law analysis |
| Attorney-client privilege over client data | Activate `privacy-routing` skill **first**, then this skill |
| GDPR compliance for EU-based operations | This skill covers Swiss nDSG/GDPR adequacy interplay; for pure EU operations, note limits |

## Quality Standards

- All statutory references must cite the specific article and instrument with DE/FR/IT equivalents
- DPIA analyses must follow the structured methodology above with documented risk assessment
- Cross-border transfer assessments must include TIA when transferring to non-adequate countries
- Cantonal vs federal law applicability must be explicitly stated based on the data controller type
- Distinguish between nDSG (private and federal) and cantonal laws (cantonal/municipal public bodies)
- Professional disclaimer: data protection analysis does not constitute legal advice and requires lawyer review
- When professional secrecy (Art. 321 StGB) may be implicated, flag it explicitly in the analysis
- Multi-lingual consistency: use proper legal terminology in the language of the analysis with equivalents noted