FADP (revised)

Switzerland's revised Federal Act on Data Protection took effect September 1, 2023, replacing the 1992 law and bringing Swiss rules closer to the GDPR. It protects natural persons only, applies to processing that has an effect in Switzerland even when it happens abroad, and introduces privacy by design and by default, a duty to inform at collection, records of processing, and impact assessments for high-risk processing. It defines profiling and high-risk profiling separately, and where a private company relies on consent for high-risk profiling, the consent must be express. The Federal Data Protection and Information Commissioner supervises. Unlike the GDPR, sanctions are criminal fines of up to CHF 250,000 imposed on the responsible individuals rather than the company, for intentional breaches of duties such as the duty to inform. Cookie rules sit separately in Switzerland's telecommunications law.