Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Switzerland sits outside the EU/EEA and is not directly bound by GDPR, running its own revised Federal Act on Data Protection (nFADP) enforced by the FDPIC, with a fine mechanism that targets responsible individuals, not companies, and a 'notify as soon as possible' breach standard rather than a fixed 72-hour clock.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Switzerland's own data protection statute, substantially revised and in force since 1 September 2023. Not an EU instrument, Switzerland is not an EU/EEA member and GDPR does not apply to it directly, though the nFADP was designed to be broadly compatible with GDPR to preserve the EU's adequacy finding for Switzerland.
SourceSince 1 April 2025, operators of critical infrastructure (energy and drinking-water suppliers, transport companies, cantonal/communal public administrations, etc.) must report cyberattacks to the Federal Office for Cybersecurity (BACS, formerly the NCSC) within 24 hours of discovery, with a full report due within 14 days, separate from nFADP personal-data-breach notification.
SourceNo fixed statutory hour limit
The nFADP does not set a fixed hour deadline. Under Article 24, controllers must notify the FDPIC 'as soon as possible' after determining that a data security breach is likely to result in a high risk to a data subject's personality or fundamental rights, a qualitative standard rather than the EU GDPR's fixed 72-hour clock. Separately, critical-infrastructure operators face a hard 24-hour deadline for cyberattack reports to BACS under the Information Security Act, a different obligation.
Notify: FDPIC
SourcePublished legal maximums, not a personalized estimate, not legal advice.
revised Federal Act on Data Protection (nFADP)
CHF 250,000
Structurally unlike GDPR: fines fall on the responsible INDIVIDUAL (e.g. a specific manager or employee), not the company as an entity, and only for intentional violations, there are no criminal penalties for negligent breaches. The company can only be fined directly (and only up to CHF 50,000) where identifying the responsible individual would require disproportionate effort. Cantonal prosecutors enforce this, not the FDPIC.
SourceInformation Security Act, critical infrastructure reporting failure
CHF 100,000
A separate penalty track from nFADP: critical-infrastructure operators (and responsible individuals personally) who fail to report a cyberattack to BACS within the required window face fines of up to CHF 100,000, enforced from 1 October 2025.
SourceNot applicable , as of 2026-09-08
NIS2 is EU law and does not apply to Switzerland, which is not an EU/EEA member. Switzerland instead runs its own critical-infrastructure cyberattack-reporting regime under the Information Security Act, operationalized by the Federal Office for Cybersecurity (BACS, formerly the NCSC): mandatory reporting within 24 hours of discovering a qualifying cyberattack, with a full report due within 14 days.
SourceFederal Data Protection and Information Commissioner(FDPIC)
Visit authority siteNot directly, Switzerland is outside the EU/EEA, so GDPR is not Swiss law. Swiss companies instead comply with the nFADP. However, GDPR can still apply extraterritorially to a Swiss company that offers goods or services to people in the EU or monitors their behaviour.
Primarily the individual responsible for the violation (up to CHF 250,000), not the company, a deliberate structural difference from GDPR's company-level, turnover-based fines. Only intentional violations are punishable.
The nFADP sets no fixed hour deadline, the FDPIC must be notified 'as soon as possible' once a breach is assessed as posing a likely high risk to affected individuals. Separately, critical-infrastructure operators face a hard 24-hour deadline to report cyberattacks to BACS under a different law.
Talk to us about scoping an engagement around your specific regulatory context.
