Part 11 of our series on data protection law in Switzerland
In this part of our series, we explore the rules on the cross-border transfer of personal data under the Federal Act on Data Protection (FADP).
Transfers to an adequate country
Pursuant to Art. 16(1) FADP, personal data may be disclosed cross-border if the Federal Council has decided that the legislation of the State concerned or the international body guarantees an adequate level of protection. The list of adequate countries can be found in Annex 1 of the Ordinance on Data Protection (DPO)1. As of 15 September 2024, this list has been extended to include the United States. This means that personal data may be transferred to U.S. companies certified under the Swiss-U.S. Data Privacy Framework.
Transfer mechanisms for transfers to non-adequate countries
In the absence of an adequacy decision by the Federal Council, an appropriate level of data protection must be guaranteed by one of the following transfer mechanisms before disclosing personal data abroad:
- a treaty under international law;
- data protection clauses which have been notified to the Federal Data Protection and Information Commissioner (FDPIC) beforehand;
- specific guarantees drawn up by the competent federal body which have been notified to the FDPIC beforehand, such as the EU Standard Contractual Clauses, which have been recognised by the FDPIC;
- standard data protection clauses approved, issued or recognised beforehand by the FDPIC;
- binding corporate rules (BCR) approved in advance by the FDPIC or by the data protection authority of a State that guarantees an adequate level of protection; or
- a code of conduct or certification approved beforehand by the FDPIC.
According to the FDPIC's guidance on the transfer of personal data to a country without an adequate level of data protection based on standard data protection clauses in accordance with Art. 16(2)(d) FADP, dated 27 August 2021 (last revised on 12 February 2025)2, the EU Standard Contractual Clauses (SCCs) may be used for the transfer of personal data to third countries. However, certain adaptations are required to ensure that the SCCs comply with Swiss law and effectively guarantee an adequate level of protection under Art. 16(2)(d) FADP. An overview of the necessary adjustments is provided in the FDPIC's guidance.
Exceptions
In the absence of an adequacy decision and of a transfer mechanism as listed above, controllers (and processors) can, in certain cases, rely on one of the following exceptions to legitimate the cross-border disclosure of personal data:
- the data subject's explicit consent;
- the disclosure is directly connected with the conclusion or performance of a contract with the data subject or in the interest of the data subject;
- the disclosure is necessary to safeguard an overriding public interest or establish, exercise or enforce legal rights before a court or another foreign competent authority;
- the disclosure is necessary to protect the life or the physical integrity of the data subject or a third party, and it is not possible to obtain the data subject's consent within a reasonable time;
- the data subject has made the data generally accessible and has not explicitly prohibited its processing; and
- the data is originating from a statutory register that is public or accessible to persons with a legitimate interest.
According to the FDPIC's Guide to checking the admissibility of data transfers to foreign countries, issued in June 20213 and last updated in May 20234, a transfer impact assessment (TIA) is necessary for transfers based on one of the legal mechanisms for transfers to non-adequate countries. The guide also lists four guarantees that should be evaluated during a TIA, as well as mandatory supplemental measures if these guarantees are not met.
Preview of Part 12
In part 12 of our series, we will examine the requirements with respect to transparency when collecting and processing personal data.
Footnotes
1 https://www.fedlex.admin.ch/eli/cc/2022/568/en#annex_1
4 https://backend.edoeb.admin.ch/fileservice/sdweb-docs-prod-edoebch-files/files/2024/12/17/3a08dae5-48c6-4d05-81f1-8016bfec4cde.pdf; only available in German
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
