The framework
Switzerland's framework rests on the Federal Act on Data Protection (revFADP), adopted in 2023, with the FDPIC as the supervisory authority.
The posture is hybrid. Notice and purpose limitation govern collection and consent is reserved for sensitive cases, which makes first-party marketing more workable here than in strict opt-in markets.
Key instruments
Federal Act on Data Protection (revFADP)
Switzerland's fully revised FADP took effect 1 September 2023 with no transition period. Its architecture is unusual in two ways. Private-sector processing does not need a legal basis by default, and penalties are criminal fines aimed mainly at individual managers. The FDPIC is testing marketing practices directly, and in April 2026 it ordered Philipp Plein and another online seller to stop emailing and texting customers who had objected. Email marketing is still opt-in via the Unfair Competition Act.
Marketing and advertising
Processing is lawful without consent unless it breaches personality rights; consent needed for sensitive data, high-risk profiling and to justify breaches. Mass email marketing requires opt-in under unfair competition law. That single sentence decides most channel plans here.
Cross-border transfers
Adequacy list maintained by the Federal Council, which covers certified US companies under the Swiss-US Data Privacy Framework since 15 September 2024; SCCs otherwise. Switzerland holds EU adequacy.
Enforcement and penalties
Criminal fines up to CHF 250,000, aimed primarily at responsible individuals; a business can be fined up to CHF 50,000 where identifying the individual would be disproportionate.