AI and the Swiss Federal Act on Data Protection (revFADP)

Does the Data Protection Act also apply to AI?

Yes. The revised Federal Act on Data Protection (FADP, in German DSG) has been in force since 1 September 2023 and is worded in a technology-neutral way. The Federal Data Protection and Information Commissioner (FDPIC, in German EDÖB) therefore considers it directly applicable to any processing of personal data with AI. In October 2026, Switzerland has no AI law of its own.

In its overview “AI and data protection” (September 2025), the FDPIC names these duties in particular:

Duty	What the FDPIC requires	Basis in the FADP
Transparency	Disclose purpose, functioning and data sources; people should know whether they are communicating with an AI and whether their input is reused	Art. 19
Data protection impact assessment	Where the risk is high, for example with extensive processing of sensitive personal data	Art. 22
Automated individual decision	Inform; on request, review by a human	Art. 21
Fake images and voices	Make them clearly recognisable	General principles

Not all experts share every reading of the FDPIC, for example on transparency in AI. The view of the supervisory authority is not a court ruling, but it shows what the FDPIC will examine in an investigation.

Which data is particularly protected?

Under Art. 5(c) FADP, sensitive personal data includes, among other things, data on health, genetic and biometric data, data on administrative and criminal proceedings, and data on social assistance measures. For hospitals, care homes and social services this means: anyone who processes such data on a large scale with AI generally needs a data protection impact assessment beforehand (Art. 22(2)(a) FADP).

What applies when a provider runs the AI?

Then the provider is a processor. Art. 9 FADP permits this under three conditions:

• Same limits: The provider only processes the data in the way you yourself would be allowed to.
• No duty of confidentiality breached: Neither law nor contract prohibits the transfer. For doctors, lawyers and other professional secrecy holders, Art. 321 of the Swiss Criminal Code (SCC, in German StGB) also applies. Professional secrecy and AI in Switzerland →
• Data security checked: You satisfy yourself that the provider guarantees data security. It may only bring in sub-processors with your prior authorisation.

Anyone who intentionally hands over data without the conditions being met risks a fine of up to CHF 250,000 (Art. 61(b) FADP). The penalty applies to natural persons, for example the responsible manager.

May the data go to Germany or the EU?

Yes. Personal data may go abroad if the Federal Council has found that the protection there is adequate (Art. 16(1) FADP). Germany, Austria and the other EU member states are listed in Annex 1 of the Data Protection Ordinance. For other states, safeguards are needed, such as standard data protection clauses recognised by the FDPIC (Art. 16(2) FADP).

What matters is where the AI requests actually go: if a platform sends your input to the model of a provider outside Europe, that is a disclosure abroad, which you must state in the record of processing activities (Art. 12(2)(g) FADP).

How does this work with basebox?

basebox offers the cloud and the server in Switzerland. A data centre in Switzerland for the cloud is in progress, by 2027 at the latest. Until then, the cloud runs for Swiss customers too in a data centre in Germany, a state with adequate data protection under Annex 1 of the Data Protection Ordinance. The server is at your site; our hardware partner FAST LTA delivers it to Switzerland through a local partner. The AI model runs in the cloud or on your server; an external model is only available as a separate app, if you have one set up. Your data does not train any model.

For processing under Art. 9 FADP there is a supplement to the DPA, and for professional and official secrecy an agreement under Art. 321 and Art. 320 SCC; both are available at /sicherheit#sec-schweiz. For your review, the DPA, TOMs, the list of sub-processors and templates for the record of processing activities and the data protection impact assessment can also be downloaded at /sicherheit. Interface and support are available in German and English.

Not legal advice: This guide gives an overview of federal law. Cantonal bodies are subject to the data protection law of their canton. Switzerland is working on rules to implement the Council of Europe’s AI Convention; check the current status. Research as of: 11 October 2026.