GDPR vs Swiss FADP: what companies in Germany and Switzerland need to know

Short answer: The GDPR and the revised Swiss Federal Act on Data Protection (FADP, revDSG, in force since 1 September 2023) share the same principles but differ in three points that matter in practice. The GDPR requires a personal data breach to be notified where feasible within 72 hours, while the FADP requires notification "as soon as possible" and only where the breach is likely to result in a high risk (Article 33 GDPR; Article 24 FADP). The GDPR provides for fines against companies of up to EUR 20 million or 4 % of worldwide annual turnover, whereas the FADP provides for fines of up to CHF 250,000 against the responsible individuals. And only the GDPR in certain cases and the German Federal Data Protection Act (BDSG) require a data protection officer; in Switzerland a data protection adviser is voluntary (Article 10 FADP).

This comparison is for data protection leads, general counsel and compliance teams with business in Germany and Switzerland. It sets out the GDPR vs FADP differences in a table, explains breach notification, sanctions, documentation and international transfers, and closes with a checklist for groups operating in both countries.

Comparison table of the main obligations

The main differences concern territorial scope, breach notification, sanctions and data protection officers.

Personal data breach notification

Under the GDPR the controller notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours; under the FADP it notifies the Federal Data Protection and Information Commissioner (FDPIC, EDÖB) as soon as possible, but only if the breach is likely to result in a high risk. The Swiss threshold is therefore higher, and there is no fixed number of hours.

A notification to the FDPIC must state at least the nature and consequences of the breach and the measures taken or planned (Article 24(2) FADP). Processors notify the controller as soon as possible (Article 24(3) FADP). A notification may be used in criminal proceedings against the person required to notify only with that person's consent (Article 24(6) FADP).

Process for an incident affecting both countries

1. Record the incident, document when it became known and start containment.
2. Identify the affected people and countries: where are the data subjects, and which entity is the controller?
3. Assess risk against both standards: "risk" under the GDPR, "high risk" under the FADP.
4. Prepare the EU notification within the 72-hour window and give reasons for any delay.
5. Check in parallel whether the FDPIC must be notified and, if the risk is high, file as soon as possible.
6. Decide on informing data subjects under Article 34 GDPR and Article 24(4) FADP.
7. Document decisions, deadlines and measures.

Sanctions: companies versus individuals

The GDPR imposes fines on companies, whereas the FADP generally imposes fines on the responsible individuals. This affects managers in Switzerland directly.

• GDPR: infringements, for example of the processing principles, can lead to fines of up to EUR 20 million or 4 % of worldwide annual turnover, whichever is higher (Article 83(5) GDPR).
• FADP: fines of up to CHF 250,000 apply to private individuals who intentionally breach duties to inform and to provide access, transfer data abroad unlawfully, engage processors without meeting the requirements, disregard minimum data security requirements, breach professional confidentiality or ignore orders of the FDPIC (Articles 60–63 FADP). Several of these offences are prosecuted only upon complaint.
• Companies in Switzerland: if the fine would not exceed CHF 50,000 and identifying the responsible person would be disproportionate, the business itself can be fined instead (Article 64 FADP).
• Procedure: in Switzerland the cantons prosecute offences; the limitation period is five years (Articles 65, 66 FADP).

The duty to notify a data security breach (Article 24 FADP) is not listed among the criminal provisions in Articles 60–63 FADP. The FDPIC can, however, investigate and issue orders, and intentionally disregarding such an order is an offence under Article 63 FADP.

Records, impact assessments and data protection officers

Both regimes require records of processing and, where a high risk is likely, an impact assessment; they differ in the exemptions and in the role of data protection officers.

Records of processing

In Switzerland, companies with fewer than 250 employees are exempt if their processing poses a low risk (Article 12(5) FADP). Under the GDPR the exemption for smaller companies applies only if processing poses no risk, is occasional and does not involve special categories of data (Article 30(5) GDPR). Groups covering both regimes usually keep a single record that includes the details required by both laws, such as the recipient country and the safeguards under Article 12(2)(g) FADP.

Impact assessment

If a Swiss impact assessment still shows a high risk after mitigation, the FDPIC must be consulted in advance. This is not required if the data protection adviser was consulted and the conditions of Article 10(3) FADP are met (Article 23(4) FADP).

Data protection officers

In Germany a data protection officer must be appointed where, as a rule, at least 20 people are regularly engaged in automated processing of personal data (Section 38(1) BDSG). In the Federal Modernisation Agenda of 4 December 2025, the federal and state governments agreed that the federal government will introduce a bill by 31 December 2026 to repeal section 38(1) BDSG, limiting the duty to Article 37 GDPR. No law has been passed so far and the 20-person rule still applies (as of 31 October 2026). An external officer under a service contract is permitted (Article 37(6) GDPR). In Switzerland a company may appoint a data protection adviser on a voluntary basis (Article 10 FADP).

International transfers

Both laws allow transfers to countries with an adequate level of protection without additional measures; otherwise appropriate safeguards such as standard contractual clauses are needed. The authorities and formalities differ.

• Switzerland: the Federal Council decides which countries offer adequate protection (Article 16(1) FADP, Annex 1 to the Data Protection Ordinance). Since 15 September 2024 this includes US companies certified under the Swiss-US Data Privacy Framework. Contractual clauses not approved or recognised by the FDPIC must be notified to the FDPIC in advance (Article 16(2) FADP).
• EU: transfers to third countries are permitted on the basis of a Commission adequacy decision or with appropriate safeguards (Articles 45, 46 GDPR). Switzerland benefits from a Commission adequacy decision (Decision 2000/518/EC), which the Commission confirmed in its review report of January 2024. Data can therefore flow from the EU to Switzerland without additional safeguards. In the other direction, Annex 1 of the Swiss Data Protection Ordinance lists the EU and EEA states as offering adequate protection.
• Transparency: under the FADP, data subjects must also be told the recipient country and, where relevant, the safeguard used (Article 19(4) FADP).

An unlawful transfer abroad can be a criminal offence for the responsible person in Switzerland if committed intentionally (Article 61(a) FADP). Data flows between entities and to cloud providers therefore belong in an up-to-date transfer map.

What companies operating in both countries should do

Companies with entities or customers in Germany and Switzerland are best served by a programme that uses the stricter standard as its baseline and adds the Swiss specifics.

• Confirm applicability: which entities and customer groups fall under the GDPR, the FADP or both?
• Keep one record of processing that covers the mandatory information under both laws.
• Set up an incident playbook with both notification thresholds, both authorities and the 72-hour deadline.
• Check privacy notices against Article 19 FADP and Articles 13 and 14 GDPR.
• Document the transfer mechanism for each data flow, including notices to the FDPIC.
• Assign and train responsible people in Switzerland clearly, because fines there target individuals.

Projects such as records of processing, playbooks or transfer mapping can be handled with additional interim data protection lawyers. Alpinum Solutions provides such professionals through staff leasing and freelancing, part-time or full-time; the formal role of data protection officer is in principle possible in both models. How such projects run is described in legal support for data protection projects; for a vacancy in the role, see covering a data protection officer vacancy.

Outlook and limits

• Digital Omnibus: the European Commission proposed GDPR amendments on 19 November 2025, including on the breach notification deadline. The Council adopted its negotiating mandate on 21 October 2026 (Council document 14756/26). Under it, a breach would only have to be notified to the supervisory authority where a high risk is likely. Until an amendment enters into force, the 72-hour deadline applies (status: October 2026).
• Responsibility: compliance remains the responsibility of the company and its governing bodies, even when interim professionals prepare documents.
• No legal advice: Alpinum is not a law firm. Questions of interpretation, such as whether the GDPR applies to a Swiss entity, should be clarified with the legal department or external advisers.

Frequently asked questions about the GDPR and the Swiss FADP

Does the GDPR apply to Swiss companies?

Yes, if a Swiss company has an establishment in the EU, or offers goods or services to people in the EU or monitors their behaviour there (Article 3 GDPR). In that case it generally also has to appoint a representative in the Union (Article 27 GDPR). For its other processing the FADP applies, which looks at effects in Switzerland.

Who is fined under the Swiss FADP?

The FADP generally imposes fines of up to CHF 250,000 on the responsible individuals rather than on the company (Articles 60–63 FADP). Only intentional conduct is punishable, and several offences are prosecuted only upon complaint. The company can be fined up to CHF 50,000 instead if identifying the responsible person would be disproportionate (Article 64 FADP).

Does a company in Switzerland need a data protection adviser?

No, private companies may appoint a data protection adviser voluntarily (Article 10 FADP). One benefit: if an impact assessment shows a high residual risk, the company does not have to consult the FDPIC if it consulted its adviser instead and the adviser is independent, free from instructions and notified to the FDPIC. German entities remain subject to Article 37 GDPR and Section 38 BDSG.

Does a data breach have to be notified in both countries?

That depends on who is affected and on the risk. If people in the EU are affected, the 72-hour deadline under Article 33 GDPR applies unless the breach is unlikely to result in any risk. If people in Switzerland are affected and the risk is likely to be high, the FDPIC must also be notified as soon as possible (Article 24 FADP).

Will the Digital Omnibus change the 72-hour deadline?

Not yet. On 21 October 2026 the Council adopted a negotiating mandate that would require notification to the supervisory authority only where a high risk is likely; professional commentary also reports a 96-hour deadline. The European Parliament has not yet taken a position, and negotiations with the Council will only start after that (status: October 2026). Until an amendment enters into force, Article 33 GDPR applies unchanged.

Next step

If you need to align a data protection programme across Germany and Switzerland or cover a vacancy in data protection, talk to us about your requirements. Selected profiles are usually available within 48 hours; the start date is agreed jointly by the company and Alpinum.

• IT, technology and data privacy law: project lawyers
• Data protection officers: covering a vacancy with an interim appointment
• Legal support for data protection projects
• Discuss your requirements

Last updated: 31 October 2026.