Updated 24 October 2026 · by Dr Pietro Cravero, certified DPO
| Topic | nFADP (Switzerland) | GDPR (EU) |
|---|---|---|
| Data Protection Officer | Optional for private companies (Art. 10) | Mandatory in the cases of Art. 37 |
| Records of processing | Exemption for companies with fewer than 250 employees, unless they process sensitive data on a large scale or carry out high-risk profiling (Art. 12 nFADP; Art. 24 of the Data Protection Ordinance) | Required, with a narrow exemption |
| Breach notification | To the FDPIC as soon as possible, if the risk is high (Art. 24) | Within 72 hours (Art. 33) |
| Sanctions | Criminal fines up to CHF 250,000 on the responsible individuals (Arts. 60-63); in limited cases up to CHF 50,000 on the company (Art. 64) | Administrative fines on the company, up to 4% of worldwide turnover |
When the company directs its offer of goods or services at people in the EU — through its website, languages, currencies, deliveries or advertising — or monitors their behaviour, for example through online profiling (Art. 3(2) GDPR). A few European customers who find you on their own are not enough. If the GDPR applies and you have no establishment in the EU, you must usually appoint an EU representative.
The mirror rule also exists: a company outside Switzerland must appoint a representative in Switzerland only if all four conditions are met: the processing relates to offering goods or services in Switzerland or to monitoring people there, it is on a large scale, it is regular, and it entails a high risk for the people concerned.
The AI Act is not Swiss law, but it applies to Swiss providers that place AI systems on the EU market or whose output is used in the Union. Switzerland has chosen to ratify the Council of Europe Convention on Artificial Intelligence and to adapt existing laws rather than adopt a general AI act.
For companies in Ticino I have pages in Italian: Lugano, Bellinzona, Locarno, Mendrisio and Chiasso.
It can. Switzerland is not in the EU, but under Art. 3(2) GDPR the regulation applies to processing linked to offers directed at people in the EU or to monitoring their behaviour there.
No. Under the nFADP appointing a data protection advisor is optional for private companies (Art. 10). It can simplify the procedure after a data protection impact assessment.
The Federal Data Protection and Information Commissioner (FDPIC) for private companies and federal bodies; cantonal authorities for cantonal and municipal bodies.
Yes, if the GDPR applies to them under Art. 3(2) and they have no establishment in the EU, unless the processing is occasional and low-risk.
Dr Pietro Cravero, certified Data Protection Officer (IDcert; Second-level Master in Personal Data Processing, Roma Tre University). Studio Cravero Consulting, Sassari, Italy.
A free first assessment: we check whether the GDPR applies to you and whether you need an EU representative.
Studio Cravero Consulting