Reference
Countries with adequate data protection under the FADP and the GDPR
Personal data may be disclosed to these countries without further safeguards. The Swiss list and the European list are not the same: here they are side by side, with the sources and the date of the last check.
In short
Under the FADP, the States listed in Annex 1 to the Data Protection Ordinance are adequate: all States of the EU and the EEA, the United Kingdom, Israel, Argentina and a few others, plus US companies certified under the Swiss-U.S. Data Privacy Framework and, in part, Canada (Art. 16 para. 1 FADP). Under the GDPR, the European Commission's adequacy decisions apply (Art. 45 GDPR), Switzerland among them. For other countries safeguards are needed, usually the standard contractual clauses.
| Country | FADP (Switzerland) | GDPR (EU) |
|---|---|---|
| Andorra | Adequate | Adequate |
| Argentina | Adequate | Adequate |
| Austria | Adequate | Territory of the law |
| Belgium | Adequate | Territory of the law |
| Brazil | Safeguards needed | Adequate |
| Bulgaria | Adequate | Territory of the law |
| CanadaOnly recipients subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) or a similar provincial law. | Only for some recipients | Only for some recipients |
| Croatia | Adequate | Territory of the law |
| Cyprus | Adequate | Territory of the law |
| Czechia | Adequate | Territory of the law |
| Denmark | Adequate | Territory of the law |
| Estonia | Adequate | Territory of the law |
| Faroe Islands | Adequate | Adequate |
| Finland | Adequate | Territory of the law |
| France | Adequate | Territory of the law |
| Germany | Adequate | Territory of the law |
| Gibraltar | Adequate | Safeguards needed |
| Greece | Adequate | Territory of the law |
| Guernsey | Adequate | Adequate |
| Hungary | Adequate | Territory of the law |
| Iceland | Adequate | Territory of the law |
| Ireland | Adequate | Territory of the law |
| Isle of Man | Adequate | Adequate |
| Israel | Adequate | Adequate |
| Italy | Adequate | Territory of the law |
| Japan | Safeguards needed | Adequate |
| Jersey | Adequate | Adequate |
| Latvia | Adequate | Territory of the law |
| Liechtenstein | Adequate | Territory of the law |
| Lithuania | Adequate | Territory of the law |
| Luxembourg | Adequate | Territory of the law |
| Malta | Adequate | Territory of the law |
| Monaco | Adequate | Safeguards needed |
| Netherlands | Adequate | Territory of the law |
| New Zealand | Adequate | Adequate |
| Norway | Adequate | Territory of the law |
| Poland | Adequate | Territory of the law |
| Portugal | Adequate | Territory of the law |
| Romania | Adequate | Territory of the law |
| Slovakia | Adequate | Territory of the law |
| Slovenia | Adequate | Territory of the law |
| South Korea | Safeguards needed | Adequate |
| Spain | Adequate | Territory of the law |
| Sweden | Adequate | Territory of the law |
| Switzerland | Territory of the law | Adequate |
| United Kingdom | Adequate | Adequate |
| United StatesOnly companies certified under the Data Privacy Framework (for Switzerland: also under the Swiss-U.S. framework). | Only for some recipients | Only for some recipients |
| Uruguay | Adequate | Adequate |
All other countries: appropriate safeguards are needed, under both laws.
What "adequate" means
The Federal Council, for the FADP, and the European Commission, for the GDPR, assess the legislation of a State. If they find it adequate, data may go to that State as if it stayed in Switzerland or in the EU. All the other duties remain: a contract with the vendor, data security and naming the States in the privacy notice.
The United States
The United States is adequate only for companies certified under the Data Privacy Framework: for Switzerland since 15 September 2024, for the EU since 10 July 2023. If the company you contract with is not certified, or not for Switzerland, safeguards such as the standard contractual clauses are needed. The list of certified companies is on the Data Privacy Framework website.
If the country is not on the list
- standard contractual clauses recognised by the FDPIC, usually those of the European Commission with the adjustments for Switzerland (Art. 16 para. 2 let. d FADP);
- binding corporate rules, within a group of companies (Art. 16 para. 2 let. e FADP);
- in individual cases the exceptions of Art. 17 FADP, for example explicit consent or the performance of a contract with the person: they are not enough for a vendor used every day.
Sources
- Annex 1 to the Data Protection Ordinance (DPO), version of 15 September 2024
- Adequacy decisions of the European Commission, the latest of 26 January 2026 (Brazil)
Lists checked on 25 October 2026. They change: before an important decision, check the source.
Read more
General information, not advice on your case. EasyLPD shows this status for every vendor on your list.