News
Data protection news from Switzerland
Decisions of the FDPIC, court rulings, new adequate countries and changes to the law. For each we say in a few lines what happened and what changes for an SME.
By Advisorn · last updated 28/10/2026 · guidance, not advice
October 2026
- FDPIC · decision
Advertising without provable consent: the FDPIC orders the data deleted
Add Conti GmbH sold addresses to advertisers, claiming the consents came from online prize draws. The FDPIC did not believe it, prohibited the processing and ordered the data deleted. The company did not even answer requests for access and erasure. The decision is final.
For you: Consent to marketing must be documented, because the burden of proof is yours (Art. 6 and 31 FADP). Handing the replies to a service provider does not relieve you of responsibility.
- Source: FDPIC communication of 22 October 2026
- Question: Newsletters: is consent needed to send marketing e-mails in Switzerland?
- Question: Is consent required to process personal data in Switzerland?
- Question: How to answer a request for access to personal data, and within what time?
- Template: Response templates for data subject requests
- Federal Administrative Court
Voice recognition: explicit consent is needed, carrying on talking is not enough
The Federal Administrative Court confirms the FDPIC's position on PostFinance (A-4467/2025, 13 October 2026). A voiceprint is biometric, sensitive personal data. A customer carrying on with the call after the notice does not count as consent, and voiceprints made without consent must be deleted.
For you: Biometric data that identify a person (voice, fingerprint, face) require explicit consent (Art. 5 let. c no. 4 and Art. 6 para. 7 FADP).
- FDPIC and NCSC · campaign
Generative AI at work: the campaign of the FDPIC and the Federal Office for Cybersecurity
The cybersecurity month campaign warns those who enter data of customers, patients or staff into tools such as ChatGPT or Claude. The NCSC has published frequently asked questions. The FADP applies directly to this processing.
For you: Give your staff written rules on what may go into an AI tool and what may not.
- FDPIC · decision
Bodycams on public transport: the FDPIC prohibits BLT from processing
According to the FDPIC, the bodycams of Baselland Transport AG lack a sufficient legal basis: the company must stop and delete the recordings (decision of 29 September 2026). The case concerns a company with public transport duties.
For you: A private company does not need a law, but it must be able to justify video surveillance and keep it proportionate (Art. 6 and 31 FADP). Before installing it, assess the risks.
September 2026
- FDPIC and privatim · guide
Digital monitoring in care homes: a joint guide of the FDPIC and the cantons
The guide covers cameras, infrared sensors and radar used to monitor people in care. Consent is desirable, but not enough on its own. The purpose must be in the person's interest, less intrusive measures come first, and an alert only in case of a fall is preferable to live images.
For you: If you run a healthcare or care facility, document the choice in a risk analysis and train your staff.
April 2026
- Warning
Fake e-mails in the FDPIC's name accuse websites of breaching the FADP
Website operators are receiving e-mails that pretend to come from the FDPIC and allege data protection breaches. The FDPIC has announced a criminal complaint against persons unknown.
For you: Do not open attachments or links and do not pay anything. If in doubt, contact the FDPIC through its website.
February 2026
- FDPIC · recommendation implemented
Digitec Galaxus: personalisation can be switched off with one click
The FDPIC had recommended that Digitec Galaxus limit the data collected through its mandatory customer account. The shop followed the recommendation: today a single setting switches off personalisation and the cookies that serve it, and the registration form points out the right to object.
For you: If you run an online shop, offer a simple way to object to profiling and say so at registration (Art. 6 para. 2 and Art. 30 para. 2 let. b FADP).
January 2026
- Adequacy · EU
Brazil is adequate for the GDPR, not yet for the FADP
The European Commission has recognised Brazil as a country with adequate protection (Implementing Decision (EU) 2026/179, in force since 28 January 2026). The Federal Council has not added it to Annex 1 to the Data Protection Ordinance.
For you: From Switzerland to Brazil, safeguards are still needed, for example standard contractual clauses (Art. 16 para. 2 FADP).
- Source: Official Journal of the EU, Implementing Decision (EU) 2026/179
- Question: Can I use vendors with servers in the United States or the EU?
- Question: What are standard contractual clauses and when are they needed?
- Template: Template for assessing a transfer of data abroad (TIA)
- Tool: Can I send data to this country?
- Adequate countries
General information summarised from the source, not advice on your case: for your case, the text of the decision or the law is what counts.