Data security breach: when and how to notify the FDPIC?
By Advisorn · updated on 17 October 2026 · Art. 24 FADP, Art. 15 Data Protection Ordinance, Art. 33-34 GDPR
In short
A data security breach must be notified to the FDPIC as soon as possible when it is likely to result in a high risk to the personality or fundamental rights of the data subjects (Art. 24 FADP). The people concerned must be informed if this is needed to protect them or if the FDPIC requests it; under the GDPR the authority must be notified within 72 hours (Art. 33 GDPR).
What to notify
The FDPIC's online form asks, among other things (Art. 15 Data Protection Ordinance):
- the nature of the breach and, if possible, when it happened and how long it lasted;
- the categories and approximate number of data and of data subjects concerned;
- the consequences and the risks for the people;
- the measures taken or planned;
- a name and a contact.
Even without a notification
Every breach must be documented, with the facts, the effects and the measures, and the documentation must be kept for at least two years (Art. 15 para. 4 Data Protection Ordinance). A processor that suffers a breach must inform the business it processes the data for without delay (Art. 24 para. 3 FADP).
Related questions
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.