Is there a new FADP certification for businesses?
By Advisorn · updated on 25 October 2026 · Art. 13 and 22 para. 5 FADP, DPCO, Art. 42-43 GDPR
In short
Yes, but it is voluntary. The FADP provides that systems, products, services and organisations may be certified by recognised, accredited bodies (Art. 13 FADP), under the Ordinance on Data Protection Certification (DPCO). The law does not require a certification; however, whoever uses a system, product or service certified for its intended use may be exempt from the duty to carry out an impact assessment (Art. 22 para. 5 FADP).
Not to be confused
Many services offer attestations, seals or "compliance certificates" that are not a certification within the meaning of Art. 13 FADP. Before paying, ask who issues the seal and whether the body is accredited by the Swiss Accreditation Service (SAS).
Under the GDPR
The GDPR provides for certification mechanisms approved by the authorities or by the European Data Protection Board (Art. 42 GDPR); as in Switzerland they are voluntary and do not remove the controller's responsibilities.
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.