What sanctions does the new FADP provide for, and on whom?
By Advisorn · updated on 17 October 2026 · Art. 60-66 FADP
In short
The FADP provides for fines of up to CHF 250,000 (Art. 60-63 FADP). They are paid by the responsible natural person, not by the business, and only for wilful breaches; the business can be fined up to CHF 50,000 when identifying the responsible person would require disproportionate investigations (Art. 64 FADP).
What is punishable
- giving false or incomplete information to someone who asks for access to their data, or failing to inform when collecting it (Art. 60 FADP);
- transferring data abroad without the conditions of Art. 16, entrusting it to a processor without complying with Art. 9 or failing to meet the minimum data security requirements (Art. 61 FADP);
- breaching professional confidentiality (Art. 62 FADP);
- failing to comply with a decision of the FDPIC (Art. 63 FADP).
Who decides
Fines are imposed by the criminal prosecution authorities of the cantons (Art. 65 FADP). The FDPIC does not impose fines: it investigates, orders measures and can file a criminal complaint. Negligence is not punishable: intent is required, even if only in the form of conditional intent (dolus eventualis).
For those who also work with the EU, the sanctions of the GDPR count, and they fall on the business: up to EUR 20 million or 4% of total worldwide annual turnover (Art. 83 GDPR).
Related questions
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.