Can I use vendors with servers in the United States or the EU?
By Advisorn · updated on 17 October 2026 · Art. 16-17 and 19 FADP, Annex 1 Data Protection Ordinance
In short
Yes. Data may be disclosed abroad if the Federal Council has determined that the State provides an adequate level of protection, as the States of the EU and the EEA do (Art. 16 para. 1 FADP). To the United States it may be transferred to companies certified under the Swiss-U.S. Data Privacy Framework; for the others appropriate safeguards are needed, usually the standard contractual clauses (Art. 16 para. 2 FADP).
How to check
- look at where the vendor stores the data and who can access it, support included;
- if the State is not on the list in Annex 1 of the Data Protection Ordinance, check the certification (for the US) or sign the standard contractual clauses with the adjustments for Switzerland;
- name the States in the privacy notice (Art. 19 para. 4 FADP) and in the record.
The exceptions
In individual cases a transfer is possible without safeguards too, for example with the express consent of the person or to perform a contract with them (Art. 17 FADP). They are not a basis for a vendor used every day.
Related questions
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.