New FADP in force since 1 September 2023: what has changed?
By Advisorn · updated on 25 October 2026 · Art. 7, 12, 19, 22, 24, 60-66, 69 FADP
In short
The revised Federal Act on Data Protection (new FADP, nFADP) has been in force since 1 September 2023, without a transitional period. Among other things it introduced the record of processing activities, a wider duty to provide information, the data protection impact assessment, the notification of breaches to the FDPIC, data protection by design and fines of up to CHF 250,000 for the responsible individuals; in return it protects only natural persons.
The main changes
- only the data of natural persons is protected, no longer that of companies;
- the duty to provide information applies to every collection of data, not only of sensitive personal data (Art. 19 FADP);
- record of processing activities (Art. 12 FADP);
- data protection impact assessment for high-risk processing (Art. 22 FADP);
- notification of breaches of data security to the FDPIC (Art. 24 FADP);
- data protection by design and by default (Art. 7 FADP);
- right to data portability (Art. 28 FADP);
- fines of up to CHF 250,000, instead of the general limit of CHF 10,000 under the Criminal Code (Art. 60-63 FADP);
- a representative in Switzerland for some foreign businesses (Art. 14 FADP).
No transitional period
The law applied at once. The only exceptions are data protection by design and the impact assessment, which do not apply to processing begun before 1 September 2023 if the purpose does not change and no new data is collected (Art. 69 FADP).
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.