What the law says
Personal data may be disclosed abroad if the Federal Council has found that the state ensures adequate protection (Art. 16 para. 1 FADP, Annex 1 Data Protection Ordinance); under the GDPR the European Commission decides (Art. 45 GDPR). For other states appropriate safeguards are needed, such as standard contractual clauses recognised by the FDPIC (Art. 16 para. 2 FADP, Art. 46 GDPR).
In every case the states of destination must be named in the privacy notice (Art. 19 para. 4 FADP) and, if you keep one, in the record of processing activities; and a provider may process data on your behalf only if you assign it the processing by contract (Art. 9 FADP).
The exceptions for the individual case
- the explicit consent of the data subject;
- processing directly connected with a contract with the data subject;
- the establishment, exercise or enforcement of legal claims before a court;
- other cases listed in Art. 17 FADP and Art. 49 GDPR, which are not enough for a provider used every day.
Related questions
Useful templates
General guidance, not advice on your case: for your case the text of the law is what counts, and the assessment remains yours.