Data Protection & IT Lawyers in Switzerland

Swiss Data Protection (nDSG vs. GDPR)

nDSG (neues Datenschutzgesetz – New Data Protection Act), effective 1 September 2023, is Switzerland's equivalent to GDPR—but with KEY differences:

• No Prior Consent Required: Unlike GDPR, most data processing does NOT require pre-approval consent. Lawful basis broader (legitimate interest threshold lower); opt-out model for many uses.
• Employee Data (art. 26 nDSG): Special allowance for employer processing of employee personal data for employment relationship (payroll, benefits, monitoring). GDPR requires consent for some uses.
• Criminal Penalties: CHF 250,000 fine for individuals violating nDSG art. 84 (criminal misconduct); limited corporate criminal liability (fines rare). GDPR: up to €20M or 4% global turnover.
• EDÖB (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter): Federal data protection authority; cantonal equivalents for cantonal/municipal bodies. Less expansive enforcement than EU DPAs.
• EU Adequacy Decision (2000, renewed post-nDSG 2023): Switzerland deemed adequate by EU; data transfers to/from EU continue without SCCs (Standard Contractual Clauses) required in most cases.

Case Study: Zurich FinTech startup experiences data breach: 50,000 customer records exposed (PII: names, email, hashed passwords). Notification obligations per nDSG art. 24: Notify EDÖB within "reasonable time" (typically 72 hours to 1 month); notify affected individuals if "likely significant damage" (subjective). Criminal investigation: EDÖB can prosecute violations under art. 84; common outcome: administrative fine (CHF 5,000-50,000 range) + order to remediate systems. GDPR equivalent: Same facts → GDPR breach notification 72 hrs, affected persons informed, EDPB/national DPA investigation, EU fine up to €20M. Swiss process: slower, lighter penalties, more industry self-regulation.