AI and Data Protection in Switzerland: the revised FADP (revFADP)

In Switzerland, AI and data protection are governed by the revised Federal Act on Data Protection (revFADP). It has been in force since 1 September 2023. The FDPIC is the supervisory authority. When you paste text into an AI tool, you often process personal data. Then the revFADP applies — even if the AI provider sits abroad.

The revFADP has applied since 2023

The revFADP replaced the old law from 1992. It strengthens the rights of the people concerned. And it binds AI projects too, as soon as personal data is involved.

• In force since 1 September 2023.
• The FDPIC is the supervisory authority.
• It covers private firms and federal bodies.
• It protects the data of natural persons.
• It moves closer to the GDPR but stays a separate law.

Your main duties

The law rests on clear principles. You must process data fairly and proportionately. And you need a purpose that is fixed from the start.

• Respect good faith, proportionality and purpose limitation.
• Inform the people concerned in a transparent way.
• Ensure adequate data security.
• Keep a record of processing activities.
• Run a data protection impact assessment for high risk.

revFADP and GDPR together

Many Swiss firms serve customers in the EU. Then the GDPR can also apply. The European regulation reaches across the border.

• The revFADP applies to processing linked to Switzerland.
• The GDPR can reach Swiss firms with EU data subjects.
• Both demand data minimisation and security.
• Both require an impact assessment for high risk.
• When in doubt, check both frameworks.

Put the sanctions in context

Here the two laws differ clearly. The revFADP has no large corporate fines like the GDPR. Instead, the penalty targets responsible individuals.

• According to the FADP, fines can reach CHF 250,000.
• They target responsible natural persons.
• The GDPR provides fines against companies.
• These can reach EUR 20 million or 4% of turnover.
• So data protection is a matter for management too.

Cut the AI risk in practice

The best protection is simple: share less. Give the AI only what the task truly needs. That keeps your exposure small. According to OpenAI, the company does not train on the business data of its API and enterprise customers — but check the current documentation.

1. 1Ask whether real personal data is needed.
2. 2Remove or replace names, numbers and addresses.
3. 3Use pseudonyms instead of plain text.
4. 4Sign a data processing agreement with the AI provider.
5. 5Document the purpose and legal basis.

Tools help you reduce the amount of data. ONYRI Sanitize detects sensitive data in your text and replaces it with reversible tokens. The mapping table stays in the browser and is never sent to the server. After the AI replies, the real values are restored. To be honest: this is pseudonymisation, not anonymisation. Pseudonymised data stays personal data (GDPR recital 26). A tool replaces neither a data processing agreement (DPA) nor a legal basis. It lowers exposure, it does not remove it.

Bottom line: the revFADP puts Swiss firms under duty when they use AI. Share fewer personal data and you lower your risk. Data minimisation is the easiest first step.