Anonymising Documents in Switzerland Under the Revised FADP

Since 1 September 2023, Switzerland's revised Federal Act on Data Protection (FADP) applies to documents about an identified or identifiable person. A document only escapes the act when nobody can link it to someone without disproportionate effort. So blacking out the name is rarely enough: the AHV number, sensitive data and small clues, like a village or an age, need care too.

What does the revised FADP protect?

In German it is the Bundesgesetz über den Datenschutz (DSG). In French it is the loi fédérale sur la protection des données (LPD). Many say revDSG or nLPD. Article 1 protects natural persons, meaning human beings. The federal SME portal sums it up: data of legal persons, such as companies, are no longer covered. A supplier company's turnover is outside the act. The mobile number of its manager, Jane Example, is not.

Article 2 applies the act to private persons, such as companies, and to federal bodies. Cantonal authorities are not covered. For medical records of cantonal hospitals, the Federal Data Protection and Information Commissioner (FDPIC) says cantonal data protection law applies.

Which data count as sensitive under Swiss law?

Why does it matter? Under Article 30 paragraph 2 letter c, disclosing sensitive data to third parties breaches personality rights. It is lawful only with a justification under Article 31: consent, an overriding interest or the law.

When is a Swiss document anonymised, and when only pseudonymised?

The FADP uses the word anonymised but never defines it, and it never mentions pseudonymisation. The FDPIC gives its own reading in a guide dated 15 January 2024. That is the authority's interpretation, not the law. Pseudonymised data can no longer be linked to a person without additional information or disproportionate effort. But they still carry a risk of re-identification, the FDPIC says, so they remain personal data. On anonymisation, the guide says:

Anonymised data are no longer considered to be personal data, and therefore falls outside the scope of the FADP.

A hospital list swaps the name for an ID but keeps: female, 42 years old, lives in a small village, treated for AIDS. The FDPIC's guide says this is not anonymous: her employer, or anyone who knows her age and village, could find her. A medical certificate with only the name blacked out is just as weak.

Why does the AHV number need special care?

The AHV number (numéro AVS in French) is the Swiss social security number. The Federal Social Insurance Office (FSIO) says it has 13 digits, starts with 756 and is generated at random. It is assigned once and never changes. Article 50c paragraph 3 AHVG, the old-age and survivors' insurance act, says the number's composition must not allow any conclusion about the person.

Yet one number points to one person for life. So Articles 153b to 153i AHVG limit its systematic use outside the AHV, meaning linking it to personal data collected in a structured way. Only listed bodies may do this, such as authorities, education institutions and some private insurers. Unauthorised systematic use is punished with a monetary penalty (Article 153i).

What should you mask in a typical Swiss document?

On a Swiss document, ONYRI Sanitize recognises AHV numbers (756…, with a valid check digit), Swiss postcodes with their town and German-language street addresses such as “Seestrasse 4”. It also finds Swiss phone numbers, IBANs and amounts in CHF. It does not detect the company identification number (UID, CHE-…), so add it under “Also mask” or in a custom rule. Mask tariff codes and diagnoses written in words by hand.

Who pays the fine when a document leaks?

Here the FADP differs sharply from the GDPR. Under GDPR Article 83, the highest fines reach EUR 20 million or 4 % of worldwide annual turnover, whichever is higher. In Switzerland, Articles 60 to 63 set fines of up to CHF 250,000. The FDPIC adds that these offences require intent, mainly target individuals, and are handled by cantonal prosecutors. Civil claims for damages are separate and can exceed that amount, it notes.

Under Article 64, the authority may fine the company instead, but only up to CHF 50,000 and when finding the person responsible would be disproportionate. Two offences fit documents closely. Article 61 letter c punishes wilfully ignoring the minimum data security requirements that the Federal Council issued. Article 62 punishes professionals who wilfully reveal secret personal data. Both are prosecuted only if a complaint is filed.

What changes when a document crosses the Swiss border?

From the EU to Switzerland, the path is simple. The European Commission recognises Switzerland as adequate (Decision 2000/518/EC of 26 July 2000), so personal data can flow from the EU without any further safeguard. That is the position as of October 2026.

Leaving Switzerland, Article 16 FADP applies. Annex 1 of the Data Protection Ordinance (DPO) lists the countries the Federal Council deems adequate. They include all EU and EEA states, the United Kingdom and a few others. Since 15 September 2024, the list also covers the United States, but only organisations certified under the Swiss-US Data Privacy Framework. Elsewhere you need safeguards, such as the EU standard contractual clauses the FDPIC recognises, or an Article 17 exception.

How do you check a Swiss document before it leaves?

1. Ask what the recipient needs: an amount or a date, rarely an ID number.
2. Mask the AHV number, date of birth, ID numbers and any tariff code.
3. Look for the six kinds of sensitive data, social assistance included.
4. Check small clues: village, age, rare job title, case number.
5. Check the destination against Annex 1 of the DPO, and keep the original safe.

This is general information, not legal advice. For a specific case, ask your data protection officer, a lawyer or the FDPIC.

Frequently asked questions

Sources & references