FADP Fines in Switzerland (2026): Enforcement, Penalties and Personal Liability

FADP fines Switzerland is one of the most pressing compliance questions for Swiss organisations in 2026, as enforcement under the revised Federal Act on Data Protection (revFADP/nFADP) continues to mature following its entry into force in 2023. The revised law brought a materially different sanctions regime from the one most businesses grew up with, and the questions have shifted from “what does the law require? ” to “what happens when we get it wrong, and who pays? ” This guide explains the statutory basis for penalties, how the Federal Data Protection and Information Commissioner (EDÖB/FDPIC) enforces the rules, how fines are calculated, and, critically, whether executives, board members and data protection officers can be held personally liable.

It is written for in-house counsel, privacy leads and senior decision-makers who need practical, statute-grounded clarity rather than high-level reassurance.

Who this guide is for and what you will get

This article is aimed at in-house counsel, privacy leads and executives in Swiss companies and foreign organisations processing Swiss personal data. You will get a clear summary of the sanctions framework, an explanation of personal liability exposure, a step-by-step view of the EDÖB enforcement process, a comparison with the GDPR, and an actionable boardroom checklist. The analysis draws throughout on primary sources: the FADP text on Fedlex, EDÖB guidance and published decisions, and Federal Council communications on admin.ch.

Quick statutory snapshot, what the FADP covers (and who enforces it)

The revised Federal Act on Data Protection governs the processing of personal data by private persons and federal bodies in Switzerland. The revised FADP modernised Swiss data protection law to bring it closer, though not identical, to the EU General Data Protection Regulation, and it entered into force on 1 September 2023 following Federal Council confirmation (admin.ch). It applies to controllers and processors in Switzerland and, importantly, extends to processing abroad that produces effects in Switzerland, creating a cross-border reach that catches many international groups.

The competent supervisory authority is the Federal Data Protection and Information Commissioner, known in German as the EDÖB and in English as the FDPIC. The authority investigates, issues binding orders, cooperates with foreign regulators and publishes guidance for controllers and processors (EDÖB official guidance). The FADP operates alongside sectoral rules, for example in banking, telecommunications and health, so a single incident can engage both the general data protection regime and sector-specific obligations. Understanding the interplay is essential, because the trigger for FADP fines Switzerland may sit inside a broader regulatory picture that involves multiple authorities.

For organisations trying to answer the basic question “what is the current data privacy law in Switzerland?”, the short answer is the revised FADP, supplemented by its implementing Ordinance on Data Protection (DPO/OPDo) and enforced by the EDÖB. The statute is the anchor for every claim in this guide; the article numbers referred to below can be verified in the official text on Fedlex.

Types of sanctions under the FADP

A defining feature of the Swiss regime, and the single most important point to grasp about FADP fines Switzerland, is that it is not a straightforward administrative fining model like the GDPR. The FADP relies primarily on a criminal-penalty architecture under which certain breaches are prosecuted as offences, combined with the supervisory authority’s power to order corrective measures. In broad terms, the sanctions fall into three categories.

• Penal fines for specified breaches. The FADP makes it an offence, punishable on complaint by a fine, to breach certain obligations, for example failing to provide required information, breaching duties to inform or to cooperate, breaching professional confidentiality, or disregarding minimum data security requirements set by the Federal Council. These are set out in the criminal provisions of the Act (Articles 60 et seq.) and are enforced through the ordinary prosecution route rather than imposed directly by the EDÖB.
• Corrective and injunctive measures. The EDÖB can open investigations and issue binding administrative orders, for instance requiring a controller to modify, suspend or terminate a particular processing operation, or to delete personal data. These measures are not monetary penalties in themselves, but non-compliance with an enforceable order can itself expose responsible individuals to penal consequences.
• Remediation and publication. Alongside formal orders, the authority can require remediation and may publish information about its investigations and findings. Reputational exposure from publication is frequently as significant to a Swiss board as the financial penalty itself.

The practical consequence is that FADP penalties are distinguished from GDPR-style administrative fines in two ways. First, the fines attach primarily to natural persons rather than being levied as a percentage of corporate turnover. Second, many offences are prosecuted only on complaint, which shapes how enforcement unfolds. This structural difference is the single most common misunderstanding among international teams who assume Switzerland simply mirrors the GDPR. Because the exact maximum amounts and the precise offences are defined in the statute, controllers should verify the figures and the relevant article numbers directly against the FADP text on Fedlex before relying on them in internal risk assessments.

How penal fines differ from corrective orders

A corrective order from the EDÖB tells you to change your conduct; a penal fine punishes a defined offence through the criminal justice system. The two can run in parallel: an investigation may produce an order to stop unlawful processing while the underlying conduct is separately capable of attracting a penal fine. Keeping these two tracks conceptually distinct is vital when advising the board, because the decision-makers, the burden of proof and the appeal routes differ for each.

How the EDÖB enforces, procedure and rights

Understanding the enforcement procedure is as important as knowing the headline numbers. The EDÖB’s powers and the rights of the parties under investigation are grounded in the FADP and in general Swiss administrative procedure, and they follow a recognisable sequence from intake to appeal.

Complaint and investigation process

Enforcement typically begins in one of three ways: a complaint or report from an affected individual, a notification of a breach, or the authority’s own initiative where it identifies a systematic or serious concern. Once a matter is opened, the EDÖB has investigative powers to request information and documents, to inspect systems and processing records, and to hear the parties. A controller or processor served with an information request should treat it as the formal start of an enforcement process and respond carefully, because what is said at this stage frames the entire proceeding. The authority’s published guidance sets out how it exercises these powers and what cooperation it expects (EDÖB guidance).

Decision, fines and publication

After investigation, the EDÖB can issue binding administrative measures, ordering changes to, suspension of, or termination of processing, and can require the deletion of data. Where conduct amounts to a defined offence, the matter proceeds through the penal route and a fine may be imposed on the responsible natural person by the competent cantonal prosecuting authority rather than by the EDÖB directly. The authority may also publish information about the outcome. Parties are entitled to be heard before an adverse decision is finalised, a cornerstone of Swiss administrative procedure that gives organisations a genuine opportunity to present mitigating facts and remedial steps before the position crystallises.

Appeal and judicial review

Binding orders of the EDÖB are subject to appeal. The ordinary route runs through the Federal Administrative Court, with the possibility of a further appeal to the Federal Supreme Court (Bundesgericht/Tribunal fédéral) on points of law. Penal fines imposed through the criminal route are challenged through the criminal appeal channels. Judicial review is a meaningful check: organisations that believe an order exceeds the authority’s powers, misapplies the statute or rests on a flawed factual basis have a clear path to challenge it, and relevant decisions are searchable in the Federal Supreme Court’s case-law database (bger.ch). Because appeal deadlines in Swiss administrative and criminal procedure are short and strict, the decision to appeal must be made quickly and with counsel.

When are FADP fines in Switzerland imposed? Risk triggers and common violations

In practice, exposure to FADP fines Switzerland clusters around a predictable set of failures. The most common triggers include:

• Inadequate transparency. Failing to provide the information individuals are entitled to at the point of collection, or responding incompletely to access requests, is a recurring source of complaints.
• Unlawful processing. Processing personal data in breach of the FADP’s principles, for example beyond the purpose communicated, or in breach of the proportionality and good-faith principles.
• Weak security. Failure to implement appropriate technical and organisational measures proportionate to the risk, which can expose responsible persons to penal consequences where the minimum security requirements defined by the Federal Council are intentionally disregarded.
• Cross-border transfer failures. Transferring personal data abroad to countries without adequate protection and without a valid safeguard mechanism.
• Non-cooperation. Ignoring or providing false information in response to a lawful request from the EDÖB, which is itself capable of attracting sanction.

Two illustrative scenarios show how these triggers play out. In the first, a mid-sized online retailer continued to send marketing to customers who had objected and could not produce records showing how consent had been captured; the resulting complaint exposed both an unlawful-processing issue and a documentation failure that made the conduct harder to defend. In the second, a services firm suffered a data breach caused by an unpatched system and had no evidence that it had assessed security risk or implemented basic safeguards; the absence of any demonstrable technical and organisational measures turned a security incident into a compliance failure with potential consequences.

Both cases point to the same lesson: the ability to produce contemporaneous evidence of compliance is frequently what separates a manageable enquiry from a sanction.

Personal liability, can executives, DPOs or board members be fined?

This is the question that most concerns senior management, and it is where the Swiss regime diverges most sharply from the GDPR. Because the FADP’s fines attach to defined offences, the penal fine is in principle imposed on the natural person who committed the offence, not automatically on the company. That design choice means personal liability is not a theoretical edge case under Swiss law; it is the default mechanism through which penal fines are levied.

Corporate versus individual exposure

Under Swiss criminal law principles, an offence requires a culpable natural person. For FADP offences, the law looks to the individual within the organisation who was responsible for the breach, which may be an executive, a manager with delegated authority, or another individual charged with the relevant function. Swiss law contains a mechanism under which a company may, in defined low-value situations, be fined in place of identifying the specific individual, in order to avoid disproportionate investigative effort. But the architecture is fundamentally person-focused. The upshot is that executives cannot assume the corporate entity will absorb every penalty; where a defined offence is established and a culpable individual identified, that individual is exposed.

This is the heart of personal liability for data protection in Switzerland, and it deserves explicit board-level attention.

Whether any particular individual is liable turns on culpability and on how responsibilities were allocated. A board member who had no operational involvement and had put in place a credible compliance framework stands in a very different position from a manager who personally directed unlawful processing or ignored clear warnings. The data protection adviser, where one is appointed, is generally an advisory and oversight function rather than the decision-maker on processing, but an individual who provides false information to the authority or actively participates in an offence is not immune.

Practical steps to reduce executive liability

Reducing personal exposure is about building a defensible compliance posture and documenting it. The following measures are the most effective:

• Clear delegation and role allocation. Document who is responsible for each processing decision and for security, so that accountability is deliberate rather than accidental.
• Maintain records of processing activities. A current, accurate RoPA is the backbone of demonstrable compliance and the first thing an investigator will ask to see.
• Appoint and empower a data protection adviser. Giving a qualified person genuine authority and resources shows the organisation took its obligations seriously.
• Keep evidence of policies and training. Policies that exist only on paper carry little weight; records showing they were implemented, communicated and followed carry a great deal.
• Act on known risks. Where a vulnerability, complaint or audit finding is identified, document the response. Inaction after a warning is the single most damaging fact in a culpability assessment.

Boards should also consider how directors’ and officers’ insurance responds to defence costs, and should seek early advice when exposure crystallises. Knowing when to hire counsel, and understanding the likely cost, is itself part of prudent risk management; organisations can review indicative engagement costs via the Data privacy lawyer fees, Switzerland (2026) guide before an incident forces a hurried decision.

Calculating FADP fines in Switzerland, mitigating and aggravating factors

Where a fine is in play, several factors shape the outcome. In the Swiss penal context, sentencing principles take account of the gravity of the conduct, the degree of fault, and the personal circumstances of the offender. In parallel, the EDÖB’s willingness to pursue formal measures, and the severity of any corrective order, is influenced by the scope and seriousness of the breach, whether it was systematic or isolated, the level of cooperation shown, and the speed and quality of remediation. Voluntary disclosure, prompt containment and demonstrable corrective action consistently count in an organisation’s favour, while concealment, repeat conduct and obstruction are aggravating.

It should be noted that the FADP’s penal provisions generally require intentional conduct for a fine to be imposed; negligent breaches are, as a rule, not penalised in the same way.

The following comparison highlights why the Swiss approach cannot be read through a GDPR lens.

The practical takeaway from this comparison is that the GDPR’s eye-catching percentage-of-turnover maxima do not translate to Switzerland. The exact franc figures, the precise offences and the maximum penalties must be confirmed against the official FADP text on Fedlex, and organisations should not import GDPR assumptions into their Swiss risk models.

Responding to an EDÖB investigation, checklist and timeline

A structured response to an enforcement enquiry materially improves outcomes. The following phased approach helps counsel and privacy leads keep control.

1. Immediate (0–72 hours). Confirm the scope of the request or incident, identify the internal owner, preserve all relevant evidence and logs, and impose a hold discipline so that nothing is deleted. Where a reportable breach is involved, assess notification obligations without delay, the FADP requires notification to the EDÖB as soon as possible. Engage counsel early.
2. Short term (72 hours–30 days). Conduct a factual investigation, map the processing at issue against the statute, prepare a considered response to the authority, and begin remediation. Document each decision. Consider whether voluntary corrective measures should be proposed proactively.
3. Medium term (beyond 30 days). Finalise remediation, update policies, RoPA and security measures, prepare submissions on mitigation, and, if an adverse order is issued, assess appeal prospects against the short statutory deadlines.

Throughout, assign clear internal ownership: a senior sponsor at board level, a legal lead, a security lead and a communications lead. The quality of the organisation’s documentation and the credibility of its remediation are the two factors most likely to influence whether an enquiry resolves with corrective guidance or escalates toward sanction. Because specialist input early can change the trajectory, many organisations review counsel options and indicative costs before an incident, using the Data privacy lawyer fees, Switzerland (2026) guide as a starting point.

Cross-border issues and enforcement cooperation

Because the FADP reaches processing abroad that has effects in Switzerland, international groups must take Swiss exposure seriously even where their main establishment is in the EU. In practice, many organisations find their Swiss and GDPR obligations overlap, but the sanctions pathways differ, and a single incident may attract separate scrutiny from the EDÖB and from EU authorities. The EDÖB can cooperate with foreign regulators, but its direct coercive powers are limited to Switzerland; enforcement against entities with no Swiss presence depends heavily on cross-border cooperation and the availability of assets or operations within reach. For comparative context on how enforcement standards and international data-protection practice have converged, inter-governmental guidance published by the OECD is a useful reference point.

The headline for Swiss operations is simple: do not treat GDPR compliance as automatic FADP compliance, and do not assume that distance from Switzerland eliminates risk.

Practical takeaways, boardroom checklist

• Confirm your organisation falls within FADP scope, including any processing abroad with Swiss effects.
• Maintain a current, accurate record of processing activities as your primary evidence of compliance.
• Document delegation of data protection responsibilities so accountability is deliberate.
• Implement and evidence appropriate technical and organisational security measures.
• Appoint and resource a data protection adviser with genuine authority.
• Establish a breach and enquiry response plan with named owners and defined timelines.
• Keep records of training, policy implementation and responses to known risks.
• Line up specialist counsel in advance and understand appeal deadlines before you need them.

Conclusion and next steps

FADP fines Switzerland operate through a distinctively Swiss architecture, penal fines targeting responsible individuals, combined with the EDÖB’s power to order corrective measures, rather than the turnover-based corporate fines familiar from the GDPR. For boards and privacy leads, the practical priorities are clear: understand that personal liability is the default mechanism for penal fines, build and document a defensible compliance posture, verify every statutory figure against the official FADP text, and have a response plan ready before an enquiry lands. Organisations that treat compliance as evidence to be produced, not merely policy to be filed, are consistently better placed when scrutiny arrives.

For tailored advice on exposure, enforcement response or reducing executive risk under the FADP, speak to the data privacy experts at Global Law Experts.

This article is for general information only and does not constitute legal advice. Organisations should seek specific counsel on their particular circumstances.

Sources

1. Federal Act on Data Protection (FADP), Swiss Confederation / Fedlex
2. Federal Data Protection and Information Commissioner (EDÖB / FDPIC)
3. Swiss Confederation, admin.ch (Federal Council communications)
4. Swiss Federal Supreme Court (Bundesgericht / Tribunal fédéral)
5. University of St. Gallen, MCM Data Protection in Swiss Law Firms report
6. OECD, comparative privacy and enforcement guidance