What Are Data Retention Requirements in Switzerland? HR, Accounting & FADP Storage-limitation, 2026 Guide

Understanding what are data retention requirements is one of the most consequential compliance tasks facing employers in Switzerland today. The legal landscape is shaped by overlapping obligations, the revised Federal Act on Data Protection (FADP), the Code of Obligations (CO), labour ordinances, and sector-specific rules, each imposing distinct retention periods that range from 72 hours for CCTV footage to 10 years for accounting records and, in exceptional cases, up to 40 years for occupational health data.

With organisations across Switzerland updating their retention schedules for 2026 compliance cycles and the Federal Data Protection and Information Commissioner (FDPIC) continuing to issue practical guidance on the storage-limitation principle, now is the time for HR leaders, in-house counsel, and compliance teams to audit their data retention requirements in Switzerland and close any gaps before inspectors come calling.

• HR records: 5–10 years depending on category (working time records 5 years; payroll records 10 years).
• Accounting records: 10 years from the end of the financial year (Art. 958f CO).
• FADP storage-limitation principle: Personal data must not be kept longer than necessary, every retention period must be justified and documented.

Quick Reference, Swiss Data Retention Requirements Table

The table below consolidates the most common record types that Swiss employers must manage. It is designed as an audit-ready reference, each row pairs a retention period with its legal basis so that compliance teams can verify their schedules at a glance. Industry observers expect this kind of structured retention inventory to become a baseline expectation during FDPIC assessments.

This table serves as a starting point. Every organisation should map its own data categories against the applicable legal bases and add sector-specific obligations where relevant.

Swiss Legal Framework, FADP, Code of Obligations and Sector Law

Switzerland does not rely on a single statute to govern data retention. Instead, employers must navigate three interlocking layers of regulation that together define the data retention requirements in Switzerland.

The Revised Federal Act on Data Protection (revFADP)

The revised FADP entered into force on 1 September 2023, replacing the 1992 statute. It enshrines the storage-limitation principle: personal data may only be processed for as long as the purpose of processing requires. Once the purpose is fulfilled, and no overriding legal obligation mandates longer retention, the data must be deleted or anonymised. The FADP does not prescribe fixed retention periods; instead, it requires controllers to justify each period they apply and to document that justification in their records of processing activities.

Code of Obligations, Art. 958f

The CO imposes its own, purpose-specific retention obligations. Art. 958f requires every entity subject to Swiss accounting law to retain its accounting books, accounting vouchers, and the business and audit reports for a period of ten years from the end of the financial year to which they relate. Digital records must be kept in an unalterable, readable format, a requirement reinforced by the Ordinance on the Maintenance and Retention of Accounts (GeBüV). Payroll records fall within this scope because they form part of the accounting documentation.

Labour Law and Sector-Specific Obligations

The Labour Act and its implementing ordinances (ArGV) impose a five-year retention requirement for working time records. Tax obligations administered by the Swiss Federal Tax Administration (ESTV) dovetail with the CO to require retention of tax-relevant documentation for at least ten years. Meanwhile, sector-specific rules, such as those governing occupational health, financial services, and telecommunications, can extend retention periods substantially. Employers must identify every applicable obligation and map it to the relevant data category.

HR and Employment Records, What Are Data Retention Requirements for Employees?

Employee records retention in Switzerland is one of the most frequently audited areas because the data is both sensitive and voluminous. The FDPIC has emphasised that employers must be able to demonstrate why each category of HR data is kept and for how long. Below is a breakdown by record type.

Payroll Records and Payslips, 10 Years

Payroll data, including payslips, salary certificates, bonus calculations, and social insurance contribution records, must be retained for ten years from the end of the relevant financial year. This obligation flows from Art. 958f CO, because payroll records constitute accounting vouchers. The AVS (old-age and survivors’ insurance) system also relies on employers maintaining accurate records of contributions, and inspectors may request access during compliance audits. In practice, payroll records retention in Switzerland should be treated as a non-negotiable ten-year minimum.

Working Time Records, 5 Years

Under the Labour Act and its ordinances, employers must record the working hours of their employees and retain those records for five years. Labour inspectors, both cantonal and federal, may request access at any time during this window to verify compliance with maximum working hours, rest period requirements, and overtime regulations. Simplified recording rules exist for certain categories of employees (such as those in management positions with significant autonomy), but even where simplified recording applies, the five-year retention obligation remains. This is a critical element of data retention requirements in Switzerland that HR teams cannot overlook.

Employment Contracts and Personnel File Components, 5 to 10 Years

Employment contracts, performance appraisals, disciplinary records, reference letters, and similar personnel file components do not have a single statutory retention period. Instead, their retention is governed by a combination of the FADP storage-limitation principle and the general limitation periods under the CO. Claims arising from employment relationships, such as wrongful dismissal, discrimination, or wage disputes, are generally subject to a ten-year limitation period under Art. 127 CO, although shorter periods apply to certain claims (e.g., five years for wage claims under Art. 128 CO).

The practical effect is that most employers retain core personnel file documents for ten years after the employment relationship ends, unless a shorter period can be justified. The FDPIC expects employers to document this justification in writing, not simply to apply a blanket ten-year retention to all HR documents without analysis. Performance appraisals, for instance, may have little relevance after a claim limitation period has expired and should be reviewed for deletion sooner.

Accounting and Tax Records, The 10-Year Rule Explained

Art. 958f of the Swiss Code of Obligations requires the retention of accounting records for ten years, making this one of the longest and most universally applicable retention obligations in Swiss law. The scope is broad.

The following documents fall within the ten-year retention requirement:

• Accounting books. General ledger, journals, and subsidiary ledgers.
• Accounting vouchers. Invoices, receipts, bank statements, contracts that underlie accounting entries, and payroll records.
• Annual reports. Balance sheets, income statements, and notes to the financial statements.
• Audit reports. Reports from statutory auditors, where applicable.
• Business correspondence. To the extent it serves as an accounting voucher.

The ten-year period begins to run at the end of the financial year to which the records relate, not from the date of the individual transaction. For digital records, the Ordinance on the Maintenance and Retention of Accounts (GeBüV) imposes additional requirements: records must be stored in an unalterable format, remain readable throughout the retention period, and be capable of being printed or otherwise reproduced on demand.

Tax obligations administered by the ESTV align with the CO requirement. The Federal Tax Administration expects taxpayers to retain all records relevant to the assessment of direct federal tax and VAT for at least ten years. In practice, this means that the accounting records retention 10 years Switzerland rule serves a dual accounting-and-tax purpose, and failing to meet it can trigger penalties under both regimes.

FADP Storage-Limitation Principle and FDPIC Practical Guidance

The FADP storage-limitation principle is the overarching rule that governs all data retention requirements in Switzerland, regardless of the specific legal basis for retention. It operates as both a floor and a ceiling: data must be retained for as long as the law requires (floor), but must not be kept beyond the point at which retention is no longer justified (ceiling).

How the FDPIC Expects Employers to Apply Storage Limitation

The FDPIC has published guidance outlining the technical and organisational measures (TOMs) that controllers must implement. With respect to retention, the FDPIC expects employers to take the following steps:

• Maintain a documented retention schedule. Every data category should have a defined retention period with a cited legal basis or justified business purpose.
• Record retention rationale in the Record of Processing Activities (ROPA). The FADP requires controllers to maintain a ROPA; retention periods and their justifications should be an integral part of this document.
• Implement automated deletion or anonymisation. Where technically feasible, retention periods should be enforced through automated processes rather than relying on manual review alone.
• Review and update retention schedules periodically. The FDPIC recommends annual reviews to ensure that retention periods remain justified in light of legal changes, business needs, and evolving risks.

Practical Examples, FDPIC Guidance in Action

The difference between a compliant and a non-compliant retention practice often comes down to documentation. Consider two examples. An employer retains working time records for five years and documents the legal basis (ArGV) in its ROPA, this is compliant. The same employer retains CCTV footage indefinitely “just in case” without any documented purpose, this violates the FADP storage-limitation principle and exposes the organisation to regulatory scrutiny. Early indications suggest that the FDPIC is paying increasing attention to retention schedules during its assessments, making documented justification a practical necessity rather than a theoretical best practice.

Exceptions and Special Categories, Health, CCTV, Logs and Safety

Several categories of data are subject to retention rules that diverge significantly from the standard five-to-ten-year ranges. Understanding these exceptions is essential for a complete picture of what are data retention requirements across all operational contexts.

• Health and occupational medicine records. Employers in sectors involving hazardous substances, radiation exposure, or other occupational health risks may be required to retain employee health records for periods of up to 40 years. These records qualify as special category data under the FADP, requiring heightened security, strict access controls, and purpose limitation.
• CCTV and video surveillance footage. The FDPIC has indicated that 72 hours is a proportionate baseline retention period for CCTV footage where the purpose is security monitoring. Retention beyond this window is only justified if a specific incident has occurred and the footage is needed for investigation or legal proceedings. A documented CCTV retention policy is mandatory.
• Server and security logs. Retention periods for IT security logs vary depending on the organisation’s risk profile and regulatory environment. Periods of 90 days to three years are common, but each must be justified under the FADP proportionality principle and, where applicable, aligned with ISO 27001 or similar security standards.
• Litigation holds. When legal proceedings are pending or reasonably anticipated, the normal deletion schedule must be suspended for all data relevant to the dispute. This overrides the standard retention period but must be documented and reviewed once the hold is no longer necessary.
• Canton-level archival laws. Public-sector employers and entities subject to cantonal archival legislation may face additional retention or transfer-to-archive obligations that supplement federal requirements.

Practical Steps for Employers, How to Build a Swiss Data Retention Schedule

A retention schedule is more than a compliance document, it is the operational backbone of an organisation’s data governance framework. The following step-by-step approach translates the data retention requirements Switzerland imposes into a workable process.

1. Map all data categories. Inventory every type of personal and non-personal data your organisation holds, from HR files and payroll to CCTV footage and server logs. Engage department heads to ensure completeness.
2. Assign a legal basis to each category. For every data type, identify the statute, ordinance, or legitimate interest that justifies retention. Where multiple legal bases overlap (e.g., payroll records subject to both Art. 958f CO and AVS requirements), cite all of them.
3. Define the retention period and trigger. Specify when the retention period starts (e.g., end of financial year, end of employment relationship) and when it ends. Avoid open-ended or “indefinite” retention, the FADP does not permit it without documented justification.
4. Obtain DPO or legal sign-off. The retention schedule should be approved by your Data Protection Officer (if appointed) or external legal counsel. This sign-off should be recorded and dated.
5. Implement deletion and anonymisation procedures. Build automated deletion workflows where systems allow. For manual processes, assign clear responsibilities and timelines. Ensure that deletion is verifiable, maintain audit logs recording what was deleted, when, and by whom.
6. Conduct annual reviews. Retention schedules become outdated as laws change, business activities evolve, and new data categories emerge. Schedule an annual review and document the outcome, even if no changes are made.

A sample policy statement for a retention schedule entry might read: “Working time records are retained for five years from the end of the calendar year to which they relate, pursuant to the Labour Ordinance (ArGV). Deletion is performed automatically by the HR system on 31 March following expiry. Exceptions require written approval from the DPO.”

Enforcement, Penalties and Good Practice, What Auditors and Inspectors Look For

The FDPIC has the authority to investigate and issue recommendations regarding data processing practices, including retention. While the revised FADP introduced criminal penalties for certain violations (including fines of up to CHF 250,000 for wilful breaches by responsible individuals), the primary enforcement mechanism for retention-related issues remains the FDPIC’s investigative and recommendation powers. Labour inspectors, operating at cantonal and federal level, independently verify compliance with working time recording and retention obligations.

Industry observers expect inspectors and auditors to focus on the following areas:

• Accessibility and readability. Can records be retrieved and read within the statutory retention period? Digital records stored in obsolete formats fail this test.
• Documented justification. Is there a written retention schedule that links each data category to a legal basis? Blanket retention policies without category-level analysis are increasingly viewed as inadequate.
• Deletion records. Can the organisation demonstrate that data was deleted on schedule? Audit logs for deletion actions are considered good practice.
• Annual review evidence. Has the retention schedule been reviewed in the past 12 months? Dated review records strengthen the organisation’s compliance posture.

Swiss Data Retention Requirements, Comparison by Record Type

The following table provides a consolidated comparison of retention periods by record type, designed for quick reference during compliance audits.

Conclusion

Swiss data retention requirements are not governed by a single rule but by a matrix of overlapping obligations, from the FADP’s storage-limitation principle to the ten-year accounting mandate under Art. 958f CO and the five-year working time record rule under the Labour Ordinance. For employers preparing their 2026 compliance audits, the essential task is to build a documented, category-level retention schedule that pairs every data type with its legal basis, implements automated deletion where possible, and undergoes annual review. Understanding what are data retention requirements, and translating that understanding into operational policy, is the foundation of data protection compliance in Switzerland. Employers who need tailored guidance can find a data privacy lawyer through the Global Law Experts directory.

Sources

1. Federal Data Protection and Information Commissioner (FDPIC / EDÖB), FAQ & Guidance
2. FADP (revised Federal Act on Data Protection), Consolidated English Translation
3. Swiss Code of Obligations, Art. 958f / KMU Admin Guidance on Electronic Bookkeeping
4. Swiss Federal Tax Administration (ESTV), FAQ on Record Retention