nFADP: Swiss law already applies to your AI

Many Swiss leaders tell us: “we are not in the EU, GDPR is for others.” Wrong on two counts.

One — as soon as you target clients in the Union, GDPR can apply as well.
Two — for everything else, the Federal Act on Data Protection (revised FADP, nFADP), in force since 1 September 2023, is already here. And it is technology-neutral.

The Federal Data Protection and Information Commissioner (FDPIC) has repeated: this law applies directly to processing that goes through AI. No need to wait for a “Swiss AI law”. The Federal Council signed the Council of Europe convention; consultation on implementing texts is not tomorrow morning. Meanwhile, the FADP is in charge.

(On 28 January 2026, Data Protection Day, the FDPIC even returned to generative AI uses — the topic is no longer theoretical.)

It is not a “small GDPR”

The two texts look alike (purpose, proportionality, security, access rights). Differences that matter for a 12-person SME:

	nFADP (Switzerland)	GDPR (EU)
Authority	FDPIC	CNIL (France) and peers
Breach to notify	High risk, “as soon as possible” (Art. 24) — not an automatic 72 h clock	72 h in principle (Art. 33), unless exception
Sanctions	Criminal fines mainly targeting individuals (directors), up to CHF 250,000, on complaint, for intentional breach of certain duties (Art. 60)	Administrative fines against the organisation (turnover caps)
Processing register	Mandatory, with possible exception if fewer than 250 employees and negligible risk (Art. 12 + ordinance)	Similar logic, 250 exception too — to document

Office-manager translation: in Switzerland, “we’ll see if the FDPIC writes” is not the plan. For some failures (information, access rights, cooperation with an inquiry), the director can be targeted. Not for a typo. For voluntary refusal to inform or cooperate.

And the register: fewer than 250 people does not exempt if you process sensitive data at scale, or high-risk profiling. An AI assistant hooked to the whole mailbox is not “negligible” by magic. When in doubt, keep the register. It fits in a spreadsheet.

Everyday AI, through the FDPIC’s lens

On practical examples, the Commissioner stresses Art. 6 FADP: lawfulness, good faith, proportionality, purpose.

The classic trap: you collected emails to reply to clients. Pasting them into a US chatbot to “improve the vendor’s model” is often a change of purpose. You must justify it — consent, or a ground in law. “It is handy” is not one.

Same idea as GDPR / CNIL: the consumer tool is not a safe. Transfers to the USA remain an issue (Swiss–US framework, clauses, subprocessors). A datacenter “somewhere in Europe” does not erase a US parent.

What we ask you to do this week

Not a “compliance 2028” project.

• One written sentence: no client / employee data in ChatGPT, consumer Copilot, Gemini, Claude — until you have framed the processor.
• Know where the tool you keep runs (Switzerland, EU, US) and who can be forced to hand it over.
• Be able to erase an index if someone exercises their rights.

AroBox is built for that: data and index at your premises; inference on private Arobass infrastructure in Switzerland. 15-day trial, on quote. DPA and contract separately.

This is not legal advice. For a specific case: your counsel, or the FDPIC.

Request a trial — we install on your premises, and nFADP is no longer a slide promised “later”.