The law already covers AI
The revised Federal Act on Data Protection, called nFADP in English and revDSG, nDSG, nLPD or LPD in the national languages, has been in force since 1 September 2023. It is written to be technology neutral. The Federal Data Protection and Information Commissioner (FDPIC) has stated that it applies directly to AI-supported data processing. There is currently no separate Swiss AI law that SMEs must follow.
Personal data in prompts
Personal data is any information about an identified or identifiable person. With AI it often appears without anyone noticing. A typical case: an employee pastes a customer email into a public chat tool to get a quick reply. The email contains a name, an address and perhaps the details of a complaint. That is processing of personal data, and it now happens at a third party, often outside Switzerland. Watch especially for:
- Customer and supplier emails with names, phone numbers and addresses
- HR documents such as CVs, references or absence records
- Health information, for example in medical practices or insurance broking, which counts as sensitive personal data
The simplest rule is data minimisation. Send the AI only what it needs for the task. Often the work can be done with names removed or replaced by placeholders. Where that is not possible, use a setup where you control where the data is processed and what the provider may do with it.
AI providers are processors
When an external service processes personal data on your behalf, the nFADP calls it a processor (Art. 9). You remain responsible as the controller. You may only hand over data if the processor handles it the way you yourself would be allowed to, and you must make sure it guarantees data security. In practice this means a written data processing agreement. Before you use an AI service with real data, check that the contract covers at least:
- What data is processed and for what purpose
- That the provider does not use your data to train its models
- Where data is stored and processed, including sub-processors
- How long inputs and outputs are kept and when they are deleted
- Technical and organisational security measures
- Support in case of a data breach or a request from a data subject
Sending data abroad
Many AI models run in data centres outside Switzerland. Under Art. 16 nFADP, personal data may be disclosed abroad if the Federal Council has decided that the destination country offers adequate protection. The list in the Data Protection Ordinance includes the EU and EEA states, the United Kingdom and several other countries. Since 15 September 2024, the United States counts as adequate only for companies certified under the Swiss-US Data Privacy Framework.
For other countries, or US providers without certification, you need additional safeguards, typically standard contractual clauses recognised by the FDPIC, together with an assessment of the risks in the destination country. Art. 17 allows a few exceptions, such as explicit consent, but they are not meant as a basis for routine operations.
| Hosting option | What it means for data protection |
|---|---|
| Switzerland | No transfer abroad. The simplest position for sensitive data and public offices. |
| EU or EEA | Adequate under Swiss law. A solid choice for most SME use cases. |
| USA, certified provider | Adequate if the provider is certified under the Swiss-US Data Privacy Framework. Check the certification and which services it covers. |
| Other countries | Standard contractual clauses and a risk assessment needed. Avoid for personal data unless there is a clear reason. |
Information duties and automated decisions
Under Art. 19 nFADP you must inform people when you collect their personal data. Your privacy notice should name the purposes, the recipients or categories of recipients and, if data goes abroad, the countries and the safeguards used. If you introduce an AI service that processes customer data, update the privacy notice. If you put a chat assistant on your website, say clearly that visitors are talking to an AI and not to a person.
Art. 21 adds a duty for automated individual decisions. If a decision is based exclusively on automated processing and has a legal effect or a significant impact on the person, for example rejecting a job applicant, you must inform the person. They can ask to state their view and to have a human review the decision. The easiest way to stay clear of this is a design where AI prepares and a person decides. That is how we build our solutions: people approve what the AI prepares.
When you need a data protection impact assessment
Art. 22 requires a data protection impact assessment (DPIA) when processing is likely to lead to a high risk to the personality or fundamental rights of the people concerned. The law names extensive processing of sensitive personal data and systematic monitoring of large public areas as examples, and new technologies can raise the risk. Answering questions about opening hours or reading supplier invoices usually does not reach that level. Analysing patient records, evaluating employees or profiling customers with AI may well do so. If a high risk remains despite the planned measures, the FDPIC must be consulted beforehand (Art. 23).
Also check the record of processing activities (Art. 12). Companies with fewer than 250 employees are exempt unless they process sensitive personal data on a large scale or carry out high-risk profiling. Even if you are exempt, a short list of which AI tools process which data is useful and costs little.
The EU AI Act: relevant if you serve the EU
The EU AI Act does not apply in Switzerland as such. It can, however, apply to Swiss companies that place an AI system on the EU market, or whose AI system produces output that is used in the EU. A Swiss SME that uses an AI tool for its own business in Switzerland is generally not affected. A Swiss software company selling an AI product to EU customers may be. The obligations are being introduced in stages, and parts of the timetable may still shift. For most SMEs the relevant points are transparency, such as telling users they are dealing with an AI, and stricter rules for high-risk uses such as recruitment. If you sell into the EU, check your case specifically.
Practical checklist
- List the AI tools in use, including free ones employees use on their own
- Use business or API offerings with a data processing agreement, not consumer accounts
- Check where data is processed and prefer Switzerland or the EU
- For US providers, check the Data Privacy Framework certification
- Update your privacy notice and label AI chat assistants as AI
- Assess whether a DPIA is needed for sensitive data or profiling
- Write a short internal rule on what may be entered into AI tools, and train your team
How we approach this at Linxa
We build AI solutions for Swiss SMEs and public offices with these rules in mind from the start. Hosting is in Switzerland or the EU on request, client data is not used to train models, and people approve what the AI prepares. In the AI Discovery workshop (from CHF 1,200) we look at your use cases together with their data protection implications, so you know before a pilot which data may go where. For a first opinion, book the free 30-minute consultation by video call.