revDSG and GDPR: what applies to Swiss companies

Many Swiss companies fall under both rule sets at the same time. The revised Swiss data protection act has applied since 1 September 2023 to processing with a Swiss connection. The GDPR applies on top as soon as you address people in the EU. What decides this is not where your company sits but who you are speaking to.

When each law applies

The revDSG attaches to a Swiss connection. The GDPR follows the marketplace principle: it applies when you deliberately offer goods or services to people in the EU or monitor their behaviour. Indicators include pricing in euros, shipping into the EU, or running your website in a language and tone clearly aimed at an EU audience. A website merely being reachable from abroad is not enough on its own.

The basic difference: permission or prohibition

The GDPR is a prohibition with reservation of permission: every processing activity needs one of the legal bases in Art. 6 GDPR, such as contract, consent or legitimate interest, otherwise it is unlawful. The revDSG works the other way round. Private parties may process personal data in principle, as long as they respect the principles: lawfulness, good faith, proportionality, purpose limitation, accuracy and data security (Art. 6 revDSG). Only when processing violates someone's personality, for instance because it breaches those principles or goes against the person's express will, is a justification required (Art. 30 and 31). Day to day this produces similar duties but different paperwork: under the GDPR you record a legal basis for every processing activity; under the revDSG alone you record that the principles are met.

Where the two diverge in practice

• Who gets sanctioned. The GDPR provides for fines against companies, up to 20 million euros or 4 percent of worldwide annual turnover. The revDSG instead aims its penalty provisions primarily at responsible private individuals, with fines up to 250,000 francs and only for intentional breaches (Art. 60 ff.). That shifts the question of responsibility inside the business noticeably.
• Data protection adviser. The GDPR mandates a data protection officer in certain cases. The revDSG knows the data protection adviser as a voluntary role (Art. 10); a company that appoints one and notifies the Swiss commissioner may skip consulting the commissioner when an impact assessment leaves a high residual risk.
• Representative. Foreign companies that process data of people in Switzerland extensively and with high risk need a representative in Switzerland (Art. 14 revDSG). Conversely, Art. 27 GDPR requires Swiss companies without an EU establishment to appoint an EU representative under similar conditions.
• Record of processing activities. Both know the concept. In Switzerland, companies with fewer than 250 employees are exempt as long as the processing carries low risk. That exemption relieves many smaller firms.
• Reporting breaches. The GDPR names a 72-hour deadline. The revDSG requires a report to the Swiss commissioner as quickly as possible, with no fixed hour count, but with its own threshold for when a report is needed at all.
• Consent. The GDPR requires active consent for many kinds of processing. The revDSG leans more on transparency and recognisable purposes, and requires explicit consent above all for particularly sensitive data.

What this means day to day

Companies serving both markets usually end up following the stricter standard. Keeping two parallel processes for consent, deletion and information requests cleanly apart costs more in operation than it saves. Companies serving only Swiss customers can make life simpler in places, but should record that assessment in writing rather than assuming it quietly.

Where a closer look pays off

It gets delicate where data leaves the country, where particularly sensitive data is involved, and where the tools in use come from providers subject to US law. Those three points justify a legal review, while everyday website practice usually manages with a clean baseline. What that baseline looks like for a company website is in the revDSG checklist for websites.

Data flows between Switzerland and the EU

Transfers are eased in both directions: the Federal Council lists the EU and EEA states as countries with adequate data protection, and the European Commission has recognised Switzerland as providing an adequate level of protection since 2000, a recognition it confirmed in its January 2024 review. Data going from Zurich to Berlin or back therefore needs no standard data protection clauses. Tools that process data in the US are different: there the EU relies on the EU-US Data Privacy Framework and Switzerland, since 15 September 2024, on the corresponding Swiss-US framework, both only for providers that have certified. Whether a provider is certified can be checked in the public list of the US Department of Commerce.

Three typical cases

• Local service in Zurich with a German-language website, prices in francs and no delivery abroad: revDSG alone. A cookie notice with a refusal option under the Telecommunications Act is enough.
• Online shop delivering to Germany and showing prices in euros: revDSG and GDPR. Consent banner, a legal basis per processing activity and possibly an EU representative under Art. 27 GDPR.
• Software with users in the EU: the GDPR in full, plus the Swiss specifics such as reporting to the Swiss commissioner. Here a legal review before the product goes live pays off.

Which rules come on top when AI tools are used is covered in the article on AI and data protection. Legal text: Federal Act on Data Protection (FADP, SR 235.1) on Fedlex.

This text is an orientation and not legal advice. Which rules apply to your specific situation belongs, in case of doubt, with a specialised lawyer.