What Switzerland’s Revised Federal Act on Data Protection (FADP) Covers
Switzerland’s overhauled Federal Act on Data Protection (FADP—known locally as revDSG in German and nLPD in French and Italian) modernized national privacy law to stay aligned with the European Union’s GDPR, preserving Switzerland’s vital EU adequacy status for friction-free cross-border data flows. The statute now focuses exclusively on the personal data of natural persons and expands the category of sensitive personal data to explicitly protect genetic data and uniquely identifying biometric data (such as fingerprints, facial geometry, and voiceprints), alongside health records, religious or political views, and social welfare files.
All private businesses and federal bodies operating in Switzerland must implement “Privacy by Design” (embedding technical safeguards from system architecture onwards) and “Privacy by Default” (pre-configuring settings so only the minimum necessary personal data is processed). Organizations face broad transparency obligations whenever collecting personal data—including disclosing the specific destination countries whenever data is transferred outside Switzerland.
Unlike the EU’s GDPR, which levies administrative fines against corporate turnover, Swiss law relies on a distinctively personal criminal enforcement mechanism: executives or responsible decision-makers who intentionally breach statutory information, access, diligence, or professional secrecy duties face personal criminal fines of up to CHF 250,000.
Role of the Federal Commissioner (FDPIC) and Exercising Your Access & Portability Rights
Oversight rests with the Federal Data Protection and Information Commissioner (FDPIC / EDÖB / PFPDT / IFPD) in Bern, an independent federal authority equipped with binding administrative enforcement powers. Organizations must report high-risk data security breaches directly to the FDPIC, which can investigate systemic compliance failures and issue enforceable orders suspending, modifying, or deleting unlawful data processing.
For individuals living in Switzerland, the most practical statutory tool is the free right of access under Article 25 FADP. Anyone may ask a bank, insurer, credit agency, employer, landlord, or digital platform in writing to confirm whether their data is being processed and to disclose the exact categories held, processing purpose, retention period, data origin, and third-party recipients; controllers must reply free of charge generally within 30 days.
Residents also enjoy the right to rectify inaccurate records, the right to data portability (receiving personal data in a standard electronic format or having it transferred to another provider), and specific safeguards around automated individual decisions: whenever an algorithm makes an automated decision carrying legal or major practical consequences (such as automated credit rejection or insurance underwriting), the company must notify you and grant your request to state your view and have a human review the outcome.
Top Four Cyber Scams Flagged by Switzerland’s Federal Office for Cybersecurity (BACS)
Switzerland’s Federal Office for Cybersecurity (FOCBS / BACS—upgraded from the former National Cyber Security Centre NCSC) tracks thousands of fraud attempts tailored specifically to Swiss banking and payment habits. First is fake bank or tech support fraud: criminals call or text posing as anti-fraud specialists from major Swiss banks or PostFinance, claim an unauthorized transfer is underway, and pressure victims into installing remote-control tools such as AnyDesk or TeamViewer or approving fraudulent mobile push notifications.
Second is classifieds and TWINT phishing targeting sellers on Swiss second-hand marketplaces (Ricardo, Tutti, Anibis, or Facebook Marketplace). Fraudsters pose as eager buyers and send a link or QR code supposedly needed to “receive” a TWINT or Swiss Post courier payment; in reality, the cloned page harvests e-banking credentials to register TWINT on the criminal’s device or triggers an outgoing money request rather than an incoming payment. Third is QR-bill manipulation (Quishing), where attackers replace the IBAN embedded inside a Swiss QR code—via phishing emails or physical stickers—while leaving the printed beneficiary text untouched.
Fourth is caller-ID spoofing by fake Cantonal Police or judicial officers: using VoIP spoofing, scammers make a genuine Cantonal Police station number or variations of emergency number 117 appear on the victim’s screen. Fabricating urgent stories about imminent burglaries or corrupt bank staff, they manipulate residents—especially seniors—into withdrawing cash, gold bars, or bank cards and handing them to purported “undercover officers”.
Phishing-Resistant Two-Factor Authentication (2FA), Passkeys, and Rapid Incident Response
Cybersecurity specialists at BACS and the Swiss banking security initiative “eBanking – but secure!” emphasize that phishing-resistant multi-factor authentication stops the vast majority of account takeovers. Across email accounts, official Swiss e-government logins (AGOV and SwissID), pension portals, and cloud storage, residents should move away from interceptable SMS codes toward biometric Passkeys, FIDO2 hardware security keys, or dedicated authenticator apps paired with unique passwords stored in a password manager.
Within Swiss e-banking, optical cryptographic readers such as PhotoTAN and CrontoSign encode the exact recipient IBAN and CHF amount directly into the coloured mosaic graphic. Taking five seconds to read and match both the beneficiary IBAN and amount on your secondary screen right before tapping “Approve” immediately exposes both banking malware and tampered QR-bills.
If you ever suspect you entered credentials on a spoofed page or approved an unauthorized prompt, act within minutes: call your bank’s official 24/7 emergency card- and account-blocking hotline printed on the back of your card, reset passwords from an uncompromised, clean device, submit the malicious link or phone number via the official BACS reporting portal (antiphishing.ch / report.ncsc.ch), and file a formal criminal complaint with your local Cantonal Police.
| Threat or Statutory Right | Typical Warning Sign | Verification Check | Correct Action |
|---|---|---|---|
| TWINT & Marketplace Phishing | Buyer sends external link or QR code to “receive” funds | Receiving TWINT only requires your mobile number—never a link | Cut contact immediately; never enter e-banking logins or TANs |
| Tampered Swiss QR-Bill (Quishing) | Unexpected invoice email or sticker over printed QR square | Match IBAN and payee name on your PhotoTAN screen vs paper | Abort payment and verify by calling the supplier’s known number |
| Caller-ID Spoofing (Fake Police/Bank) | Urgent demand for AnyDesk, PINs, secrecy, or cash handover | Swiss police and banks never request remote access, PINs, or cash | Hang up at once and dial 117 or your bank’s official number yourself |
| FADP Access Right (Art. 25) | Unclear data profiling, credit scoring, or automated denial | Send written subject access or portability request to controller | Free disclosure within 30 days; escalate violations to the FDPIC |
Staying safe online in Switzerland rests on combining your statutory FADP privacy rights with disciplined payment habits: adopt Passkeys, verify every IBAN and franc amount directly on your PhotoTAN display before signing, and hang up immediately on any urgent phone request involving banking access or cash.