Law note · Switzerland
FADP Articles 16-17, Cross-Border Transfer of Personal Data from Switzerland
Transfer abroad is permitted without extra safeguards to a state or international body the Federal Council has found provides an adequate level of protection, a maintained list that includes the EU and EEA states.
Absent adequacy, a transfer needs a safeguard: standard contractual clauses, the EU SCCs work with a Swiss-law addendum, binding corporate rules, or one of the narrower Article 17 derogations, explicit consent, contract necessity, overriding public interest, life or safety, or transfer of data from a public register. This is structurally the General Data Protection Regulation (GDPR) Chapter V mechanism, adequacy or safeguards or a derogation, not a hard localization duty.
The European Commission's own adequacy decision for Switzerland was reconfirmed 15 January 2024, covering the post-revision regime, and Switzerland's own Federal Council lists the EU and EEA as adequate for outbound transfers, so the relationship is adequate in both directions.
What it asks of an app
- Rely on the Federal Council's adequacy list, standard contractual clauses with the Swiss-law addendum, binding corporate rules, or a narrow Article 17 derogation before moving personal data of a person in Switzerland outside an adequate jurisdiction.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot
Primary source: Fedlex, the Swiss Federal Council's official legislation portal
Federal Office of Justice, Swiss-EU adequacy page