Swiss nFADP (nLPD) · ISO/IEC 27701:2025
How well does your organisation meet the revised Swiss Data Protection Act?
64 requirements covering the revised Federal Act on Data Protection (nFADP / nLPD / revDSG) and its Ordinance (DPO / OPDa / DSV) for private-sector controllers and processors, FDPIC (IFPDT / EDÖB / PFPDT) guidance, and the Annex A controls and clauses 4-10 of ISO/IEC 27701:2025. Guidance highlights where Swiss law differs from the GDPR, for Swiss companies and for EU companies with Swiss customers or staff. Processing by federal bodies is out of scope. Regulatory snapshot: 2 November 2026.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- Report: free summary PDF; with Pro the full report with action plan, guidance, control map, roadmap and Excel export.
64 requirements · 14 assessment areas · mapped to ISO 27701 · 45-90 minutes
nFADP (SR 235.1)Revised Federal Act on Data Protection of 25/09/2020, in force since 01/09/2023 without a transition period (except Art. 69 for ongoing processing with unchanged purpose). Protects natural persons only; criminal fines up to CHF 250,000 on responsible individuals.
DPO / OPDa (SR 235.11) and FDPIC guidanceOrdinance of 31/08/2022 on data security (Art. 1-5), information, breach reporting (Art. 15), access and portability (Art. 16-22), records exemption (Art. 24) and adequacy list (Annex 1, Swiss-US DPF since 15/09/2024); amended 01/12/2025 (federal-body logging, adequacy procedure). FDPIC guidelines on breaches (02/2025) and cookies (2025).
ISO/IEC 27701:2025Standalone privacy information management system standard (published 14/10/2025). Each requirement is linked to Table A.1 (controller), A.2 (processor) and A.3 (security) controls and to clauses 4-10, as a basis for a Statement of Applicability and for certification.
Assessment areas
- PRI – Principles, justification and sensitive data
Art. 6 FADP principles apply to every processing. Swiss private-sector law does not require a legal basis for each processing as the GDPR does: a justification is needed only where personality is infringed (Art. 30-31). Identify sensitive data under the wider Swiss definition and use express consent where required. - GOV – Governance, scope and representative
Define roles and responsibilities: FADP sanctions target individuals, so clear delegations matter. Document scope (natural persons, effects in Switzerland), the optional data protection advisor (Art. 10) and, for foreign controllers, the Swiss representative (Art. 14). - ROP – Records of processing and data inventory
Art. 12 FADP requires records for controllers and processors; DPO Art. 24 exempts organisations under 250 employees unless they process sensitive data on a large scale or carry out high-risk profiling. Keep at least a light record anyway: it drives notices, rights and breach handling. - TRN – Duty to inform
Art. 19 FADP sets a shorter minimum content than the GDPR, but countries of disclosure must be named and intentional failure to inform is a criminal offence. Use layered, plain-language notices in the languages of your Swiss audience. - DSR – Data subject rights
Access and portability within 30 days, free as a rule (max CHF 300 for disproportionate effort). Objection, rectification, erasure and prohibition are enforced as personality protection claims (Art. 32). Map where data lives to answer completely. - ADM – Automated decisions, profiling and AI
Automated individual decisions require information and human review on request (Art. 21). High-risk profiling is a Swiss-specific concept triggering express consent, records, logging and DPIA duties. The FADP applies directly to AI. - PBD – Privacy by design, default and retention
Art. 7 FADP requires data protection by design and by default. A retention schedule with verified deletion or anonymisation (Art. 6(4)) is the control most often missing and most often checked. - PRC – Processors and sub-processors
Art. 9 FADP: assign processing by contract, ensure the processor guarantees security, require prior approval of sub-processors (DPO Art. 7). Reuse GDPR DPAs with a Swiss addendum. ISO/IEC 27701:2025 Table A.2 covers the processor side. - SEC – Data security
Art. 8 FADP and DPO Art. 1-5 set risk-based minimum requirements on confidentiality, availability, integrity and traceability, including patching, logging and processing regulations for high-risk processing. Wilful failure to meet minimum requirements is punishable (Art. 61(c)). - BRN – Data security breaches
Report breaches likely to cause high risk to the FDPIC as soon as possible (no 72-hour deadline), inform data subjects where needed for their protection, and document every breach for two years. Processors report every breach to the controller. - DPI – DPIA and FDPIC consultation
Screen all new or changed processing; carry out a DPIA where high risk is likely (Art. 22), keep it two years after processing ends, and consult the FDPIC or a qualified advisor if residual risk remains high (Art. 23). - TRF – Disclosure of personal data abroad
Use the Federal Council adequacy list (DPO Annex 1), FDPIC-recognised SCCs with Swiss adaptations, BCRs or the Swiss-US DPF for certified US recipients; Art. 17 exceptions only case by case. Name the destination States in notices. - ENF – FDPIC supervision and sanctions
The FDPIC investigates and issues binding rulings; cantonal authorities prosecute criminal offences with fines up to CHF 250,000 on responsible individuals (wilful conduct). Prepare for investigations and keep a legal register covering Swiss and EU rules. - AUD – Training, audits and improvement
Training, internal audits, management reviews and corrective actions turn compliance into a sustained programme and provide evidence of diligence, which matters when intent is assessed in criminal proceedings.
Key regulatory dates
| Date | Source | Status | |
|---|---|---|---|
| 25/09/2020 | Federal Assembly | Revised FADP adopted by Parliament (total revision of the 1992 Act) | In force |
| 31/08/2022 | Federal Council | Data Protection Ordinance (DPO/OPDa) and Data Protection Certification Ordinance (DPCO, SR 235.13) adopted | In force |
| 01/09/2023 | nFADP / DPO | Entry into force of the revised FADP, DPO and DPCO with no general transition period; Art. 69 FADP: Art. 7, 22 and 23 (privacy by design, DPIA, consultation) do not apply to processing started before this date as long as the purpose is unchanged and no new data is collected (no fixed end date) | In force |
| 15/01/2024 | European Commission | Commission report confirming that Switzerland continues to provide adequate protection (EU data can flow to Switzerland without additional safeguards) | In force |
| 15/09/2024 | DPO Annex 1 | Swiss-US Data Privacy Framework: US organisations certified under the Swiss-US DPF added to the adequacy list (Federal Council decision of 14/08/2024) | In force – monitor |
| 06/02/2025 | FDPIC | Guidelines on reporting data security breaches and informing data subjects under Art. 24 FADP (published 07/02/2025); cookie guidelines for private controllers published 03/02/2025 and updated 07/10/2025 | Applicable |
| 08/05/2025 | FDPIC | FDPIC confirms that the FADP applies directly to AI-supported data processing (Federal Council AI approach of 12/02/2025) | Applicable |
| 14/10/2025 | ISO | ISO/IEC 27701:2025 published (standalone PIMS); 2019-edition certificates cease to be valid on 31/10/2028 | In force – transition |
| 01/12/2025 | DPO amendment | DPO amendments in force (Federal Council decision 29/10/2025): new logging rules for federal bodies, FDPIC consulted on adequacy assessments (Art. 8(3)), annual FDPIC reporting on cooperation declarations; private-sector logging duty (Art. 4(1)) substantially unchanged | In force |
| Spring 2027 | Federal Council (FOJ/OFCOM) | Planned consultation on the draft act implementing the Council of Europe AI Convention (amendments expected also to data protection rules); interim progress noted 28/10/2026 | Proposal – monitor |
| To be determined | CJEU | Appeal C-703/25 P (Latombe) against the EU-US DPF judgment pending; an EU ruling could affect confidence in the parallel Swiss-US DPF | Monitor |
Frequently asked questions
Is the Swiss nFADP (nLPD) self-assessment free?
Yes. The questionnaire, the scoring, the dashboard and a summary PDF are free and need no account; your answers stay in your browser and are never sent to our servers. An optional Pro pass (18 EUR for 45 days, all assessments) adds the full PDF report with prioritised action plan and guidance, the evidence tracker, comparisons with previous assessments, the cross-framework view and the Excel export.
Which standard is the Swiss nFADP (nLPD) assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 27701:2025. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
Compliance, legal, IT security and risk functions of organisations established or operating in the EU; it is a self-assessment and does not constitute legal advice.
How up to date is the regulatory content?
The regulatory snapshot is dated 2026-11-02 (version 1.0). Proposals not yet adopted are labelled as such. References point to official sources (EUR-Lex, European authorities, ISO).
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
- ISO/IEC 27001 readiness – Information security management system (ISMS) gap analysis against ISO/IEC 27001:2022 - clauses 4-10 and the 93 Annex A controls, in view of certification
- ISO/IEC 42001 readiness – AI management system (AIMS) gap analysis against ISO/IEC 42001:2023 - clauses 4-10 and the 38 Annex A controls, in view of certification
- ISO/IEC 20000-1 / ITSM maturity – Service management system (SMS) gap analysis against ISO/IEC 20000-1:2018 and maturity of the ITSM processes, with ITIL practice cross-references, in view of certification
- EU laws for Swiss companies – Scoping of GDPR, AI Act, NIS2, DORA and Cyber Resilience Act for non-EU (Swiss) companies – mapped to ISO/IEC 27001:2022
- NIST CSF 2.0 – NIST Cybersecurity Framework 2.0 (CSWP 29, 26/02/2024) - maturity by Function and Category, Current vs Target Profile - mapped to ISO/IEC 27001:2022
- SOC 2 Type II readiness – Gap analysis against the AICPA 2017 Trust Services Criteria (revised points of focus 2022) and DC 200 description criteria - mapped to ISO/IEC 27001:2022
Self-assessment tool for information purposes only; it does not constitute legal advice. Article references and dates reflect the regulatory snapshot of 02/11/2026 and must be verified against the official texts on fedlex.admin.ch (SR 235.1, SR 235.11) and FDPIC guidance. Only German, French and Italian versions of Swiss law are legally binding. Processing by federal bodies and cantonal data protection laws are out of scope. No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.