AI and data protection in Switzerland: what companies need to know
Using artificial intelligence is permitted in Switzerland – but not unconditionally. As soon as employees enter personal data into an AI tool, that constitutes data processing within the meaning of the revised Federal Act on Data Protection (revFADP). The company remains responsible for it, even though the processing happens at the AI provider. Anyone with customers in Germany or Austria must also meet the GDPR – the principles are similar, the documentation requirements more formal.
This article sets out which rules apply when deploying AI, where the typical risks lie and how companies can adopt AI in line with data protection law – from transfers abroad to the data processing agreement.
Why AI tools are a data protection issue
With every prompt, data flows to the provider of the AI model. If inputs or uploaded documents contain names, customer data or health information, the company is processing personal data – with all the duties that follow from the revFADP. It becomes critical when providers use inputs to train their models or process data in third countries without an adequate level of data protection.
On top of that, many employees use AI privately and carry that habit into the office. Without clear rules, shadow AI emerges – uncontrolled use that IT knows nothing about.
Which rules apply: revFADP and GDPR
The revFADP has been in force since 1 September 2023 and requires, among other things, transparency about processing, data security in line with the state of the art and, where risk is high, a data protection impact assessment. Intentional breaches can lead to fines of up to CHF 250,000 – directed at the responsible individuals, not at the company.
Anyone serving customers in the EU must also observe the GDPR. Fines there are considerably higher: up to 20 million euros or 4 per cent of global annual turnover.
Transfers abroad: the problem with US providers
Most major AI providers are based in the USA. The US CLOUD Act of 2018 obliges American providers to hand data over to authorities on request – regardless of where the servers stand. For confidential customer and business data this is a structural risk that contractual clauses can only partly defuse.
The most robust answer is to keep data in Switzerland or the EU, with a provider that does not use inputs for training and offers a data processing agreement (DPA).
Checklist: adopting AI in line with data protection law
Adopting AI is not purely an IT project but a governance task. These points belong on the list:
- Take stock: which AI tools are already in use – officially and unofficially?
- AI policy: which data may go into which tools? What is off limits?
- Provider choice: hosting in Switzerland or the EU, no training on company data, a DPA
- Access: manage roles and permissions centrally instead of relying on private accounts
- Training: make staff aware of data protection and hallucinations
- Documentation: make use traceable, for example through audit logs
Frequently asked questions
Is ChatGPT compliant with data protection law in Switzerland?
Using it is not prohibited as such. It becomes problematic when personal data is entered into consumer versions that use inputs for training or transfer them to the USA. Companies need an enterprise solution with a DPA, clear data rules and ideally hosting in Switzerland or the EU.
Does using AI require customer consent?
Not as a general rule. The revFADP permits data processing where the principles are observed. Consent is mainly required for sensitive personal data, or where the processing would not be apparent to the people concerned.
Who is liable for data protection breaches caused by AI use?
Responsibility remains with the company processing the data – not with the AI provider. Fines under the revFADP are also directed at the responsible individuals, such as members of the management team.
Related reading
Bring AI into your company securely.
Try Vidimas with your team – and see how quickly secure AI becomes productive.
- Try it with the whole team
- Set up in minutes
- Productive from day one