Data breach notification in Switzerland: the FDPIC

A stolen laptop, a customer file sent to the wrong recipient, a hacked Microsoft 365 account, ransomware: these are all data security breaches under the nFADP. Depending on the risk to the people concerned, a data breach calls for a notification to the FDPIC, the Federal Data Protection and Information Commissioner.

The hours after discovery matter. This article summarizes what the law provides and how to prepare. It does not replace legal advice on a specific case.

What is a data breach under the nFADP?

The law speaks of a data security breach when personal data is accidentally or unlawfully lost, modified, deleted or destroyed, or disclosed and made accessible to unauthorized persons. An attack is therefore not required: a mistake is enough.

• An unencrypted laptop lost or stolen.
• An e-mail containing customer data sent to the wrong address.
• A mailbox compromised by phishing and read by a third party.
• Files encrypted or copied by ransomware.
• A file share opened by mistake to anyone with the link.

When must a breach be reported to the FDPIC?

Notification is mandatory when the breach is likely to result in a high risk to the personality or fundamental rights of the people concerned. The risk depends on the type of data (sensitive data, financial data, passwords), the number of people affected and the possible consequences: identity theft, fraud, reputational harm.

A lost encrypted laptop usually presents a low risk; a customer list with bank details published online, a high one. Notification is made as soon as possible, through the FDPIC's online portal. The law sets no number of hours, but waiting until you understand everything is not a good idea: it is better to report what you know, then complete it.

Do you need to inform the people concerned?

You also inform the people concerned when this is necessary for their protection or when the FDPIC requires it. That is the case if they can act to limit the harm: change a password, monitor their bank account, watch out for fraudulent messages that exploit the stolen data.

The message stays clear and factual: what happened, which data is affected, what you have done and what the person can do. The law provides for exceptions, for example when informing them is impossible or requires disproportionate effort; a public announcement can then replace it.

Document every breach

The controller documents breaches: the facts, their effects and the measures taken. When a breach has been reported, the Data Protection Ordinance (DPO) requires this documentation to be kept for at least two years from the notification. Keeping this log, even for minor incidents, also helps spot what keeps recurring.

The role of your IT provider

Your IT provider is often the first to see the incident: an EDR alert, a suspicious sign-in, a tampered backup. As a processor, it must inform you as soon as possible. Notifying the FDPIC remains your decision, but the provider passes on the technical information it has: initial findings, systems affected, data concerned, containment measures taken. An in-depth investigation or forensic analysis is usually a separate engagement.

Prepare before the incident with a one-page written procedure: who decides, who reports, the contact details of your provider and insurer, where the logs and backups are. Operators of critical infrastructure must also, since April 1, 2025, report cyberattacks to the FOCS within 24 hours.