Learn when Switzerland permits data transfers to third countries, which safeguards are required and who is responsible for the protection of personal data...
A transfer of personal data from Switzerland to a third country is generally permissible if the Federal Council has certified that the destination state provides an adequate level of data protection. Where this decision is lacking, additional safeguards are required, such as Standard Contractual Clauses, specific contractual clauses, Binding Corporate Rules or a statutory exception under Art. 17 DSG. Responsibility always remains with the exporting company; the FDPIC examines newly drafted clauses in particular within 90 days.
In short: - Recognised Standard Contractual Clauses do not need to be notified; bespoke contractual clauses, by contrast, are subject to notification and apply only to the specifically agreed relationship between exporter and recipient. - The exporter must assess state access, proportionality, legal remedies and independent oversight in the destination country; irremediable shortcomings may halt the transfer. - Consent, contractual necessity or legal claims may permit a transfer without an adequacy decision in an individual case, but do not support systematic or ongoing data flows. - Contractual safeguards do not prevent state access in the destination country; for particularly sensitive data, refraining from processing there may therefore be necessary.
Table of Contents
- Legal Bases: Art. 16 and 17 DSG and Annex 1 DSV
- Safeguarding Instruments Where Adequacy Is Lacking: SCC, Contractual Clauses, BCR
- Responsibility and Examination Duties: Four Guarantees, Register and Logging
- Practical Checklist: Steps Before Transfer to a Third Country
- Why Legal Support Is Worthwhile for Complex Transfers
- Our Offering: Data Protection Check and Contract Review
- FAQ
- Sources
Legal Bases: Art. 16 and 17 DSG and Annex 1 DSV
The revised Data Protection Act governs the cross-border disclosure of personal data in Art. 16 DSG. Core concept: the Federal Council determines which states offer a level of data protection equivalent to the Swiss one. This list is found in Annex 1 DSV and is reviewed periodically, because a country may change, tighten or weaken its data protection law. For the EU itself, clarity has existed for years in the opposite direction: on 15 January 2024 the European Commission confirmed that Swiss data protection law continues to meet the requirements of the GDPR, an adequacy decision that significantly facilitates data flows between Swiss companies and the EU.
Where adequacy is lacking, the route via Art. 17 DSG remains open. The exceptions are exhaustively listed there:
- Explicit consent of the data subject to the specific transfer.
- Direct connection with the conclusion or performance of a contract.
- Assertion, exercise or enforcement of legal claims before courts or authorities.
- Overriding public interest or protection of the life of the data subject.
These exceptions apply only to the individual case, not as a general justification for systematic data flows.
Safeguarding Instruments Where Adequacy Is Lacking: SCC, Contractual Clauses, BCR
Without an adequacy decision, every transfer requires its own safeguarding instrument. Three variants occur most frequently in practice:
- Standard Contractual Clauses (SCC): The FDPIC has recognised the revised EU Standard Contractual Clauses in principle; for newly drafted or adapted versions, the authority examines within 90 days whether they are approved. Where the SCC are already recognised, the notification obligation does not apply.
- Specific Data Protection Clauses: Anyone who drafts their own contractual clauses instead of relying on recognised models must notify these to the FDPIC. They apply exclusively to the specifically agreed relationship between exporter and recipient.
- Binding Corporate Rules (BCR) and International Treaties: For groups with recurring intra-group data flows, BCR provide a more stable basis than individual contracts, even though their implementation is more complex.
Where both the DSG and the GDPR apply, it is usually advisable to agree Swiss law for the contractual claims, insofar as the chosen SCC modules permit this choice of law, as this simplifies the enforcement of third-party beneficiary rights.
Pro Tip: Contractual safeguards do not work against state access rights in the destination state. For particularly sensitive data, the organisational decision against processing in the third country is often the only viable solution.
Responsibility and Examination Duties: Four Guarantees, Register and Logging
Responsibility for a lawful transfer lies with the data exporter, regardless of the instrument chosen. The FDPIC guide requires a case-by-case examination of the destination country that goes far beyond a glance at Annex 1 DSV:
- Examination of the legal situation, authority practice and independence of the judiciary in the destination state.
- Assessment based on the four guarantees: legality of state access, proportionality, legal remedies for data subjects and independent oversight.
- Documentation in the data transfer register including recipient, data categories and chosen instrument.
If the examination reveals shortcomings that cannot be compensated, the transfer may have to be suspended or terminated, as the FDPIC states, a consequence that many companies underestimate when they merely sign SCC and then file them away.
In addition, the logging obligations under Art. 4 DSV apply: in the automated processing of particularly sensitive or high-risk data, operations such as storage, modification, reading and disclosure must be logged, with an appropriate retention period and separate, access-restricted storage. Anyone who passes data on to translation service providers, for example for certified translations in an international context, should apply the same diligence; UnaLingua explains the relevant obligations when outsourcing such services.
Practical Checklist: Steps Before Transfer to a Third Country
A structured approach prevents a transfer from only being identified as impermissible after the fact:
- Inventory: Which data categories are being transferred, who is the recipient, is there a subcontractor chain and are there risks of onward transfers to further third countries?
- Legal Review: Is the destination country listed in Annex 1 DSV? If not: Do SCC, specific clauses or BCR come into question, or does an exception under Art. 17 DSG apply?
- Contractual Implementation: Use recognised SCC or draft own clauses and notify the FDPIC, depending on the chosen route.
- Technical Measures: Set up and document encryption, own key management (BYOK) or own encryption infrastructure (BYOE) as well as access controls.
- Monitoring: Periodic review of the legal situation in the destination state and clear rules on when a transfer is suspended or terminated.
Pro Tip: For cloud providers with links to the USA or other third countries, it is worth sending a specific enquiry to the provider about the subcontractor chain before a contract is signed.
Anyone wishing to assess the risks in a structured manner beforehand will find a deepening of the methodology in our article on the Data Protection Impact Assessment, and background on the obligations arising from the legislative revision in our article on the revised Data Protection Act.
Why Legal Support Is Worthwhile for Complex Transfers
As soon as data are simultaneously subject to the DSG and the GDPR, for example because a Swiss company serves customers in the EU and uses service providers in the USA, two regulatory frameworks with different deadlines, notification obligations and clause requirements overlap. It is precisely at this point that we assist our clients: we advise directly in five languages, without the need for interpreters, which avoids misunderstandings in international contractual chains. Our experience with cross-border mandates, for example in the context of Ukraine and Russia references with their own sanctions regimes, shows how quickly apparently simple data flows can develop into multi-layered compliance questions.
A mandate is particularly worthwhile when particularly sensitive data are involved, when a long subcontractor chain extends across several states or when criminal prosecution risks exist in the destination country. In such cases, a checklist alone is not sufficient; a case-by-case assessment linking legal and technical aspects is required.
— Bitblade
Our Offering: Data Protection Check and Contract Review
We support companies in precisely the steps that a lawful transfer to third countries requires:
- Data protection check in accordance with the revised DSG, including assessment of the destination state and the four guarantees.
- Review and drafting of Standard Contractual Clauses or specific contractual clauses.
- Support with communication with the FDPIC, for example regarding notifiable clauses.
We advise in several languages and accompany mandates from the initial consultation through to contractual implementation. An overview of our services in commercial and contract law can be found on our Services page; an initial consultation can be booked directly via our Packages and Fees.
This article contains general information and does not replace advice from a qualified lawyer. Consult a qualified legal professional regarding your personal situation before acting on the basis of this content.
FAQ
What Does an Adequacy Decision Mean for Switzerland in Concrete Terms?
An adequacy decision means that the Federal Council has certified a state as having a level of data protection equivalent to the Swiss one, so that data may be transferred without additional safeguards. The list of these states is in Annex 1 DSV and is reviewed periodically.
How Long Does the FDPIC Take to Examine New Standard Contractual Clauses?
The FDPIC decides on the approval of newly drafted Standard Contractual Clauses within 90 days. Already recognised SCC models, by contrast, do not need to be notified again.
Which Exceptions Does Art. 17 DSG Permit Without an Adequacy Decision?
Art. 17 DSG permits a transfer, inter alia, in cases of explicit consent, contractual necessity or for the assertion of legal claims. These exceptions apply only to the specific individual case, not as a general legal basis for ongoing data flows.
Which Guarantees Does the FDPIC Examine for Data Transfers to Third Countries?
The FDPIC guide requires an assessment based on four guarantees: legality of state access, proportionality, legal remedies for data subjects and independent oversight. If these guarantees are lacking in the destination state, the transfer may have to be suspended or terminated.
What Does an Initial Consultation for a Data Protection Check Cost?
An initial consultation and assessment is bookable with us from CHF 150 per hour. For ongoing mandates with regular advisory needs, we also offer retainer packages.
Sources