BERN. The justice ministry on Wednesday published the final draft of the revised Data Protection Act, closing a drafting process that began four years ago and sending the text to parliament for the winter session. The revision is the most consequential update to Swiss privacy law since the current act entered into force.
The draft tightens the duties around profiling, requiring companies to tell individuals when they are systematically evaluated and to offer a human review of significant automated decisions. High risk processing, a category that includes large scale health data and algorithmic tools used by public authorities, would require a documented impact assessment before it begins.
The automated decision clause has been watched most closely by the cantonal courts, several of which are piloting algorithmic sentencing aids. The draft does not ban such tools. It requires that their recommendations be explainable and that a judge remain able to depart from them without giving reasons to the software's supplier.
Fines remain directed at companies rather than individuals, capped at CHF 250,000 for serious breaches, a ceiling the business lobby defended and privacy groups describe as a rounding error for the largest platforms. The Federal Data Protection Commissioner gains the power to order a stop to unlawful processing, a remedy the office has sought for a decade.
Behind the technicalities sits the question that has driven the revision from the start: adequacy. The European Union recognises Swiss data protection as essentially equivalent to its own, a finding that lets data flow freely between Swiss and European businesses. Brussels reviews that finding periodically, and a Swiss regime that drifts too far from the GDPR risks losing it.
“Adequacy with Europe is not a badge of honour. It is a business licence,” a senior official in the justice ministry said. The draft therefore shadows the European rulebook closely on cross border transfers and processor duties, while keeping Swiss particularities, including the lighter registration regime for small firms.
Reaction split along the expected lines. The technology industry welcomed the transition periods, which run to 18 months for most duties. Civil liberties groups praised the automated decision clause and immediately demanded it be extended to insurance pricing. The cantons, which must apply the act to their own administrations, asked for money.
The timing is diplomatically convenient. The final draft lands as Geneva hosts a new round of international talks on cross border data rules, and Swiss negotiators can now point to a domestic text that is more than a promise. Officials concede the two files will be read together abroad.
Parliament takes up the bill in the winter session, with the Council of States expected to go first. If the chambers agree by next summer, the revised act would enter into force in 2028, four years after the drafting began and, its authors hope, in time for the next adequacy review.