Data sovereignty
A Swiss business entrusts providers with employment contracts, dismissal files, debt enforcement extracts and tenant data. Under the revised FADP it stays responsible for that data. Here is what the law says, why the hosting location matters, and the questions to ask before signing. General information, not personalised legal advice.
What the FADP says
Reference text: the Federal Act on Data Protection (FADP), in force since 1 September 2023. Article numbers checked on Fedlex on 29 September 2026. The French and German versions are the ones that carry authority.
Personal data means any information about an identified or identifiable natural person. Some is sensitive: health, social assistance, administrative or criminal prosecutions and sanctions, biometric data and more. It calls for extra care, and an HR or tenancy file can contain some.
You may entrust processing to a provider if a contract provides for it, it only does what you could lawfully do yourself, and no duty of secrecy forbids it. You must make sure it can guarantee data security, and it may only sub-contract with your prior authorisation.
Data may only be disclosed abroad if the Federal Council has found adequate protection there, or appropriate safeguards exist (contract clauses, for example). Art. 17 allows limited exceptions, such as explicit consent.
Your files
Indicative reading: the exact classification depends on the facts of each file.
Name, address, salary, bank details: personal data. A provider that stores or drafts them is your processor under Art. 9, and the contract must say so.
They may contain medical certificates or health-related grounds: sensitive data under Art. 5 let. c no. 2. A leak carries a higher risk, and so does the security expected (Art. 8).
They reveal a person's financial situation, which comes close to profiling under Art. 5 let. f. The list of sensitive data refers to administrative and criminal prosecutions and sanctions: how an extract is classified is a case-by-case question, but care is needed either way.
ID documents, income, extracts and sometimes social assistance measures, which are sensitive data (Art. 5 let. c no. 6). The landlord stays responsible even when a tool or a property manager handles the files.
The FADP does not say that data must stay in Switzerland. It says you remain responsible for its security and that any disclosure abroad must be covered. The definition of disclosure includes making data accessible (Art. 5 let. e): remote access from abroad, for technical support for instance, deserves a look as much as the location of the servers.
Hosting in Switzerland simplifies the analysis: no transfer to justify under Art. 16 and 17 for the storage itself, and a known applicable law. It does not remove all legal exposure. A Swiss host remains subject to Swiss law, including international mutual legal assistance, through which a foreign authority may request data under the conditions of the law and the applicable treaties. A provider that belongs to a foreign group, or uses a foreign sub-processor, may also be subject to another legal system.
Location is therefore one criterion among others, to be read with the contract, the list of sub-processors and the security measures. For a specific question, the Federal Data Protection and Information Commissioner publishes guidance, and a lawyer or your data protection adviser can assess your case.
Before you sign
Servers, backups, logs: country and data centre for each. Ask for it in writing.
Contracting company, country, the group it belongs to, the law governing the contract.
An up-to-date list, and a commitment not to add any without your prior agreement (Art. 9 para. 3).
It must frame what the provider may do with the data and guarantee its security (Art. 9).
Encryption, access control, logging. If a standard is cited, ISO 27001 for instance, ask for the certificate and its scope (Art. 8).
The processor must report any breach to the controller as soon as possible, and the controller may have to notify the FDPIC (Art. 24).
Support, maintenance, subsidiaries: are there accesses from outside Switzerland, and under which safeguards (Art. 16 and 17)?
Export in an open format, actual deletion, how long backups are kept.
Example of a Swiss host
Your website (contact form, careers page, rental enquiry) also collects personal data: its host is your processor for it. Infomaniak is one example of a Swiss provider, named because its web hosting offer is public and detailed. It is neither a ranking nor an exclusive recommendation. Details are on Infomaniak's web hosting page(affiliate link).
This text is general information on Swiss data protection law, as of the date shown. It does not replace legal advice tailored to your situation. For high-risk processing, sensitive data in volume or a transfer abroad, have your contracts reviewed by a lawyer or your data protection adviser. The Data and security page describes what Clairdex does with your data.
FAQ
No, the FADP does not prescribe a location. It requires that you stay responsible, that the processor guarantees security and that any disclosure abroad complies with Art. 16 and 17. Staying in Switzerland avoids the transfer question for storage, but not remote access or mutual legal assistance.
Not entirely. It remains subject to Swiss law, international mutual legal assistance included, and may be subject to another legal system if it belongs to a foreign group. Ask the provider for its position and its procedure when an authority makes a request.
The list in Art. 5 let. c refers to administrative and criminal prosecutions and sanctions. An extract from the debt enforcement register (debts) is not expressly listed: the classification is arguable, and care remains advisable because it reveals a financial situation.
It is an affiliate link, flagged as such: Clairdex may receive a commission if you subscribe, at no extra cost. The criteria on this page apply to any host, and we do not claim this one suits every case.
A question before ordering?
A privacy policy to update, a processing contract to prepare, a doubt about your HR files: describe your situation here. Personal reply within two business days.
