A company subject to both the Swiss Federal Act on Data Protection (FADP) and the EU GDPR needs two incident decisions, even if one team investigates the event. Under Swiss FADP Article 24, a controller reports a data-security breach to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible when it is likely to result in a high risk to a person’s personality or fundamental rights. Under GDPR Article 33, a controller notifies the competent EU supervisory authority unless risk to natural persons’ rights and freedoms is unlikely, without undue delay and, where feasible, within 72 hours of awareness. The different thresholds can produce different outcomes for the same incident.
The revised Swiss FADP has applied since 1 September 2023. The GDPR has applied since 25 May 2018. The 2024 European Commission review of existing adequacy decisions concluded that Switzerland continues to provide adequate protection for EU transfers. It was a review of the existing 2000/518/EC decision, not a new Swiss adequacy decision numbered 2024/254. Adequacy addresses a transfer mechanism; it does not merge breach-reporting duties or decide whether each law applies to a particular controller.
The incident decision in each regime
| Decision | Swiss FADP | EU GDPR |
|---|---|---|
| Report to authority | Likely high risk to personality or fundamental rights, Article 24(1) | Notify unless risk to rights and freedoms is unlikely, Article 33(1) |
| Timing | As soon as possible after awareness; no fixed statutory hour count | Without undue delay and, where feasible, within 72 hours after awareness; reasons if later |
| Processor to controller | As soon as possible for a data-security breach, Article 24(3) | Without undue delay after awareness, Article 33(2) |
| Tell affected people | Where necessary for their protection or if FDPIC requires it, Article 24(4) | Where likely high risk, subject to Article 34 exceptions |
| Authority | FDPIC | Competent national or regional supervisory authority under GDPR rules |
The Swiss authority notice and Swiss notice to people have different triggers. The FDPIC’s 2025 breach guidelines say Article 24(4) can require informing people even where the controller has not concluded that the Article 24(1) high-risk threshold for reporting to the FDPIC is met. If people need to change a password or block a card to protect themselves, examine that duty directly. A simple “high risk means both notices; lower risk means neither” decision tree would be unsafe.
The EU also has separate decisions. Article 33 concerns the authority and uses a lower risk threshold; Article 34 concerns people and requires likely high risk, with specific exceptions in Article 34(3). For a detailed EU authority workflow, see GDPR Article 33 breach notification; for the person-facing step, see Article 34 breach communication. Record the analysis for each jurisdiction, including why an exemption applies, rather than copying the conclusion from one form into the other.
What “as soon as possible” does and does not mean
Swiss Article 24 sets no universal 72-hour deadline. The FDPIC guidance says a controller should perform an initial risk assessment promptly and report where high risk is likely; it should not wait for a long investigation to eliminate every uncertainty. Article 15 of the Swiss Data Protection Ordinance sets information for the notification, and additional details can be supplied later where they are not immediately available. Set an internal escalation target that permits immediate triage and a timely initial report, but label it an organisation’s operational target, not a statutory Swiss 72-hour clock.
The GDPR clock is also more precise than “report every breach within 72 hours.” Article 33(1) starts from controller awareness of a personal-data breach, and notification is required unless the breach is unlikely to result in risk. It requires notification without undue delay and, where feasible, within 72 hours; if later, reasons for the delay accompany it. Article 33(4) allows information in phases when not all details are available at once. Article 33(5) requires the controller to document personal-data breaches, including facts, effects and remedial action, so the authority can verify compliance. The 72-hour breach guide is useful for running that clock without treating it as a waiting period.
For both laws, put the processor contract and incident contacts to work. A Swiss processor must tell its controller as soon as possible about a data-security breach under Article 24(3); the FDPIC explains that this processor duty does not depend on the controller’s high-risk conclusion. A GDPR processor must notify its controller without undue delay after becoming aware under Article 33(2). A contractual internal deadline can help preserve time for the controller’s assessment, but neither statute creates a generic processor “24-hour” rule. Record when each party learned the facts and when information was transmitted.
A scenario: one SaaS incident, two assessments
Imagine a Swiss SaaS provider loses a support export containing account names, work email addresses and encrypted application records for both Swiss and EU customers. First establish which organisation is the controller for each record, whether the provider is acting as processor, what information was actually accessible, and whether the encryption keys were exposed. The same provider could be controller of its own support-account records and processor of customer records; the legal role follows each processing operation.
The provider should alert customer controllers promptly, even while the investigation is ongoing. Each controller then assesses its own affected people and exposure. Under FADP Article 24(1), a Swiss controller asks whether a high risk to personality or fundamental rights is likely. Under GDPR Article 33(1), an EU-scope controller asks whether risk to rights and freedoms is unlikely; if not, it prepares authority notice. Separately, each assesses the person-notice rule under Swiss Article 24(4) or GDPR Article 34. Strong encryption with uncompromised keys may materially reduce risk, but it does not automatically settle whether account names or email addresses were exposed in usable form.
If the export was briefly available to an unknown actor, document the access evidence, containment, affected fields, number and type of people, foreseeable misuse and mitigation. Where facts are incomplete, state what is known and what is being checked. Do not delay a legally required report solely to determine an exact number. Later information may change the risk assessment or the need to inform people. Keep separate decision records even if one investigation log and one incident owner coordinate them. The breach response playbook offers a broader investigation structure, while this comparison supplies the separate Swiss decision points.
The notice to people deserves its own owner
Swiss Article 24(4) requires the controller to inform affected people when necessary for their protection or when the FDPIC so requires. Article 24(5) permits limitation, delay or omission in specified situations, including overriding third-party interests, legal secrecy, impossibility or disproportionate effort, or equivalent public communication. These conditions need their own factual assessment. The FDPIC guidance explains why a person may need actionable information even when the controller views the broader authority-reporting risk as below “likely high.” Give that person a clear account of what happened and what they should do.
GDPR Article 34 asks whether the personal-data breach is likely to result in a high risk. The communication must be in clear and plain language and include at least the nature of the breach and the Article 33(3)(b)–(d) contact, likely consequences and remedial measures. Article 34(3) provides specific exceptions, for example where appropriate measures rendered the data unintelligible to unauthorised persons or subsequent measures remove the likely high risk; where individual communication would involve disproportionate effort, an equally effective public or similar measure is required. An internal label of “encrypted” or “large breach” is not by itself a complete Article 34 analysis.
Assign one person to reconcile Swiss and EU communications so messages do not contradict each other, but retain the legal distinctions. A designated GDPR data protection officer, where required, can advise and coordinate without replacing the controller as the decision-maker. A notice may need different recipients, authority references or instructions. If affected people reside in several EU states, the competent supervisory-authority analysis may involve the GDPR one-stop-shop framework and concerned authorities; the EDPB coordinates the EU authorities but is not a replacement for the competent supervisory authority receiving Article 33 notices. The FDPIC is the federal Swiss privacy supervisor; other Swiss sectoral or cantonal rules can add separate incident obligations for particular organisations.
Swiss sanctions: the CHF 250,000 figure has a narrow meaning
The Swiss FADP’s criminal provisions are not a universal fine schedule for every data breach or every late Article 24 notification. The FDPIC’s criminal-law explainer says Articles 60–63 define specific intentional offences, generally pursued against individuals, with a maximum of CHF 250,000. Article 60 covers specified duties to provide information/access and cooperation; Article 61 covers certain due-diligence duties, including conditions for disclosure abroad; other provisions address confidentiality and noncompliance with an order. Article 24 breach reporting is not itself listed as an automatic CHF 250,000 offence under Article 60.
Swiss prosecutors, not the FDPIC, impose criminal fines under the FADP. Article 64 permits a limited company fine instead of pursuing an individual where the contemplated fine does not exceed CHF 50,000 and identifying the person would take disproportionate effort. The FDPIC can investigate and issue corrective orders under its supervisory powers. Civil or other liability is a separate question. The old shorthand that every CEO or DPO personally faces a CHF 250,000 fine for a breach, while companies can never be fined, misstates this framework.
GDPR Article 83 provides administrative fine ceilings depending on the infringed provision. The upper tier is the higher of €20 million or 4% of the undertaking’s total worldwide annual turnover of the preceding financial year; the lower tier is the higher of €10 million or 2%. Those are ceilings, not automatic penalties for an incident. Article 83(2) requires a case-specific assessment of factors including nature, gravity, duration, mitigation and cooperation. A controller or processor may also face corrective measures, compensation claims and obligations under other applicable laws. The GDPR fines guide explains the tier structure without using the maximum as a prediction.
For a cross-border incident, keep the enforcement analysis separate from the notification analysis. The immediate question is what must be done to protect people and inform the right authority. Whether a specific intentional Swiss criminal offence or GDPR administrative infringement occurred depends on additional evidence. A timely report does not prove that security measures were sufficient; a breach does not automatically prove a fine-worthy violation.
Adequacy and international transfers are a different file
The EU’s Switzerland adequacy finding dates to Commission Decision 2000/518/EC. The Commission’s January 2024 report reviewed that and other older findings and concluded they continued to provide adequate protection. For EU-to-Switzerland transfers within the decision’s scope, GDPR Article 45 allows transfer without a separate Article 46 safeguard. This does not remove the ordinary GDPR duties of a controller or processor, including breach assessment. Switzerland-to-EU disclosure is governed by the Swiss FADP’s own rules and Swiss country list; do not infer it solely from the EU decision.
Transfers to other countries need a separate analysis under the applicable regime. The GDPR Article 44 transfer guide explains the EU starting point. Swiss FADP Articles 16–17 and the FDPIC’s guidance address Swiss disclosures abroad and available safeguards, including recognised clauses where appropriate. Standard clauses may require adaptation to the Swiss context; an EU adequacy finding for Switzerland does not authorise onward disclosure to every destination. Keep a trace of which exporter, importer, data and transfer rule apply.
This distinction matters in breach response. A compromised cloud environment may involve an EU customer, a Swiss service provider and infrastructure elsewhere. First determine which laws apply to the processing and who is controller or processor. Then assess the incident and notices under each law. Only then examine whether a separate transfer duty or contract was breached. Combining those questions into “our provider is in an adequate country” can miss the actual affected data flow.
A practical dual-regime decision record
Record a single incident chronology with timestamps, source evidence and who learned each fact. Add a separate line for each controller, processing activity and population of affected people. For the Swiss line, record the Article 24(1) likely-high-risk assessment, FDPIC decision and timing, and the distinct Article 24(4) person-protection assessment. For the EU line, record Article 33 risk and awareness, notification timing or reason for not notifying, and Article 34 high-risk/exception assessment. Make the evidence easy to update as the investigation changes.
Include the processor’s first alert, contractual contacts, containment, data categories, number of people where known, encryption and key status, accessibility to unauthorised parties, potential harm and protective actions. The responsible legal team should check other sectoral obligations separately, because finance, telecoms or critical infrastructure rules may impose additional incident notices. This record can support one coordinated investigation without pretending the two legal tests are identical. If assessing software for this work, the Swiss GDPR software guide gives a procurement context; ask any vendor to demonstrate separate FADP and GDPR decisions with your sample incident.
If the Swiss and EU analyses reach different results, explain why. For example, a breach may present a non-negligible risk under GDPR Article 33 but not a likely high risk under FADP Article 24(1); EU authority notification may be required while Swiss authority notification is not. Conversely, people may need a protective warning under Swiss Article 24(4) even where the Swiss authority threshold is not met. The decision should be based on exposure and likely harm, not an arbitrary internal “72-hour rule satisfies both” shortcut.
Questions teams ask
Is there a 72-hour Swiss deadline? No fixed 72-hour deadline appears in FADP Article 24. The controller must notify the FDPIC as soon as possible after awareness when likely high risk exists. A fast internal target may help, but it cannot justify waiting until hour 72. GDPR Article 33 has its own conditional 72-hour rule for reportable breaches.
Does every Swiss breach have to go to the FDPIC? No. Article 24(1) requires likely high risk to personality or fundamental rights. The processor’s duty to inform its controller is broader, and a controller may report voluntarily. Also assess whether affected people must be told for their protection under Article 24(4).
Does the FDPIC fine a business for failing to notify? The FDPIC investigates and may issue orders; Swiss criminal fines are pursued by prosecutors for specific intentional offences. Do not attach Article 60’s CHF 250,000 maximum automatically to Article 24 non-reporting. Other remedies and sectoral duties may still matter.
Who receives a GDPR breach notice? The competent supervisory authority under GDPR jurisdiction rules, ordinarily not the EDPB. For a cross-border case, identify lead and concerned authorities as applicable rather than assuming one authority for every group company.
Can we run one incident process? Yes: use one investigation and evidence log, then make and document separate Swiss and EU threshold, timing and person-notice decisions. A single process is useful only if it preserves the different legal tests.