Swiss data protection in 2026: what SMEs should review

The revised FADP has applied since September 2023. The basic checklist remains relevant. In practice, questions now concentrate on AI, international services and tracking.

1. AI in everyday work#

Customer emails are often copied into AI tools before a company defines rules. The FADP is technology neutral and applies to AI processing of personal data too.

• Assess permitted tools and account settings before uploading identifiable customer data.
• Where personal data is processed, review contractual training exclusions, processing agreements and transfer safeguards.
• Minimise and tokenise sensitive fields before they reach a model where appropriate.
• Create a short internal policy defining allowed tools, data and exception approvals.

A subscription alone does not establish a legal basis or appropriate controls.

2. US transfers#

The Swiss–US Data Privacy Framework has simplified eligible transfers since September 2024, but certification must be checked for the specific organisation and documented. Do not assume all US services are covered.

Transfer frameworks and provider arrangements can change. Where migration is straightforward, Swiss or European services may reduce architectural dependencies. Assess actual protection needs rather than nationality alone.

3. Tracking#

Consent settings must match actual browser behaviour. Where consent is required, marketing tags should wait for it; a banner that leaves tracking active is ineffective.

First-party and server-side architecture can improve control and reduce some technical losses. It does not override consent. Keep the privacy notice aligned with every deployed service, including AI.

Five checks#

1. Is there an internal AI policy understood by employees?
2. Are personal-data workflows covered by suitable provider contracts and minimisation?
3. Are US certifications or other transfer safeguards verified and documented?
4. Do consent choices actually control marketing tags? Test fresh browser sessions.
5. Does the privacy notice describe the current system?

Our approach#

Technical safeguards belong in architecture: first-party measurement, AI minimisation and suitable hosting. Compliance also requires documented purposes, roles, contracts, consent, deletion and actual configuration, revisited when processing changes.