Data Processing Agreement in Switzerland: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the contract a controller signs with a supplier that processes personal data on its behalf. In Switzerland the DPA is governed by the revised Federal Act on Data Protection (FADP, in German revDSG), which came into force on 1 September 2023, together with the Data Protection Ordinance. Switzerland is not in the EU, so the EU GDPR does not apply as domestic law, but the Swiss rules are deliberately close to it, and many Swiss companies that serve EU customers must comply with both. This page explains what a Swiss DPA must contain, how it differs from a GDPR DPA, the cross-border transfer rules, and a template outline. It is general information, not legal advice. ## Do you need a DPA in Switzerland, and under what law? Yes, whenever a processor handles personal data on behalf of a controller. The revised FADP requires that processing by a third party be governed by a contract or by law, and it sets conditions for delegating processing. A Swiss DPA is the document that meets those conditions. Two framing points: - The FADP, not the GDPR, is the Swiss base. The revised FADP applies to processing that has an effect in Switzerland, even by companies based abroad. If you also process data of people in the EU, the GDPR may apply too, and many businesses write one DPA that satisfies both regimes.

• The regulator is the FDPIC. The Federal Data Protection and Information Commissioner (FDPIC, in German EDÖB) supervises compliance. Under the revised law its powers were strengthened, and it can open investigations on its own initiative. Note that certain breaches carry criminal fines of up to CHF 250,000 directed at responsible individuals, not administrative fines on company turnover as under the GDPR. ## What a Swiss DPA must cover The FADP requires that, where processing is delegated, the processor may only process data as the controller itself is allowed to, the delegation must be agreed by contract or law, and the processor must not sub-delegate without the controller's approval. In practice a sound Swiss DPA covers: 1. Subject matter and purpose of the processing, tied to the controller's own permitted use.

2. Processing only as instructed, and only as the controller itself may process.
3. Data security appropriate to the risk (the FADP and its Ordinance require adequate technical and organisational measures).
4. Confidentiality of staff handling the data.
5. Sub-processors: no engagement without the controller's prior approval, with equivalent obligations passed down.
6. Assistance with data subject rights and with security incidents.
7. Cross-border transfer safeguards for data leaving Switzerland.
8. Return or deletion of data at the end of the service.
9. Audit and evidence of compliance. If you already run a GDPR Article 28 DPA, most of it maps across. The main adjustments are the legal references, the transfer mechanism and the terminology. ## Key clauses, and what to watch in each | Clause | What good looks like | Common weak spot | |---|---|---| | Scope and instructions | Processing only as the controller may itself process | Scope wider than the controller's own rights | | Security | Named measures matching the risk | A bare promise with no detail | | Sub-processors | Prior approval plus flow-down | Blanket consent with no control | | Cross-border transfers | A valid safeguard for non-adequate countries | Silence on where data sits | | Incident handling | A fixed notice deadline to the controller | "Promptly" with no time | | Data subject rights | Clear assistance process | Timelines and costs left open | | End of term | Return or deletion, with confirmation | No wording on backups | | Liability | Allocation matching each role | Caps that ignore Art. 100 CO limits | ## Cross-border transfers: the key Swiss point Swiss data can move freely to countries the Federal Council recognises as providing adequate protection. The list includes the EU and EEA states and several others. For a country not on that list, the DPA needs a transfer safeguard, such as the EU Standard Contractual Clauses in the version recognised by the FDPIC (often with a Swiss addendum), binding corporate rules, or another measure the FADP allows. Name where sub-processors sit so the controller can check the route. This is the clause most often missing from a reused GDPR template. ## Other Swiss points that change the drafting - One DPA for two regimes. If you serve EU and Swiss customers, draft so the DPA satisfies both the FADP and GDPR Article 28. Reference both, and use a transfer mechanism recognised under both.

• Liability line (Art. 100 CO). As with any Swiss contract, a clause excluding liability for unlawful intent or gross negligence is void under the Code of Obligations.
• Language. There is no requirement to use German, French or Italian; English DPAs are common and enforceable. FDPIC proceedings will be in an official Swiss language.
• Security specifics. The Data Protection Ordinance expects documented, risk-appropriate measures. Attach them as an annex rather than relying on a vague promise. ## A short Swiss DPA outline you can adapt 1. Parties and roles.

2. Definitions aligned to the FADP (and GDPR if dual-use).
3. Subject matter, purpose and duration (annex).
4. Categories of data and data subjects (annex).
5. Processing only as the controller may itself process.
6. Confidentiality.
7. Security measures (annex).
8. Sub-processors: approval and flow-down.
9. Cross-border transfers and the chosen safeguard.
10. Assistance with rights and incidents.
11. Audit and evidence.
12. Return or deletion at end of term.
13. Liability, term, governing law (Switzerland) and disputes.
14. Annexes: processing details, security measures, approved sub-processors. ## Common mistakes - Reusing a GDPR DPA unchanged and forgetting the Swiss transfer mechanism and FADP references.

• Giving the processor broader rights than the controller itself has.
• Leaving incident notification at "promptly" with no deadline.
• Blanket sub-processor consent with no approval or objection right.
• Ignoring that Swiss penalties target responsible individuals, which raises the stakes for accountability. ## Keeping every DPA consistent in one place Most organisations hold dozens of DPAs, each with a different sub-processor list, a different transfer route and a different review date, scattered across drives and inboxes. The work of drafting from a house standard, checking each DPA against the FADP and GDPR, tracking signatures and surfacing renewal and review dates is the work an AI contract workspace can hold in one place: draft from your own template, flag clauses that drift, keep a live timeline of versions and signatures, and raise key dates as alerts. If that is useful, Adira is built around that single-workspace idea. Deeper non-India jurisdiction coverage is on its roadmap; India is the deepest today. This article is general information about Swiss data protection practice and is not legal advice. Confirm the current FADP rules and the Federal Council adequacy list, and take qualified Swiss advice for a specific agreement.