AI and data protection in Switzerland: what the FADP asks of SMEs

Most data protection problems with AI do not start with a decision. They start with copy and paste.

A customer email with a name, a phone number and contract details goes into a personal ChatGPT account so the reply is ready faster. Nobody decided anything. Yet personal data has just reached a provider your company has no contract with.

Switzerland's National Cyber Security Centre (NCSC) and the Federal Data Protection and Information Commissioner (FDPIC) call this "oversharing" and launched a joint campaign on it on 16 October 2026 (NCSC and FDPIC, 2026).

For a small business the topic comes down to a handful of questions, and each one has an article in the law. This post goes through them in order. It describes the legal position in broad terms as of October 2026 and does not replace advice on a specific case.

Does Switzerland have an AI act?

Not as of October 2026. On 12 February 2025 the Federal Council came out in favour of ratifying the Council of Europe's AI convention and amending Swiss law for it, as sector-specifically as possible: only key areas relevant to fundamental rights, such as data protection, are to get general, cross-sectoral rules (Federal Council, 12 February 2025). Switzerland signed the convention in March 2025, and the NCSC expects the consultation in January 2027, with an approach that is deliberately more streamlined than comprehensive horizontal regulation.

Until then, the law that already applies is the one that counts. The FDPIC states that the Federal Act on Data Protection "is formulated in such a way as to apply to all types of technology and is therefore also directly applicable to the use of AI-supported data processing" (FDPIC, update of 8 May 2025). Waiting for new rules is not a plan.

When the FADP applies at all

The FADP protects personal data, meaning any information relating to an identified or identifiable natural person (Art. 5 let. a FADP). In practice:

• A prompt containing website copy, a product description or a table from which nobody can be identified does not touch the FADP. No names does not mean anonymous: customer numbers, addresses or rare characteristics can make a person identifiable.
• A prompt containing a customer's name, an email address or the notes from a call does.
• Health data, religious views, biometric data that uniquely identifies a person, or data relating to administrative and criminal proceedings or sanctions count as sensitive personal data (Art. 5 let. c FADP). If you work in a practice or in HR, you reach the strictest category quickly.

The FADP does not cover trade secrets such as quotes or margins. They still belong under the same rule, for a different reason: once they are in, you will hardly get them back.

Once the FADP applies, its principles govern every processing activity: collect personal data only for a specific purpose the person concerned can recognise, process it proportionately, and destroy or anonymise it once it is no longer needed (Art. 6 FADP). The NCSC and the FDPIC put a breach of these principles first when they describe the legal risks of AI.

Personal account or business contract

When a service provider processes personal data for you, the law calls it processing by a processor. It is allowed if the provider handles the data only in the way you yourself would be permitted to, and you have satisfied yourself that it can guarantee data security (Art. 9 FADP). In addition, no statutory or contractual duty of confidentiality may prohibit the assignment (Art. 9(1)(b) FADP), professional secrecy in a medical practice being one example. It may only bring in further sub-processors with your prior approval.

A personal account does not meet that test. It is a contract between your employee and the provider, not between your company and the provider. That is why the NCSC and the FDPIC recommend using the business or enterprise version of a tool rather than personal accounts, and knowing when inputs are used for training.

What a business contract actually promises is in the provider's terms. For Microsoft 365 Copilot, which Microsoft now calls «Microsoft Copilot», Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models (Microsoft Learn, as of July 2026). That is the vendor's commitment, not an independent audit.

Another sentence on the same page matters more to a small business: Copilot only surfaces data a user already has at least view permission for. Sharing that was set too wide in SharePoint therefore becomes findable through Copilot. How to tidy up permissions first is covered in securing Microsoft 365 with Business Premium.

Data going abroad: what Art. 16 FADP requires

Most AI services process data outside Switzerland. That is allowed, but not unconditionally. Personal data may be disclosed abroad if the Federal Council has found that the destination offers adequate protection, or if appropriate safeguards are in place, such as standard data protection clauses recognised by the FDPIC (Art. 16 FADP).

For the United States the detail matters. Since 15 September 2024 the US has been on the Federal Council's list, but only for organisations certified under the Swiss-US Data Privacy Framework (DPO, Annex 1, German). Whether a provider qualifies is shown on the official Data Privacy Framework list. Without certification you need other appropriate safeguards under Art. 16(2) FADP, in practice usually standard data protection clauses in the contract, or one of the exceptions in Art. 17 FADP, such as the explicit consent of the person concerned.

Two points are easy to miss:

• The storage location is not the whole story. Microsoft notes that Copilot's calls to the language model can be routed to other regions at times of high demand.
• You have to say it. Whoever discloses personal data abroad tells the people concerned which country and, where relevant, which safeguards (Art. 19 para. 4 FADP), usually in the privacy policy.

Whether running your own infrastructure in Switzerland is the better answer depends on more than data protection. The trade-off is laid out in on-premises or cloud.

Transparency: what your customers must be told

Whoever collects personal data informs the person concerned of at least the controller's identity and contact details, the purpose and, where applicable, the recipients or categories of recipients (Art. 19(2) FADP). If AI services process customer data, they belong in the privacy policy.

For chatbots the FDPIC is more explicit: users of a language model have a legal right to know whether they are corresponding with a machine and whether their inputs are processed further (FDPIC, 8 May 2025). As a rule, a notice in the chat window and a paragraph in the privacy policy are enough, provided both say that a machine is answering and whether inputs are processed further.

When the AI decides about people

A decision that is based exclusively on automated processing and has a legal consequence for the person or a considerable adverse effect on them is an automated individual decision (Art. 21 FADP). You then inform the person, let them express their point of view on request, and have a human review the decision if they ask.

Typical cases in a small business:

• an application screened out by a tool with no person looking at it,
• a payment method or credit limit set by a system on its own,
• an application for a service rejected automatically.

The law names two exceptions: where the decision is directly connected with a contract and the person's request is granted, and where they have explicitly consented. A lead score that tells sales whom to call first, on the other hand, is profiling (Art. 5 let. f FADP) but not a decision about the person. How to build one cleanly is covered in lead scoring for SMEs.

The simplest rule: the AI proposes, a person decides, and that person is free to reject the proposal. Which processes split that way is shown in using AI in business processes.

When a data protection impact assessment is due

If processing is likely to result in a high risk to the people concerned, you carry out a data protection impact assessment beforehand (Art. 22 FADP). The law explicitly mentions the use of new technologies as a circumstance in which that risk can arise. It names two cases where it exists in particular: large-scale processing of sensitive personal data and systematic large-scale monitoring of public areas.

For a small business that means:

• Drafting, translating or summarising text without personal data: usually not.
• An AI that analyses patient files or personnel records containing health data at scale: very likely yes.
• In between: write down why you do not consider the risk high.

The FDPIC notes that high-risk AI processing is permitted in principle under the FADP, provided exactly this assessment is done. Prohibited are applications that aim to undermine privacy, such as comprehensive real-time facial recognition or "social scoring".

You only have to keep a record of processing activities from 250 employees, unless you process sensitive data on a large scale or carry out high-risk profiling (Art. 24 DPO). As a list of the AI tools running in the business, it is worth having anyway.

Security and incidents

Controllers and processors guarantee data security appropriate to the risk (Art. 8 FADP). For AI tools that means business accounts with two-factor authentication, access only for those who need it, and a look at who can read chat histories.

If an incident is likely to result in a high risk to the people affected, you report it to the FDPIC as soon as possible (Art. 24 FADP). The provider has to report a breach on its side to you just as quickly. How to close the most common gaps is covered in cyber security for SMEs.

What a breach can cost

The FADP's fines are aimed at the individuals responsible, not primarily at the company. Anyone who wilfully discloses personal data abroad in breach of Art. 16 FADP without an exception under Art. 17 applying, hands processing to a processor without meeting Art. 9, or ignores the minimum data security requirements can, on complaint, be fined up to CHF 250,000 (Art. 61 FADP). The same applies to wilfully failing to inform the people concerned (Art. 60 FADP).

The company itself can be ordered to pay a fine of at most CHF 50,000 instead of the individuals, where identifying them would be disproportionate (Art. 64 FADP). The offence itself is only punishable if committed wilfully, not through negligence. Through Art. 64 FADP, however, Art. 6(2) of the Administrative Criminal Law Act also applies: an employer who wilfully or negligently fails to prevent such an offence by an employee is subject to the same penalty provisions.

The EU AI Act: when it reaches a Swiss SME

The EU's AI regulation also applies to providers and deployers in a third country where the output produced by the AI system is used in the Union (Art. 2(1)(c) Regulation (EU) 2024/1689). For chatbots it obliges providers to ensure that people are informed they are interacting with an AI system (Art. 50(1)).

Whether that applies to your business depends on where your customers are and what the output is used for. If you deliberately target customers in the EU, also check the GDPR: it applies to companies outside the EU that offer goods or services to people in the Union or monitor their behaviour there, for example through tracking (Art. 3(2) GDPR).

The data rule in five questions

Before a team uses an AI tool, answer five questions. They fit on one page:

1. Is a person in it, in the prompt or in the data the tool can reach (mailbox, file shares, CRM)? If not, the FADP is not engaged. If so, carry on.
2. Do we have a business contract with the provider? Without one, no personal data.
3. Where does the data go? Country, certification or clauses, and whether inputs are used for training.
4. Do the people concerned know? Privacy policy, notice in the chat window.
5. Does the AI decide about people? Then Art. 21 applies, along with the question of an impact assessment.

The first question can go to the team as a single sentence: which data never belongs in an AI tool. How to phrase that sentence and measure the benefit afterwards is covered in AI strategy for SMEs.

What ALPENIQ does here

In AI governance we work out with you which AI tools are already running in the business and which data flows into them. We assess the tools for data protection and security, write the AI policy for your team and prepare you for the requirements of the EU AI Act.

What we do not do is give legal advice. For a data protection impact assessment, or a contract covering sensitive personal data, a data protection lawyer belongs at the table.

Conclusion

AI in a small business does not need a new law, it needs the existing one applied: business account instead of personal account, know where the data goes, inform openly, let people decide. With those four in place, and the principles of Art. 6 FADP observed, you cover the duties AI use touches most often. The rest is the individual case, and that is where a specialist is worth it.

Further reading

• The evidence on AI in Swiss SMEs and a measurement template: the guide AI in Swiss SMEs
• When a chatbot becomes an agent that acts on its own: AI agents for businesses
• What a language model and artificial intelligence actually mean: in the glossary

Frequently asked questions (FAQ)