AI and data protection in Switzerland: what management should look out for

This article provides an overview and does not replace legal advice.

1. Know which data the agent sees

Does the agent process personal data? Is sensitive personal data among it, for example health data (Art. 5 FADP)? Give it only as much as it needs for its task (Art. 6 FADP).

2. Inform the people concerned

Anyone who collects personal data must inform the data subjects (Art. 19 FADP). Update your privacy policy. If a system alone, without a person, makes a decision that has a legal effect on the person concerned or significantly affects them, a special duty to inform applies in addition (Art. 21 FADP). A good reason to leave decisions with people.

3. Bind providers by contract

AI services process data on your behalf. This requires a data processing agreement (Art. 9 FADP). Also check whether the provider uses your data to train its own models.

4. Know where the data flows

Data may only be transferred to countries with adequate protection or with suitable safeguards (Art. 16 FADP). For the USA, the Swiss-U.S. Data Privacy Framework applies to certified providers. Where that is not sufficient, there are models that run in Switzerland or in your own environment.

5. Ensure security

The FADP requires appropriate technical and organisational measures (Art. 8 FADP). For AI agents this means graded access rights, logging, approvals by people and a way to switch the agent off.

6. Assess in advance if the risk is high

If processing may entail a high risk for the data subjects, for example extensive processing of sensitive personal data, a data protection impact assessment is required beforehand (Art. 22 FADP).

What may also apply

• Professional secrecy, for example in medical practices, law firms or fiduciary offices.
• Supervisory requirements, for example for banks and insurers.
• For customers in the EU, the GDPR and the EU AI Act.