Does The Federal Act On Data Protection (FADP) Require A Legal Basis For Data Processing?

Part 4 of our series on data protection law in Switzerland

In this part of our series on the revised Swiss Federal Act on Data Protection (FADP), we examine an essential compliance question: when is a legal basis required to process personal data under Swiss law? The answer depends on who is processing the data—federal bodies or private persons—and whether personality rights are affected.

Mandatory legal basis for federal bodies

Under the FADP, federal bodies, such as federal authorities and administrative units, must always have a legal basis to process personal data. This requirement reflects the constitutional principle that public bodies must act within the limits of the law when interfering with fundamental rights.