Federal Act
on Data Protection
(Data Protection Act, FADP)

¹ Fed­er­al bod­ies may only pro­cess per­son­al data if there is a stat­utory basis for do­ing so.

² A stat­utory basis in a form­al law is re­quired in the fol­low­ing cases:

a.

The mat­ter in­volves the pro­cessing of sens­it­ive per­son­al data.

b.

The mat­ter in­volves pro­fil­ing.

c.

The pur­pose or man­ner of the data pro­cessing may lead to a ser­i­ous vi­ol­a­tion of the data sub­ject's fun­da­ment­al rights.

³ A stat­utory basis in a sub­stant­ive law is suf­fi­cient as the basis for pro­cessing per­son­al data un­der para­graph 2 let­ters a and b provided the fol­low­ing re­quire­ments are sat­is­fied:

a.

Pro­cessing is es­sen­tial for a task re­quired by a form­al law.

b.

The pur­pose of pro­cessing poses no par­tic­u­lar risks to the data sub­ject's fun­da­ment­al rights.

⁴ In derog­a­tion from the para­graphs 1–3, fed­er­al bod­ies may pro­cess per­son­al data if any one one of the fol­low­ing re­quire­ments is sat­is­fied:

a.

The Fed­er­al Coun­cil has au­thor­ised the pro­cessing be­cause it con­siders that the data sub­ject's rights are not at risk.

b.

The data sub­ject has con­sen­ted to the pro­cessing in the spe­cif­ic case or has made their per­son­al data gen­er­ally ac­cess­ible and has not ex­pli­citly pro­hib­ited any pro­cessing.

c.

The pro­cessing is ne­ces­sary in or­der to pro­tect the life or phys­ic­al in­teg­rity of the data sub­ject or of a third party, and it is not pos­sible to ob­tain the con­sent of the data sub­ject with­in a reas­on­able time.