Switzerland-US Data Transfers: Is the Assessment Still Needed?

The New Swiss Data Protection Act and US Transfers

If you thought the Swiss-US data transfer saga was settled, think again. The revised Swiss Federal Act on Data Protection (nDSG) came into force on September 1, 2023, and it's shaking up the rules for sending personal data across the Atlantic. The big question: do you still need to conduct a transfer impact assessment (TIA) for US recipients? The short answer is yes—but with nuances.

Featured Snippet Bait: Under the nDSG, transfers to the US require an adequate level of protection. While the US-EU Data Privacy Framework (DPF) extends to Switzerland, it's not automatic. Swiss companies must verify if the US recipient is certified under the Swiss-US DPF extension, or else conduct a TIA and implement supplementary measures.

Why the Assessment Isn't Going Away

Let's be real: reading data protection laws is about as fun as cleaning grout with a toothbrush. But here's the deal—the nDSG doesn't just copy-paste the GDPR. It has its own list of countries with adequate protection, and the US isn't on it. The Federal Data Protection and Information Commissioner (FDPIC) hasn't issued a blanket adequacy decision for the US. So, unless your US partner is certified under the Swiss-US DPF, you're back to square one: a TIA.

Even with certification, the FDPIC has warned that the DPF may not fully align with Swiss law. For example, Swiss law requires a level of protection equivalent to its own, which is often stricter than the GDPR. So, don't pop the champagne yet.

What the Swiss-US Data Privacy Framework Actually Covers

The Swiss-US DPF, effective from July 2023, allows certified US companies to self-certify compliance with Swiss data protection principles. But here's the kicker: it only covers transfers to those certified entities. If you're sending data to a non-certified processor or a cloud provider that hasn't jumped through the hoops, you need a full TIA. And even with certification, you should monitor for any changes—like the FDPIC's recent statements questioning the framework's adequacy.

Practical Steps for Swiss Companies

So, what do you do? First, check if your US recipient is certified under the Swiss-US DPF. You can verify on the Data Privacy Framework website. If they are, you're good—for now. If not, you need to conduct a TIA, document it, and implement supplementary measures like Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs). And remember, the nDSG requires you to update your privacy notices and keep records of processing activities. It's a paperwork party, but you don't want to miss it.

FAQ